Hi everyone! Continuing the security topic: after you create in WireGuard the first client for yourself and one spare, it is advisable to close access to the web interface (WireGuard-UI) from outside. In this short note I’ll show how to do this using ufw-docker, leaving the panel accessible only from the internal VPN network.
Installing ufw-docker
For this, first install ufw-docker — detailed instructions here:
Allow access only from the WireGuard network
Then run the command:
ufw route allow proto tcp from 10.10.10.0/24 to any port 51821
That’s it! Now access to the web interface will be only through the internal WireGuard network.
Check the result
In the output of ufw status the rule will look like:
51821/tcp ALLOW FWD 10.10.10.0/24
Access from the WG network will be at:
The article was first published on 14.12.2022 on openode.xyz; moved and updated on 04.08.2026.