> Block everything incoming except your VPN tunnel should you need remote access
With the slight caveat that you should have at least a second out-of-band access method for when you bork your VPN config :)
With the slight caveat that you should have at least a second out-of-band access method for when you bork your VPN config :)