Securing a Remote Linux Host with firewalld and OpenVPN

For my experiments I'm renting a remote Linux server. As soon as it was online, it became clear that the first real problem wasn't installing software, but reducing how much of the server was exposed to the internet by default. Services like SSH are continuously scanned and probed, and a freshly provisioned host is immediately visible. This lab documents how I secured that host step by step: first by establishing a strict firewall baseline, then by introducing a private administrative VPN, and finally by removing public SSH exposure entirely. Goal The goal of this lab is to secure a rented Linux host that acts as the entry point to a private network. In this setup, the public host fronts several internal virtual machines. External HTTP(S) traffic is terminated on the host and routed to internal services via a reverse proxy, while internal systems are not directly exposed to the internet. Although built as a homelab, this mirrors real-world infrastructure patterns where a single edge no