4 ms·
Deny by default and Defense in depth are good security approaches in many organisations. I may have a critical server that only comes from 1-2 known, static, I
by yardstick 4y ago
Deny by default and Defense in depth are good security approaches in many organisations.
I may have a critical server that only comes from 1-2 known, static, IPs.
Repeat this for dozens of servers. Now treat each of these servers as third parties not under your control. I don’t want one of these third parties using a key that doesn’t belong to them. As a silly example, let’s say I send one third party the key for my super important server by mistake. I would prefer it simply wasn’t able to connect.
- bongobingo1 4y agoMy point is, you deny by default and only allow your static ips at the FW. You need a firewall rule anyway to let the wg traffic through. WG was built to handle roaming, and the FW can do a great job of filtering by address already, so it makes sense to not bloat wg with extra code to me.
- yardstick 4y agoBut the FW can’t filter by source IP and key, which is important to some people. There’s a gap in security coverage between WG and FW. This is commonly supported by IPsec implementations already. Remember your WG service could be terminating many tunnels from many different sources. Some yes roaming may be valid. Others not. There is no way in WG to selectively disable roaming for some keys but not others. This may be an intentional design decision in WG but I would argue it’s a poor one due to the above.
- bongobingo1 4y agoAh yes, great point.