8 ms·

I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. I am not sure why people are so afraid of exposing ports. I

by drnick1 10mo ago

I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. I am not sure why people are so afraid of exposing ports. I have dozens of ports open on my server including SMTP, IMAP(S), HTTP(S), various game servers and don't see a problem with that. I can't rule out a vulnerability somewhere but services are containerized and/or run as separate UNIX users. It's the way the Internet is meant to work.

CSSer 10mo ago
The answer is people who don't truly understand the way it works being in charge of others who also don't in different ways. In the best case, there's an under resourced and over leveraged security team issuing overzealous edicts with the desperate hope of avoiding some disaster. When the sample size is one, it's easy to look at it and come to your conclusion. In every case where a third party is involved, someone is either providing a service, plugging a knowledge gap, or both.
sauercrowd 10mo ago
People are not full time maintainers of their infra though, that's very different to companies. In many cases they want something that works, not something that requires a complex setup that needs to be well researched and understood.
- buildfocus 10mo ago
  Wireguard is _really_ simple in that sense though. If you're not doing anything complicated it's very easy to set up & maintain, and basically just works. You can also buy quite a few routers now that have it built in, so you literally just tick a checkbox, then scan a QR code/copy a file to each client device, done.
  - vladvasiliu 10mo ago
    This may come with its own limitations, though. My ISP-provided router (Free, in France) has WG built-in. But other than performance being abysmal, its main pain point is not supporting subnet routing. So if all you want is to connect your phone / laptop while away to the local home network, it's fine. If you want to run a tunnel between two locations with multiple IPs on the remote side, you're SoL.
Topgamer7 10mo ago
I don't have a static IP, so tailscale is convenient. And less likely to fail when I really need it, as apposed to trying to deal with dynamic dns.
heavyset_go 10mo ago
> I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. This is what I do. You can do Tailscale like access using things like Pangolin[0]. You can also use a bastion host, or block all ports and set up Tor or i2p, and then anyone that even wants to talk to your server will need to know cryptographic keys to route traffic to it at all, on top of your SSH/WG/etc keys. > I am not sure why people are so afraid of exposing ports. I have dozens of ports open on my server including SMTP, IMAP(S), HTTP(S), various game servers and don't see a problem with that. This is what I don't do. Anything that needs real internet access like mail, raw web access, etc gets its own VPS where an attack will stay isolated, which is important as more self-hosted services are implemented using things like React and Next[1]. [0] https://github.com/fosrl/pangolin https://github.com/fosrl/pangolin [1] https://news.ycombinator.com/item?id=46136026 https://news.ycombinator.com/item?id=46136026
- edoceo 10mo ago
  Is a container not enough isolation? I do SSH to the host (alt-port) and then services in containers (mail, http)
  - heavyset_go 10mo ago
    Depends on your risk tolerance. I personally wouldn't trust a machine if a container was exploited on it, you don't know if there were any successful container escapes, kernel exploits, etc. Even if they escaped with user permissions, that can fill your box with boobytraps if they have container-granted capabilities. I'd just prefer to nuke the VPS entirely and start over than worry if the server and the rest of my services are okay.
    - Imustaskforhelp 10mo ago
      Yea I feel that too. there are some well respected compute providers as well which you can use and for very low amount, you can sort of offload this worry to someone else. That being said, VM themselves are good enough security box too. I consider running VM's even on your home server with public facing strategies usually allowable
esseph 10mo ago
With ports you have dozens or hundreds of applications and systems to attack. With tailscale / zerotier / etc the connection is initiated from inside to facilitate NAT hole punching and work over CGNAT. With wireguard that removes a lot of attack surfaces but wouldn't work if behind CGNAT without a relay box.
SchemaLoad 10mo ago
If you expose ports, literally everything you are hosting and every plugin is an attack surface. Most of this stuff is built by single hobbiest devs on the weekend. You are also exposed to any security issues you make in your configuration. My first attempt self hosting I had redis compromised because I didn't realise I had exposed it to the internet with no password. Behind a VPN your only attack surface is the VPN which is generally very well secured.
- sva_ 10mo ago
  You exposed your redis publicly? Why? Edit: This is the kind of service that you should only expose to your intranet, i.e. a network that is protected through wireguard. NEVER expose this publicly, even if you don't have admin:admin credtials.
  - SchemaLoad 10mo ago
