I want to restrict a few business applications hosted on cloud, to only our employees using Wireguard VPN (client server setup, with split tunnel for their private browsing).
For the applications running on standalone server with static IP, we can achieve this easily, by adding their IPs in wireguard "Allowed IPs" and creating a firewall rule in the application server to only accept connections from our VPN server (also hosted on cloud). Please note that Wireguard routes this in layer 4.
But for applications using a application load balancer or serverless setup, which do not have a static IP, we use a proxy server like Cloudflare which has a IP range, which we then add in Wireguards allowed IPs. This is a layer 7, solution.
Is there a better way (preferably on layer 4), to restrict access to applications without static IPs using Wireguard VPN.
Also, we have a private DNS in the VPN server, which may be used in designing the solution.
Thanks Vivek