Maintain access as a security system

A VPN you built once and never touched again drifts toward being a liability. Access systems need operation, not just installation.

Start with the population of things that can connect. Remove lost or retired devices quickly. Revoke WireGuard peers and Cloudflare device registrations that no longer belong. On the WireGuard side, the interface itself tells you which peers are alive:

sudo wg show wg0 latest-handshakes
# xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=   1785171243
# mAbc9xkQGVpDzR7wFJ2sLuNvTq81cYheKf0iW5nBOEU=   0

The number is a Unix timestamp of the last handshake. A 0 means that peer has never connected — so why is it still configured? A peer silent for months is a removal candidate: delete its [Peer] block from wg0.conf and restart the interface. On the Cloudflare side, review the device list in the dashboard and revoke stale registrations, and re-check that the enrollment rule still lists only the identities you intend.

Patch the VPN endpoint and connector host. These machines process input from the Internet by design; running last year’s cloudflared or an unpatched kernel on the WireGuard server undermines everything the tunnel protects.

Review who can edit routing and policy. A dashboard admin is a network admin, whatever their job title says.

Keep logs long enough for the risks and plan you chose. Handshake history, policy logs, and connector logs are what turn “something looks wrong” into an answer.

Test recovery without weakening access permanently. The classic failure: an outage, someone adds a broad allow rule “temporarily”, and the rule outlives the incident by years. Time-box exceptions and put the removal date in the rule’s name, where the next reviewer will trip over it.

A tunnel that still connects is not necessarily healthy. Re-run both allowed and denied tests after meaningful changes — a routing edit can widen access quietly while every existing connection keeps working.

My advice: a fifteen-minute monthly review. Peer list, device list, policies, versions, one allowed test, one denied test. Written down, every time. Boring is exactly what you want from an access system.