0

My scenario:

  • I want to expose Wordpress REST API only to the public (for a headless CMS), and close down everything else (security risk)
  • I want to be able to access a Wordpress installation from anywhere (home, office, laptop when traveling)
  • I don't want anyone else to access this Wordpress installation at all. The only public endpoint should be /wp-json/

My solution:

  • Create a VPC and host Wordpress on EC2 or some other AWS service
  • Expose the /wp-json/ REST API using API gateway
  • Deny access to the rest of the Wordpress installation for everyone but my own IP

Problem:

  • My IP is not the same at home, office or when traveling.
  • My IP is dynamic.
  • How can I make sure I can access the /wp-admin/ from anywhere in the world with the right credentials

Possible solutions:

  • VPN
  • SSH tunnel
  • ???

How can I solve this?

0

I would say go with VPN. We use https://pritunl.com/ for the same purpose. To restrict access what we have done is:

  1. Install pritunl on a small EC2 instance (even a t2.small works).
  2. Attach an elastic IP to it.
  3. For all the resources restrict access to the elastic IP only.
  4. Now since you will be launching these resources in a VPC add routes in the server corresponding to that VPC (The CIDR of the VPC).

This ensures that the IP of your VPN server never changes and you can access your resources from wherever you want.

P.S. If you're launching the VPN server in the same VPC as the resource you won't have to do a VPC peering but in case you're going with a different VPC peer the two VPCs.

Pro Tip: Don't use the AWS default VPC, rather launch a new VPC and launch your resources in that. That way if you ever want to have your resources peered to a default VPC in a different region you can do it easily. Will come in handy in case you ever want to migrate your resources from one AWS region to another.

Hope this helps.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.