3 ms·
Completely agreed, and that seems like best practice even at home let alone "the most sensitive networks" which should be running zero trust. Text traffic or ev
by xoa 3y ago
Completely agreed, and that seems like best practice even at home let alone "the most sensitive networks" which should be running zero trust. Text traffic or even most web interfaces at this point are so lightweight and Noise-based VPNs so performant that even if theoretically there are inefficiencies in running it through other layers of tunnels in practice it's zero issue outside of extreme edge cases. Seems like everything non-public should just be tunneled by default at this point, even when the protocol itself is supposed to be secure. I can't see any downside to adding another layer to the onion in this case, and indeed there are some bonuses IME in terms of ease of routing/NAT hole punch etc to boot.
Of course on top is the whole galaxy of gear running never-updated stacks, from UPSs and PDUs to even core stuff like network switches which I've seen linger on completely obsolete cipher choices for ages. Or web GUIs doing the same with HTTPS (if they even support HTTPS(!)). Some stuff arguably should just be airgapped entirely, but if/when that's not possible stuff it behind a lot of layers of protection would be nice. I'd love to see an in-line form factor PoE ultra minimal dongle whose only job in life is to run Wireguard or Nebula or Tailscale or something, translating from that to an ethernet port that any ancient device can talk into and insuring 100% of traffic will go via that or not at all at the hardware level. Then could effectively mediate all traffic even to ancient stuff via that without it ever needing to even hit a switch.
- jvanderbot 3y ago> PoE ultra minimal dongle I believe this is the future as envisioned by tailscale. Where some kind of key-exchange server is used alongside DNS, and DNS itself uses something like wireguard encryption.
- rsync 3y ago"'d love to see an in-line form factor PoE ultra minimal dongle whose only job in life is to run Wireguard ..." This is a type of "network slug"[1][2] and it is a very good idea. An immutable, two-port (in and out) hardware "slug" that enforces your network policy no matter what form of misconfiguration lies behind it is a tool I hope more people will avail themselves of. [1] https://john.kozubik.com/pub/NetworkSlug/tip.html https://john.kozubik.com/pub/NetworkSlug/tip.html [2] https://john.kozubik.com/pub/NetworkSlug/body.html https://john.kozubik.com/pub/NetworkSlug/body.html
- xoa 3y agoThat's definitely interesting too, but despite the increased risk of more power, what I'd like would be more complex then that. I want clients that were made long before the noise protocol framework even existed to still be able to get all traffic forced into a virtual network over it, which means effectively to dispense with layer 2 entirely as something for more then physical bit moving and move all traffic and traffic management/auth into L3 or higher. That's certainly becoming more cheaply possible on a technical level with modern SBCs, but I don't know of any really elegant turnkey product yet. Feels like one of those situations where you can see a lot of pieces of the puzzle scattered about but not quite pieced together. Would you still call that a "network slug"? Might be a decent name regardless, but the description there sounds much, much simpler and more focused on layer 2.