Securing Modern Infrastructure: Implementing Firezone with Google Workspace OIDC for Developer SSH Access

The Evolution of Secure Remote Access

In the modern DevOps landscape, the traditional perimeter-based security model is no longer sufficient. As engineering teams become increasingly distributed, providing secure, low-latency access to internal servers and staging environments has become a primary challenge for Infrastructure Leads. The standard practice of exposing SSH ports to the public internet—even with key-based authentication—presents an unnecessary attack surface. Enter Firezone, an open-source remote access platform built on the WireGuard® protocol, which, when integrated with Google Workspace OIDC, provides a robust Zero Trust solution for managing developer access.

Why Firezone and WireGuard?

Before diving into the implementation, it is essential to understand why Firezone has emerged as a preferred alternative to traditional VPNs like OpenVPN or IPsec. Firezone leverages WireGuard, a modern VPN protocol that aims for better performance, simpler configuration, and stronger cryptography.

Performance: WireGuard is implemented in the Linux kernel space, resulting in significantly higher throughput and lower latency compared to userspace implementations.
Simplicity: With a much smaller codebase than its predecessors, WireGuard is easier to audit and less prone to vulnerabilities.
Battery Efficiency: For developers working on mobile workstations, WireGuard’s stealthy nature and efficient handshake process conserve battery life and maintain stable connections during network transitions.

The Power of Identity-Based Access Control

Integrating Google Workspace (GWS) via OpenID Connect (OIDC) transforms your VPN from a simple encrypted tunnel into an identity-aware gateway. By using OIDC, you ensure that only active employees in your Google directory can authenticate. This centralizes user management: when a developer leaves the company and their GWS account is suspended, their access to the VPS infrastructure is automatically revoked, eliminating the risk of 'orphan' SSH keys.

Architectural Overview

The solution involves three primary components:

The Gateway (VPS): A Linux-based VPS (Ubuntu 22.04/24.04 recommended) acting as the Firezone server.
The Identity Provider (IdP): Google Cloud Console configured to provide OIDC credentials.
The Clients: Developers using Firezone clients to establish secure tunnels to target resources.

Phase 1: Preparing the Google Cloud Console

To enable OIDC, you must first register Firezone as an application within your Google Cloud ecosystem.

Step 1: Create OAuth 2.0 Credentials

Navigate to the APIs & Services > Credentials section. Create a new OAuth Client ID. You will need to provide a 'Redirect URI,' which typically follows the format: [https://firezone.yourdomain.com/auth/oidc/google/callback](https://firezone.yourdomain.com/auth/oidc/google/callback). Secure the Client ID and Client Secret generated here; these are the keys to your identity integration.

Step 2: Configure the Consent Screen

Ensure the OAuth consent screen is set to Internal. This restricts access strictly to users within your organization's domain, providing an immediate layer of security against external authentication attempts.

Phase 2: Deploying Firezone on the VPS

Firezone is most efficiently deployed using Docker Compose. This ensures that all dependencies, including the PostgreSQL database and Phoenix-based web interface, are orchestrated correctly.

Prerequisites

Ensure your VPS has a public IP and that ports 80/tcp, 443/tcp, and 51820/udp (WireGuard's default) are open in your firewall (UFW or security groups).

The Installation Script

Execute the official Firezone auto-installer, which handles the generation of secrets and configuration files:

bash <(curl -fsSL [https://raw.githubusercontent.com/firezone/firezone/master/scripts/install.sh](https://raw.githubusercontent.com/firezone/firezone/master/scripts/install.sh))

During the installation, you will be prompted to enter your external URL. Ensure this matches the domain name you pointed to your VPS IP address.

Phase 3: Integrating OIDC with Firezone

Once Firezone is running, log in to the admin portal using the default credentials provided at the end of the installation script.

Configuration Steps

Navigate to Settings > Security.
Enable OIDC and select 'Google' as the provider.
Input the Client ID, Client Secret, and the Discovery Document URL (usually [https://accounts.google.com/.well-known/openid-configuration](https://accounts.google.com/.well-known/openid-configuration)).
Map the 'Email' scope to ensure Firezone can identify users correctly.

Once saved, developers will see a 'Sign in with Google' button on their login screen, streamlining the onboarding process significantly.

Phase 4: Managing SSH Access via Firezone

With the infrastructure in place, you can now define how developers access your internal VPS services. Instead of exposing port 22 to the 0.0.0.0/0 range, you should restrict SSH to the WireGuard interface IP range (typically 10.3.2.0/24).

Creating Resources

In the Firezone UI, create a 'Resource.' A resource can be a single IP address (the internal IP of the VPS itself) or a CIDR range of your entire staging VPC. Assign these resources to specific Groups (e.g., 'Backend-Devs' or 'DevOps-Lead').

Client Side Configuration

Developers simply need to install the Firezone client for macOS, Linux, or Windows. Upon logging in via their Google account, the WireGuard tunnel is automatically configured. They can then SSH into the VPS using its internal VPN IP: ssh [email protected]. This ensures that the SSH service remains invisible to the public internet, effectively neutralizing brute-force attacks.

Best Practices for Security and Maintenance

To maintain a high-security posture, consider the following advanced configurations:

Enable MFA: Enforce Multi-Factor Authentication at the Google Workspace level. This ensures that even if a developer's password is compromised, the VPN remains secure.
Strict Egress Rules: Use Firezone to restrict developer access only to the specific servers they need for their current project.
Logging and Monitoring: Monitor Firezone logs to audit who is connecting and when. Integrate these logs with a SIEM for real-time alerting on suspicious patterns.

Conclusion

Implementing Firezone with Google Workspace OIDC on a VPS is a transformative step for any engineering team. It replaces cumbersome, legacy VPN hardware and insecure SSH practices with a modern, Zero Trust framework. By leveraging the speed of WireGuard and the centralized identity management of Google, you provide your developers with a seamless, high-performance workflow while significantly reducing your organization's attack surface. As the digital landscape continues to evolve, tools that prioritize both security and developer experience will remain the cornerstone of successful infrastructure management.