This is what a Network Slug[1] is for. "A Network Slug, or "Slug", is a transparent layer 2 firewall running on a device with only two interfaces." ... "A Sl

This is what a Network Slug[1] is for. "A Network Slug, or "Slug", is a transparent layer 2 firewall running on a device with only two interfaces." ... "A Slug has no IP address, cannot be reached on the network, and does not increment IP TTL." ... So, for instance, I have a port 22 slug that I can insert anywhere in the physical chain of a network that passively, and silently, blocks all traffic except for TCP 22.[2] You could clamp down further and restrict it to port 22 and your specific VPN endpoint IP. Foolproof ? Perhaps not - but a huge piece of defense-in-depth that makes the use of a (port 22) VPN much safer. [1] https://john.kozubik.com/pub/NetworkSlug/tip.html https://john.kozubik.com/pub/NetworkSlug/tip.html [2] https://john.kozubik.com/pub/NetworkSlug/images/sg-1000-back-vented.png https://john.kozubik.com/pub/NetworkSlug/images/sg-1000-back...