    I actually didn't know I had. At the time I didn't properly know how docker networking worked and I exposed redis to the host so my other containers could access it. And then since this was on a VPS with a dedicated IP, this made it exposed to the whole internet. I now know better, but there are still a million other pitfalls to fall in to if you are not a full time system admin. So I prefer to just put it all behind a VPN and know that it's safe.
    - drnick1 10mo ago
      > but there are still a million other pitfalls to fall in to if you are not a full time system admin. Pro tip: After you configure a new service, review the output of ss -tulpn. This will tell you what ports are open. You should know exactly what each line represents, especially those that bind on 0.0.0.0 or [::] or other public addresses. The pitfall that you mentioned (Docker automatically punching a hole in the firewall for the services that it manages when an interface isn't specified) is discoverable this way.
      - jsrcout 10mo ago
buran77 10mo ago
> I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. Ideal if you have the resources (time, money, expertise). There are different levels of qualifications, convenience, and trust that shape what people can and will deploy. This defines where you draw the line - at owning every binary of every service you use, at compiling the binaries yourself, at checking the code that you compile. > I am not sure why people are so afraid of exposing ports It's simple, you increase your attack surface, and the effort and expertise needed to mitigate that. > It's the way the Internet is meant to work. Along with no passwords or security. There's no prescribed way for how to use the internet. If you're serving one person or household rather than the whole internet, then why expose more than you need out of some misguided principle about the internet? Principle of least privilege, it's how security is meant to work.
- lmm 10mo ago
  > It's simple, you increase your attack surface, and the effort and expertise needed to mitigate that. Sure, but opening up one port is a much smaller surface than exposing yourself to a whole cloud hosting company.
  - appplication 10mo ago
    Ah… I really could not disagree more with that statement. I know we don’t want to trust BigCorp and whatnot, but a single exposed port and an incomplete understanding of what you’re doing is really all it takes to be compromised.
    - SchemaLoad 10mo ago
      Even if you understand what you are doing, you are still exposed to every single security bug in all of the services you host. Most of these self hosted tools have not been through 1% of the security testing big tech services have.
      - johnisgood 10mo ago
zamadatix 10mo ago
It's the way the internet was meant to work but it doesn't make it any easier. Even when everything is in containers/VMs/users, if you don't put a decent amount of additional effort into automatic updates and keeping that context hardened as you tinker with it it's quite annoying when it gets pwned. There was a popular post less than a month ago about this recently https://news.ycombinator.com/item?id=46305585 https://news.ycombinator.com/item?id=46305585 I agree maintaining wireguard is a good compromise. It may not be "the way the internet was intended to work" but it lets you keep something which feels very close without relying on a 3rd party or exposing everything directly. On top of that, it's really not any more work than Tailscale to maintain.
- SoftTalker 10mo ago
  I just run an SSH server and forward local ports through that as needed. Simple (at least to me).
  - zamadatix 10mo ago
    I do that as well, along with using sshd as a SOCKS proxy for web based stuff via Firefox, but it can be a bit of a pain to forward each service to each host individually if you have more than a few things going on - especially if you have things trying to use the same port and need to keep track of how you mapped it locally. It can also a lot harder to manage on mobile devices, e.g. say you have some media or home automation services - they won't be as easy to access via a single public SSH host via port forwarding (if at all) as a VPN would be, and wireguard is about as easy a personal VPN as there is. That's where wg/Tailscale come in - it's just a traditional IP network at that point. Also less to do to shut up bad login attempts from spam bots and such. I once forgot to configure the log settings on sshd and ended up with GBs of logs in a week. The other big upside (outside of not having a 3rd party) in putting in the slightly more effort to do wg/ssh/other personal VPN is the latency+bandwidth to your home services will be better.
    - jmb99 10mo ago
      > and wireguard is about as easy a personal VPN as there is. I would argue OpenVPN is easier. I currently run both (there are some networks I can’t use UDP on, and I haven’t bothered figuring out how to get wireguard to work with TCP), and the OpenVPN initial configuration was easier, as is adding clients (DHCP, pre-shared cert+username/password). This isn’t to say wireguard is hard. But imo OpenVPN is still easier - and it works everywhere out of the box. (The exception is networks that only let you talk on 80 and 443, but you can solve that by hosting OpenVPN on 443, in my experience.) This is all based on my experience with opnsense as the vpn host (+router/firewall/DNS/DHCP). Maybe it would be a different story if I was trying to run the VPN server on a machine behind my router, but I have no reason to do so - I get at least 500Mbps symmetrical through OpenVPN, and that’s just the fastest network I’ve tested a client on. And even if that is the limit, that’s good enough for me, I don’t need faster throughput on my VPN since I’m almost always going to be latency limited.
