VPN software usually is built strong to begin with, and any vulnerabilities discovered will be promptly fixed as well, so updating frequently should suffice. (Why not automate it with unattended-upgrades package?
Using a random high port number will probably hide it well enough for Internet-wide port scanners as well.
if you want to be extra paranoid, you can hide the VPN service behind a port knocker as well.
Updating without a reboot only works for wireguard-go. The default implementation runs in the kernel. An update to it would require kernel live patching.
Wireguard doesn’t answer to unsigned packets. Using obscure ports or even port knocking is rather pointless. It’s indistinguishable from a closed port.
I’d rather take Casaos out of the equation and target Ubuntus’ Wireguard stack instead.
Good point, kernel updates should be paired with reboots to get kernel patches applied quickly.
Yes wireguard would only accept connections clfrom clients with known certificates, but this is “belt and suspenders” approach. What happens if there’s a bug in wireguards packet parsing or certificate processing? Using port knocking would protect against this —very remote— possibility.
Not to knock on the security, but what is the threat model you are protecting against?
I see people harp on about security and you can do X or you need to do Y as if they hold a million bucks in Bitcoin to protect.
We make concessions every day with security for convenience. Most people’s threat model doesn’t include wire guard might respond to connection attempts without the proper key AND this will somehow allow an attacker to leverage a vulnerability in wire guard to gain access. However, I admit that some people’s paranoia makes them want to add every bit of security they possibly can even if it’s the most frustrating day to day usage.
Self hosting individuals aren’t a lucrative target for ransomware. Nor is it for most targeted hacking attempts.
i also think that it’s overkill, especially for a minimalistic tool like wireguard. That’s why I mentioned “if you want to be extra paranoid”. This forum is for learning, and this question is an open ended learning question, hence, an opportunity to learn about port knocking, even if the actual real life benefit of that would be minuscule.
Wireguard runs over UDP, the port is undistinguishable from closed ports for most common port scanning bots. Changing the port will obfuscate the traffic a bit. Even if someone manages to guess the port, they’ll still need to use the right key, otherwise the response is like from a wrong port - no response. Your ISP can still see that it’s Wireguard traffic if they happen to be looking, but can’t decipher the contents.
I would drop containers from the equation and just run Wireguard on the host. When issues arise, you’ll have a hard time identifying the problem when container networking is in the mix.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
VPN software usually is built strong to begin with, and any vulnerabilities discovered will be promptly fixed as well, so updating frequently should suffice. (Why not automate it with
unattended-upgradespackage?Using a random high port number will probably hide it well enough for Internet-wide port scanners as well.
if you want to be extra paranoid, you can hide the VPN service behind a port knocker as well.
Do you really know how Wireguard works?
Updating without a reboot only works for wireguard-go. The default implementation runs in the kernel. An update to it would require kernel live patching.
Wireguard doesn’t answer to unsigned packets. Using obscure ports or even port knocking is rather pointless. It’s indistinguishable from a closed port.
I’d rather take Casaos out of the equation and target Ubuntus’ Wireguard stack instead.
Good point, kernel updates should be paired with reboots to get kernel patches applied quickly.
Yes wireguard would only accept connections clfrom clients with known certificates, but this is “belt and suspenders” approach. What happens if there’s a bug in wireguards packet parsing or certificate processing? Using port knocking would protect against this —very remote— possibility.
Not to knock on the security, but what is the threat model you are protecting against?
I see people harp on about security and you can do X or you need to do Y as if they hold a million bucks in Bitcoin to protect.
We make concessions every day with security for convenience. Most people’s threat model doesn’t include wire guard might respond to connection attempts without the proper key AND this will somehow allow an attacker to leverage a vulnerability in wire guard to gain access. However, I admit that some people’s paranoia makes them want to add every bit of security they possibly can even if it’s the most frustrating day to day usage.
Self hosting individuals aren’t a lucrative target for ransomware. Nor is it for most targeted hacking attempts.
i also think that it’s overkill, especially for a minimalistic tool like wireguard. That’s why I mentioned “if you want to be extra paranoid”. This forum is for learning, and this question is an open ended learning question, hence, an opportunity to learn about port knocking, even if the actual real life benefit of that would be minuscule.
Wireguard runs over UDP, the port is undistinguishable from closed ports for most common port scanning bots. Changing the port will obfuscate the traffic a bit. Even if someone manages to guess the port, they’ll still need to use the right key, otherwise the response is like from a wrong port - no response. Your ISP can still see that it’s Wireguard traffic if they happen to be looking, but can’t decipher the contents.
I would drop containers from the equation and just run Wireguard on the host. When issues arise, you’ll have a hard time identifying the problem when container networking is in the mix.
+1 on not using containers.for Network routing stuff That way lies pain and misery.
Fair enough. I’ve had success with it though. I should probably just use the official wireguard not wg-easy