trade/trade-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(step1): note ufw inactive and safe enable commands

Browse Source
This commit is contained in:
u1
2026-02-07 13:56:44 +01:00
parent 16c99e021c
commit 98572612c4
1 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
doc/step-001-order-wg-then-ssh.txt
View File

@@ -47,6 +47,18 @@ Na baremetalu:
sudo ufw enable sudo ufw enable
sudo ufw status verbose sudo ufw status verbose
Uwagi:
- Jesli `sudo ufw status verbose` pokazuje "Status: inactive", to reguly NIE dzialaja.
- W takim wypadku wlacz UFW bezpiecznie (zostawiajac dostep przez WG):
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 51820/udp
sudo ufw allow in on wg0 to any port 22 proto tcp
sudo ufw deny in on eth0 to any port 22 proto tcp
sudo ufw enable
sudo ufw status verbose
4) Przestawienie SSH na "tylko WireGuard" 4) Przestawienie SSH na "tylko WireGuard"
1) Najpierw pozwol na SSH po wg0: 1) Najpierw pozwol na SSH po wg0:
sudo ufw allow in on wg0 to any port 22 proto tcp sudo ufw allow in on wg0 to any port 22 proto tcp
@@ -74,4 +86,3 @@ Z klienta:
Docelowo: Docelowo:
- bind RPC/WS na 10.66.66.1 (wg0) - bind RPC/WS na 10.66.66.1 (wg0)
- UFW: allow 8899/8900 tylko "in on wg0" - UFW: allow 8899/8900 tylko "in on wg0"