Etheryte 10mo ago
Every time I put anything anywhere on the open net, it gets bombarded 24/7 by every script kiddie, botnet group , and these days, AI company out there. No matter what I'm hosting, it's a lot more convenient to not have to worry about that even for a second.
- drnick1 10mo ago
  > Every time I put anything anywhere on the open net, it gets bombarded 24/7 by every script kiddie, botnet group , and these days, AI company out there Are you sure that it isn't just port scanners? I get perhaps hundreds of connections to my STMP server every day, but they are just innocuous connections (hello, then disconnect). I wouldn't worry about that unless you see repeated login attempts, in which case you may want to deploy Fail2Ban.
  - fooqux 10mo ago
    Port scanners don't try to ssh into my server with various username/password combinations. I prefer to hide my port instead of using F2B for a few reasons. 1. Log spam. Looking in my audit logs for anything suspicious is horrendous when there's just megs of login attempts for days. 2. F2B has banned me in the past due to various oopsies on my part. Which is not good when I'm out of town and really need to get into my server. 3. Zero days may be incredibly rare in ssh, but maybe not so much in Immich or any other relatively new software stack being exposed. I'd prefer not to risk it when simple alternatives exist. Besides the above, using Tailscale gives me other options, such as locking down cloud servers (or other devices I may not have hardware control over) so that they can only be connected to, but not out of.
    - pferde 10mo ago
      You can tweak rate thresholds for F2B, so that it blocks the 100-attempts-per-second attackers, but doesn't block your three-attempts-per-minute manual fumbling.
      - fooqux 10mo ago
Frotag 10mo ago
Speaking of Wireguard, my current topology has all peers talking to a single peer that forwards traffic between peers (for hole punching / peers with dynamic ips). But some peers are sometimes on the same LAN (eg phone is sometimes on same LAN as pc). Is there a way to avoid forwarding traffic through the server peer in this case?
- prima-facie 10mo ago
  Two separate WG profiles on the phone; one acting as a Proxy (which forwards everything), and one acting just as a regular VPN without forwarding.
- Frotag 10mo ago
  I guess I'm looking for wireguard's version of STUN. And now that I know what to google for, finally found some promising leads. https://github.com/jwhited/wgsd https://github.com/jwhited/wgsd https://www.jordanwhited.com/posts/wireguard-endpoint-discovery-nat-traversal/ https://www.jordanwhited.com/posts/wireguard-endpoint-discov... https://github.com/tjjh89017/stunmesh-go https://github.com/tjjh89017/stunmesh-go
- megous 10mo ago
  Have your network managing software setup a default route with a lower metric than wireguard default route based on wifi SSID. Can be done easily with systemd-networkd, because you can match .network file configurations on SSID. You're probably out of luck with this approach on network-setup-challenged devices like so called smart phones.
- torcete 10mo ago
  The way I do it is to have two different first level domains. Let's say: - w for the wireguard network. - h for the home network. Nothing fancy, just populate the /etc/hosts on every machine with these names. Now, it's up to me to connect to my server1.h or server1.w depending whether I am at home or somewhere else.
- deleted 10mo ago
  [deleted]
- 10mo ago
epistasis 10mo ago
I've managed wireguard in the past, and would never do it again. Generating keys, distributing them, configuring it all...... bleh! Never again, it takes too much time and is too painful. Certs from Tailscale are reason enough to switch, in my opinion! The key with successful self hosting is to make it easy and fast, IMHO.
alpn 10mo ago
> I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. I’m working on a (free) service that lets you have it both ways. It’s a thin layer on top of vanilla WireGuard that handles NAT traversal and endpoint updates so you don’t need to expose any ports, while leaving you in full control of your own keys and network topology. https://wireplug.org https://wireplug.org
- copperx 10mo ago
  Apparently I'm ignorant about Tailscale, bacause your service description is exactly what I thought Tailscale was.
  - SchemaLoad 10mo ago
    The main issue people have with Tailscale is that it's a centralised service that isn't self hostable. The Tailscale server manages authentication and keeping track of your devices IPs. Your eventual connection is direct to your device, but all the management before that runs on Tailscales server.
    - TOMDM 10mo ago
      Isn't this what headscale is for?
- hamandcheese 10mo ago
  This is very cool! But I also think it's worth a mention that for basic "I want to access my home LAN" use cases you don't need P2P, you just need a single public IP to your lan and perhaps dynamic dns.
