▲ 66 ▼ How much do you secure a home server that's only accessible with VPN? (programming.dev) submitted 4 months ago by jello@programming.dev to c/selfhosted@lemmy.world 30 comments fedilink hide all child comments I have a VPS that I secure as much as possible since the IP is public, but does a wireguard-access-only homelab warrant the same efforts? Those with homelabs like this, what do you do?
[–] possiblylinux127@lemmy.zip -4 points 4 months ago (6 children) Putting it on a non standard port will change nothing permalink fedilink source parent hideshow 6 child comments replies: [–] surewhynotlem@lemmy.world 15 points 4 months ago (3 children) Security through obscurity is not sufficient. It's also not nothing. permalink fedilink source parent hideshow 3 child comments replies: [–] possiblylinux127@lemmy.zip 4 points 4 months ago (2 children) Wireguard doesn't respond to port scans so it changes nothing permalink fedilink source parent hideshow 2 child comments replies: [–] surewhynotlem@lemmy.world 11 points 4 months ago* (1 child) Assume a security researcher finds a bug in wireguard that, if sent a malformed packet, it can crash the service. Then it would be trivialy easy to send that packet to the default port on every IP address and just crash everything for fun. It costs me nothing to increment the port by 1 and avoid all that drama. permalink fedilink source parent hideshow 1 child comment replies: [–] Cyber@feddit.uk 7 points 4 months ago And, to be fair, you'll know more about your setup when you don't use the defaults as you have to learn more... permalink fedilink source parent [–] 0x0@infosec.pub 2 points 4 months ago* (1 child) It is going to make fingerprinting more annoying while evading default port scans. That isnt nothing but you do you boo permalink fedilink source parent hideshow 1 child comment replies: [–] sandwichsaregood@lemmy.world 1 point 4 months ago I agree that there is some value to obscurity generally, but Wireguard already evades port scans and fingerprinting. Unless a packet is signed with a known key, it gives no response to traffic, so scanners and fingerprinters see a closed port. You ISP can identify WG traffic while you are connected by inspecting your traffic, but random scanners won't see anything. Look on shodan, you won't see Wireguard. permalink fedilink source parent
[–] surewhynotlem@lemmy.world 15 points 4 months ago (3 children) Security through obscurity is not sufficient. It's also not nothing. permalink fedilink source parent hideshow 3 child comments replies: [–] possiblylinux127@lemmy.zip 4 points 4 months ago (2 children) Wireguard doesn't respond to port scans so it changes nothing permalink fedilink source parent hideshow 2 child comments replies: [–] surewhynotlem@lemmy.world 11 points 4 months ago* (1 child) Assume a security researcher finds a bug in wireguard that, if sent a malformed packet, it can crash the service. Then it would be trivialy easy to send that packet to the default port on every IP address and just crash everything for fun. It costs me nothing to increment the port by 1 and avoid all that drama. permalink fedilink source parent hideshow 1 child comment replies: [–] Cyber@feddit.uk 7 points 4 months ago And, to be fair, you'll know more about your setup when you don't use the defaults as you have to learn more... permalink fedilink source parent
[–] possiblylinux127@lemmy.zip 4 points 4 months ago (2 children) Wireguard doesn't respond to port scans so it changes nothing permalink fedilink source parent hideshow 2 child comments replies: [–] surewhynotlem@lemmy.world 11 points 4 months ago* (1 child) Assume a security researcher finds a bug in wireguard that, if sent a malformed packet, it can crash the service. Then it would be trivialy easy to send that packet to the default port on every IP address and just crash everything for fun. It costs me nothing to increment the port by 1 and avoid all that drama. permalink fedilink source parent hideshow 1 child comment replies: [–] Cyber@feddit.uk 7 points 4 months ago And, to be fair, you'll know more about your setup when you don't use the defaults as you have to learn more... permalink fedilink source parent
[–] surewhynotlem@lemmy.world 11 points 4 months ago* (1 child) Assume a security researcher finds a bug in wireguard that, if sent a malformed packet, it can crash the service. Then it would be trivialy easy to send that packet to the default port on every IP address and just crash everything for fun. It costs me nothing to increment the port by 1 and avoid all that drama. permalink fedilink source parent hideshow 1 child comment replies: [–] Cyber@feddit.uk 7 points 4 months ago And, to be fair, you'll know more about your setup when you don't use the defaults as you have to learn more... permalink fedilink source parent
[–] Cyber@feddit.uk 7 points 4 months ago And, to be fair, you'll know more about your setup when you don't use the defaults as you have to learn more... permalink fedilink source parent
[–] 0x0@infosec.pub 2 points 4 months ago* (1 child) It is going to make fingerprinting more annoying while evading default port scans. That isnt nothing but you do you boo permalink fedilink source parent hideshow 1 child comment replies: [–] sandwichsaregood@lemmy.world 1 point 4 months ago I agree that there is some value to obscurity generally, but Wireguard already evades port scans and fingerprinting. Unless a packet is signed with a known key, it gives no response to traffic, so scanners and fingerprinters see a closed port. You ISP can identify WG traffic while you are connected by inspecting your traffic, but random scanners won't see anything. Look on shodan, you won't see Wireguard. permalink fedilink source parent
[–] sandwichsaregood@lemmy.world 1 point 4 months ago I agree that there is some value to obscurity generally, but Wireguard already evades port scans and fingerprinting. Unless a packet is signed with a known key, it gives no response to traffic, so scanners and fingerprinters see a closed port. You ISP can identify WG traffic while you are connected by inspecting your traffic, but random scanners won't see anything. Look on shodan, you won't see Wireguard. permalink fedilink source parent