On: Mind your Logs: How a build log from a Jenkins lea...

[jsty]

> Block everything incoming except your VPN tunnel should you need remote access

With the slight caveat that you should have at least a second out-of-band access method for when you bork your VPN config :)

[Avamander → jsty]

True, but you know you have done your private network correctly if borking your VPN config means no access.