  - kevin_thibedeau 10mo ago
    A public IP and DDNS can be impossible behind CGNAT. A VPN link to a VPS eliminates that problem.
digiown 10mo ago
A mesh-type wireguard network is rather annoying to set up if you have more than a few devices, and a hub-type network (on a low powered router) tends to be so slow that it necessitates falling back to alternate interfaces when you're at home. Tailscale does away with all this and always uses direct connections. In principle it is more secure than hosting it on some router without disk encryption (as the keys can be extracted via a physical attack, and a pwned router can also eavesdrop on traffic).
byb 10mo ago
My biggest source of paranoia is my open home assistant port, while it requires a strong password and is TLS-encrypted, I'm sure that one day someone will find an exploit letting them in, and then the attacker will rapidly turn my smart home devices on and off until they break/overheat the power components until they start a fire and burn down my house.
- seszett 10mo ago
  That seems like a very irrational fear. Attackers don't go around trying to break into Home Assistant to turn the lights on at some stranger's house. There's also no particular reason to think Home Assistant's authentication has to have a weakness point. And your devices are also unlikely to start a fire just by being turned on and off, if that's your fear you should replace them at once because if they catch fire it doesn't matter if it's an attacker or yourself turning them on and off.
  - deleted 10mo ago
    [deleted]
  - timc3 10mo ago
    People are putting their whole infrastructure onto HA - cars, Apple/Google/other accounts, integrations to grid companies, managing ESP software etc.. I think that has more potential for problems than turning lights on and off and warrants strong security.
- wao0uuno 10mo ago
  Why expose HA to the internet? I’m genuinely curious.
catlifeonmars 10mo ago
Honestly the managed PKI is the main value-add from Tailscale over plain wireguard. I’ve been meaning to give this a try this winter: https://github.com/juanfont/headscale https://github.com/juanfont/headscale
BatteryMountain 10mo ago
Which router OS are you using? I have openwrt + daily auto updates configure with a couple of packages blacklisted that I manually update now & then.
PeterStuer 10mo ago
Defence in dept. You have a layer of security even before a packet reaches your port. I might have a zero day on your service, but now I also need to breach your reverse proxy to get to it.
nialv7 10mo ago
> introduce a third party like Tailscale. Well just use headscale and you'll have control over everything.
- vladvasiliu 10mo ago
  That just moves the problem, since headscale will require a server you manage with an open port. Sure, tailscale is nice, but from an open-port-on-the-net perspective it's probably a bit below just opening wireguard.
arjie 10mo ago
I used to do that, but Tailscale with your own headscale server is pretty snazzy. The other thing is with cloudflared running your server doesn't have to be Internet-routable. Everything is tunneled.
eqvinox 10mo ago
> I am not sure why people are so afraid of exposing ports. Similar here, I only build & run services that I trust myself enough to run in a secure manner by themselves. I still have a VPN for some things, but everything is built to be secure on its own. It's quite a few services on my list at this point and really don't want to have a break in one thing lead to a break in everything. It's always possible to leave a hole in one or two things by accident. On the other side this also means I have a Postgres instance with TCP/5432 open to the internet - with no ill effects so far, and quite a bit of trust it'll remain that way, because I understand its security properties and config now.
twelvedogs 10mo ago
i tried wireguard and ended up giving up on it, too many isps just block it here or use some kind of tech that fucks with it and i have no idea why, i couldn't connect to my home network because it was blocked on whatever random wifi i was on the new problem is now my isp uses cgnat and there's no easy way around it tailscale avoids all that, if i wanted more control i'd probably use headscale rather than bother with raw wireguard
- pferde 10mo ago
  And there's nothing wrong with it. That is what wireguard is meant to be - a rock-solid secure tunneling implementation that's easy to build higher-level solutions on.
pacija 10mo ago
Of course. A port is a door. If service listening on a port is secure and properly configured (e.g. ssh), whole Internet can bang on it all day every day, they won't let through without proper key. Same for imap, xmpp or any othet service. But what can you expect from people who provide services but won't even try to understand how they work and how they are configured as it's 'not fun enough', expecting claude code to do it right for them. Asking AI to do thing you did 100 times before is OK I guess. Asking AI to do thing you never did and have no idea how it's properly done - not so much I'd say. But this guy obviously does not signal his sysadmin skills but his AI skills. I hope it brings him the result he aimed for.
rubatuga 10mo ago
Yggdrasil network is probably the future. At Hoppy Network we're about to release private yggdrasil relays as a service so you don't get spammed with "WAN" traffic. With Yggdrasil, IP addresses aren't allocated by an authority - they are owned and proven by public key cryptography.
