3 ms·
vpn + port knocking should be good enough but I am not sure how to implement it in an efficient way (I currently only use a VPN) https://www.howtogeek.com/1056
by coronadisaster 6y ago
vpn + port knocking should be good enough but I am not sure how to implement it in an efficient way (I currently only use a VPN)
https://www.howtogeek.com/105693/how-to-knock-into-your-network-part-2-protect-your-vpn-dd-wrt/ https://www.howtogeek.com/105693/how-to-knock-into-your-netw...
- yjftsjthsd-h 6y agoDoes this have any advantages over using plain wireguard? WG operates purely over UDP and doesn't respond unless you send it packets with an authorized key, so it's essentially the VPN and port knocking all in one.
- coronadisaster 6y agoI guess if you only have the key, you would still need to figure out how to use it
- yjftsjthsd-h 6y agoI think "attacker has a private key" is an unreasonable threat model to protect against, not least because the key is so much harder to crack than port knocking. The benefit to port knocking is against information disclosure ("this server is running Apache httpd version x.y and sshd version z"), brute force, noisy logs, and pre-auth vulnerabilities (things like heartbleed and shellshock). While in theory I suppose wireguard could be affected by pre-auth vulnerabilities and maybe a completely blind bruteforce attack, it's a listening UDP port that doesn't respond until it sees valid credentials, so it's completely invisible to an attacker.