UFW
Allow ports only on specific interface
sudo ufw allow in on tailscale0 to any port 22 proto tcp
Workstation UFW config
sudo ufw allow in on tailscale0 to any port 22 proto tcp
sudo ufw allow in on tailscale0 to any port 9100 proto tcp
sudo ufw deny from 10.0.0.235 to any
sudo ufw deny from <moonshadow tailnet IP> to any
UFW (iptables) rules are applied in order of appearance, so inspection ends immediately on the first match. If access to port 22 is allowed from a particular subnet first, and then a rule is added which blocks incoming on port 22 from an IP address in that subnet, the latter rule will not be applied. To avoid this, we must edit /etc/ufw/before.rules.
Add the following line after the line # End required lines:
-A ufw-before-input -s 10.0.0.235 -j DROP`
Save the file, and reload the firewall.
sudo ufw reload