Put SSH Behind Tailscale and Close Port 22

说明与用途

SSH 通过 Tailscale 私有网络访问，关闭公共端口 22，访问仅限 VPN。

问题

Exposing SSH on the public internet increases attack surface and scanning risk.

结果

SSH access is now confined to a private Tailscale network, eliminating exposure to public port 22 while maintaining secure key‑based authentication.

工作流

• Install Tailscale on server and client and authenticate
• Verify server’s 100.x.x.x address and test SSH over it
• Disable key expiry for the server in Tailscale admin console
• Allow traffic on tailscale0 in UFW and remove OpenSSH rule
• Confirm UFW rules and that sshd still listens on 0.0.0.0:22
• Test new SSH session over Tailscale before closing old one
• Keep provider console as recovery path
• If misconfiguration occurs, re‑open public SSH first

证据

Verified end to end on a real Ubuntu 24.04.4 server: joined a tailnet, allowed tailscale0 in UFW, and removed the public port 22 rule.

来源

Disable key expiry on the server in the admin console, or Tailscale logs you out in 180 days and you cannot reauth remotely.

来源