Restrict a full client to one private server

The problem

A broad VPN profile can expose neighboring systems when the user only needs SSH, RDP, HTTPS, or a database on one server.

Choose and scope the connection model

Model access as user to group to publisher. The full client provides WireGuard, routes, and split DNS, while the restricted policy narrows broker enforcement to the approved rule.

1. 1Deploy a publisher that can reach the server and expose its containing CIDR.
2. 2Create a dedicated group and link it to the publisher with restricted access.
3. 3Add an effective AccessRule for the server /32 and required TCP port, then assign the user.
4. 4Run wireztna connect and open the server's private hostname or IP with its normal credentials.

When this pattern fits

• A support user needs SSH, RDP, HTTPS, or database access to one server.
• The user benefits from private DNS and native client behavior.
• The organization can maintain explicit restricted access rules.
• The target service authenticates each user separately.

Security boundary and limitations

• A group assignment or published app entry alone does not enforce one-host, one-port access. Verify the restricted policy and effective rule.
• The server still needs individual accounts, hardening, session controls, and audit logs.
• Add explicit rules for additional destinations instead of describing CIDR-wide access as server-specific.