> Wireguard doesn't respond at all if you do not send the correct key from the start, so I'm not sure how you would write a probe for it. Is that really so? I'

> Wireguard doesn't respond at all if you do not send the correct key from the start, so I'm not sure how you would write a probe for it. Is that really so? I'm not all that familiar with Wireguard but that seems like a debugging nightmare if the client has no way to get any error pointer from the server. At least my experience from setting up some IPsec infrastructures is that client logs are essential for troubleshooting. > Most real world firewall configurations I have seen use DROP instead of REJECT, so anecdotally I'm not sure about your claim. I do advocate for DROP, but most configurations I see are default REJECT. DROP has a bunch of disadvantages that most people don't want to deal with. It messes with TCP because of the lack of ICMP responses, and overall it makes troubleshooting harder because you end up with programs hanging and time outing instead of instantaneous failure. Actually the use of REJECT is so widespread that it makes my life easier. When multiple levels of firewalls are involved, I can be quite sure that if the program hangs, it's a rule on my side, while a RST tells me that it's somewhere else. > I don't think it's particularly worrisome if someone knows I'm running Wireguard, though. Agree, though the subject is just port scanning here, not what happens beyond that.