Complete procedures with a way back.

Build a routed full-tunnel OpenVPN service with Easy-RSA, an owned nftables policy, a tested encrypted client profile, and rehearsed certificate revocation.

Create a minimal routed WireGuard VPN with protected keys, explicit peers, constrained forwarding, and peer removal.

Create a default-deny host firewall with loopback, established traffic, controlled SSH, service ports, logging, validation, and rollback.