3 ms·
> A nice aspect of wireguard is that it's "steath", meaning that it does not respond to unauthenticated connections at all, so there is no way to probe and scan
by runeks 3y ago
> A nice aspect of wireguard is that it's "steath", meaning that it does not respond to unauthenticated connections at all, so there is no way to probe and scan for wireguard listeners at all.
I did not know this. That’s really cool.
Is it done over a stateless protocol like UDP, or is a TCP connection opened first? Ie. is it impossible to see if there’s even a server there at all, or is it first revealed that there’s a server accepting a TCP connection?
- omegabravo 3y agoIt's over UDP, you can't probe for wireguard AFAIK
- lyu07282 3y agodepends on your firewall, lots of setups give you an ICMP port unreachable in response to probing closed udp ports so you can often tell a wireguard host if the default port doesn't (in practice)
- jofla_net 3y agoopenvpn has had an option for such behavior (over udp obviously) for a while. the option is called tls-auth, it requires you to go through and generate an aditional key which has to exist on all clients and server. Last i remember is that even if you scan the server, it is completely quiet unless the right signature is received as well for each frame.