gambiting 10mo ago
"Back in the day"(just few years ago) I used to expose a port for RDP on my router, on a non-standard port. Typically it would be fine and quiet for a few weeks, then I assume some automatic scanner would find it and from that point onwards I could see windows event log reporting a log in attempt every second, with random login/password combinations, clearly just looking for something that would work. I would change the port and the whole dance would repeat all over again. Tens of thousands of login attempts every day, all year round. I used to just ignore it, since clearly they weren't going to log in with those random attempts, but eventually just switched to OpenVPN. So yeah, the lesson there is that if you have a port open to the internet, someone will scan it and try to attack it. Maybe not if it's a random game server, but any popular service will get under attack.
- drnick1 10mo ago
  > someone will scan it and try to attack it. Maybe not if it's a random game server, but any popular service will get under attack. That's fine, it's only people knocking on a closed door. You cannot host things such as email or HTTP without open ports, your service needs to be publicly accessible by definition.
inapis 10mo ago
Skill issue. Not to mention the ongoing effort required to maintain and secure the service. But even before that, a lot of people are behing CGNAT. Tailscale makes punching a hole through that very easy. Otherwise you have to run your own relay server somewhere in the cloud.
abc123abc123 10mo ago
This is the truth. I've been exposing 22 and 80 for decades, and nothing has happened. The ones I know who had something bad happen to them exposed proprietary services or security nightmares like wordpress.
dpacmittal 10mo ago
Tailscale works behind NAT, wireguard does not unless you also have a publicly reachable relay server which introduces its own maintenance headaches and cost.
1vuio0pswjnm7 10mo ago
"I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale." It's always perplexing to me how HN commenters replying to a comment with a statement like this, e.g., something like "I prefer [choice with some degree of DIY]", will try to "argue" against it The "arguments" are rarely, "I think that is a poor choice because [list of valid reasons]" Instead the responses are something like, "Most people...". In other words, a nonsensical reference to other computer users It might make sense for a commercial third party to care about what other computer users do, but why should any individual computer user care what others do (besides genuine curiosity or commercial motive) For example, telling family, friends, colleagues how you think they should use their computers usually isn't very effective. They usually do not care about your choices or preferences. They make their own Would telling strangers how to use their computers be any more effective Forum commenters often try to tell strangers what to do, or what not to do But every computer user is free to make their own choices and pursue their own preferences NB. I am not commenting on the open ports statement
- 1vuio0pswjnm7 10mo ago
  O5QXGIBLGMQC4LQK
zobzu 10mo ago
put simply and fairly bluntly: because they do not know how things work. but actually it's worse. this is HN - supposedly, most commenters are curious by nature and well versed into most basic computer stuff. in practice, it's slowly less and less the case. worse: what is learned and expected is different from what you'd think. for example, separating service users sure is better than nothing, but the OS attack surface as a local user is still huge, hence why we use sandboxes, which really are just OS level firewalls to reduce the attack surface. the open port attack surface isnt terrible though: you get a bit more of the very well tested tcp/ip stack and up to 65k ports all doing the exact same thing, not terrible at all. Now, add to it "AI" which can automatically regurgitate and implement whatever reddit and stack overflow says.. it makes for a fun future problem - such forums will end up with mostly non-new AI content (new problem being solved will be a needle in the haystack) - and - users will have learned that AI is always right no matter what it decides (because they don't know any better and they're being trained to blindly trust it). Heck, i predict there will be a chat, where a bunch of humans will argue very strongly that an AI is right while its blatantly wrong, and some will likely put their life on the line to defend it. Fun times ahead. As for my take: humans _need_ learning to live, but are lazy. Nature fixes itself.
cirelli94 10mo ago
I did it and I was just hacked because of a CVE on my pangolin reverse proxy! Sadly, I didn't knew of the CVE soon enough and I only noticed when a crypto malware took my fan 100% all day long...
Ir0nMan 10mo ago
It's worth considering: Run the PiVPN script on a Ubuntu/Debian based VM. Set it to use a non-standard random port. That will be your only port exposed to the internet. Add the generated Wireguard key to any device (laptops, phones, etc) and access your home LAN as if it was local from anywhere in the world for free. Works well, super easy to setup, secure, and fast.

