> We have a WireGuard mesh internally I’ve got one too, and I ssh over Wireguard to various machines in the mesh. But I’ve been thinking recently that one big

> We have a WireGuard mesh internally I’ve got one too, and I ssh over Wireguard to various machines in the mesh. But I’ve been thinking recently that one big shared Wireguard internal VPN that lets every machine get access to all ports of one-another is really not ideal. And in light of that; if my Wireguard setup was more strict, then perhaps I would not even need ssh. But on the other hand I would prefer to keep my defences deep. I sleep better knowing that even if I mess up something with the Wireguard setup and the listening ports and addresses for host logins at least everything still has ssh protecting it.