DSPT Evidence: IT supplier statement confirming firewall configuration, or network diagram
VeriPath services are hosted on Fasthosts Internet Ltd VPS (ISO 27001 certified, UK based).
| Server | IP | Role |
|---|---|---|
| Primary | 88.208.212.211 | Application hosting |
| Backup | 77.68.112.126 | Off-site encrypted backups |
Firewall and boundary controls are configured and verified by Security Operations.
INTERNET
│
┌────┴────┐
│ :443 │
└────┬────┘
│
╔══════════╧══════════╗
║ Fail2ban ║
║ (SSH + Nginx logs) ║
╚══════════╤══════════╝
│
┌──────────┴──────────┐
│ gp_booking_nginx │
│ (reverse proxy) │
└──────────┬──────────┘
│
┌───────────────┼───────────────┐
│ │ │
┌────┴────┐ ┌────┴────┐ ┌────┴────┐
│ Django │ │ Wiki.js │ │ Forgejo │
│ App │ │ │ │ (Git) │
└─────────┘ └─────────┘ └─────────┘
ADMIN ACCESS (WireGuard VPN only):
┌──────────┐ ┌──────────┐
│ Staff │────▶│ VPS │
│ Device │ │ 10.0.0.1 │
│10.0.0.x │ │ SSH:22 │
└──────────┘ └──────────┘
UFW (host firewall): default deny inbound — only ports 80, 443, and 51820 (WireGuard) open to the internet. SSH (port 22) restricted to the WireGuard subnet 10.0.0.0/24. All other ports blocked.
WireGuard VPN: all admin access requires connection to the encrypted VPN tunnel. SSH is not reachable from the public internet.
Fail2ban (intrusion prevention): monitors SSH auth logs and Nginx access/error logs. After 5 failed SSH attempts or suspicious URL scans, the attacker's IP is automatically blocked via UFW.
SSH hardening: password authentication disabled; public key authentication only.
TLS: all web traffic encrypted via Let's Encrypt; Nginx terminates TLS and reverse-proxies to backend apps.
Standard 9 evidence is satisfied by this page (IT supplier statement + network diagram) and verified via live output of ufw status verbose, fail2ban-client status, and /etc/ssh/sshd_config on the primary VPS.