From 98572612c4279e5916426b260d88b0740bb4773c Mon Sep 17 00:00:00 2001 From: u1 Date: Sat, 7 Feb 2026 13:56:44 +0100 Subject: [PATCH] docs(step1): note ufw inactive and safe enable commands --- doc/step-001-order-wg-then-ssh.txt | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/doc/step-001-order-wg-then-ssh.txt b/doc/step-001-order-wg-then-ssh.txt index bcbfbea..875da71 100644 --- a/doc/step-001-order-wg-then-ssh.txt +++ b/doc/step-001-order-wg-then-ssh.txt @@ -47,6 +47,18 @@ Na baremetalu: sudo ufw enable sudo ufw status verbose +Uwagi: +- Jesli `sudo ufw status verbose` pokazuje "Status: inactive", to reguly NIE dzialaja. +- W takim wypadku wlacz UFW bezpiecznie (zostawiajac dostep przez WG): + + sudo ufw default deny incoming + sudo ufw default allow outgoing + sudo ufw allow 51820/udp + sudo ufw allow in on wg0 to any port 22 proto tcp + sudo ufw deny in on eth0 to any port 22 proto tcp + sudo ufw enable + sudo ufw status verbose + 4) Przestawienie SSH na "tylko WireGuard" 1) Najpierw pozwol na SSH po wg0: sudo ufw allow in on wg0 to any port 22 proto tcp @@ -74,4 +86,3 @@ Z klienta: Docelowo: - bind RPC/WS na 10.66.66.1 (wg0) - UFW: allow 8899/8900 tylko "in on wg0" -