by drnick1 10mo ago

CSSer 10mo ago

The answer is people who don't truly understand the way it works being in charge of others who also don't in different ways. In the best case, there's an under resourced and over leveraged security team issuing overzealous edicts with the desperate hope of avoiding some disaster. When the sample size is one, it's easy to look at it and come to your conclusion. In every case where a third party is involved, someone is either providing a service, plugging a knowledge gap, or both.

sauercrowd 10mo ago

People are not full time maintainers of their infra though, that's very different to companies. In many cases they want something that works, not something that requires a complex setup that needs to be well researched and understood.

buildfocus 10mo ago
Wireguard is _really_ simple in that sense though. If you're not doing anything complicated it's very easy to set up & maintain, and basically just works. You can also buy quite a few routers now that have it built in, so you literally just tick a checkbox, then scan a QR code/copy a file to each client device, done.
- vladvasiliu 10mo ago
  This may come with its own limitations, though. My ISP-provided router (Free, in France) has WG built-in. But other than performance being abysmal, its main pain point is not supporting subnet routing. So if all you want is to connect your phone / laptop while away to the local home network, it's fine. If you want to run a tunnel between two locations with multiple IPs on the remote side, you're SoL.

Topgamer7 10mo ago

I don't have a static IP, so tailscale is convenient. And less likely to fail when I really need it, as apposed to trying to deal with dynamic dns.

heavyset_go 10mo ago

> I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. This is what I do. You can do Tailscale like access using things like Pangolin[0]. You can also use a bastion host, or block all ports and set up Tor or i2p, and then anyone that even wants to talk to your server will need to know cryptographic keys to route traffic to it at all, on top of your SSH/WG/etc keys. > I am not sure why people are so afraid of exposing ports. I have dozens of ports open on my server including SMTP, IMAP(S), HTTP(S), various game servers and don't see a problem with that. This is what I don't do. Anything that needs real internet access like mail, raw web access, etc gets its own VPS where an attack will stay isolated, which is important as more self-hosted services are implemented using things like React and Next[1]. [0] https://github.com/fosrl/pangolin https://github.com/fosrl/pangolin [1] https://news.ycombinator.com/item?id=46136026 https://news.ycombinator.com/item?id=46136026

edoceo 10mo ago
Is a container not enough isolation? I do SSH to the host (alt-port) and then services in containers (mail, http)
- heavyset_go 10mo ago
  Depends on your risk tolerance. I personally wouldn't trust a machine if a container was exploited on it, you don't know if there were any successful container escapes, kernel exploits, etc. Even if they escaped with user permissions, that can fill your box with boobytraps if they have container-granted capabilities. I'd just prefer to nuke the VPS entirely and start over than worry if the server and the rest of my services are okay.
  - Imustaskforhelp 10mo ago
    Yea I feel that too. there are some well respected compute providers as well which you can use and for very low amount, you can sort of offload this worry to someone else. That being said, VM themselves are good enough security box too. I consider running VM's even on your home server with public facing strategies usually allowable

esseph 10mo ago

With ports you have dozens or hundreds of applications and systems to attack. With tailscale / zerotier / etc the connection is initiated from inside to facilitate NAT hole punching and work over CGNAT. With wireguard that removes a lot of attack surfaces but wouldn't work if behind CGNAT without a relay box.

SchemaLoad 10mo ago

If you expose ports, literally everything you are hosting and every plugin is an attack surface. Most of this stuff is built by single hobbiest devs on the weekend. You are also exposed to any security issues you make in your configuration. My first attempt self hosting I had redis compromised because I didn't realise I had exposed it to the internet with no password. Behind a VPN your only attack surface is the VPN which is generally very well secured.

sva_ 10mo ago
You exposed your redis publicly? Why? Edit: This is the kind of service that you should only expose to your intranet, i.e. a network that is protected through wireguard. NEVER expose this publicly, even if you don't have admin:admin credtials.
- SchemaLoad 10mo ago
  I actually didn't know I had. At the time I didn't properly know how docker networking worked and I exposed redis to the host so my other containers could access it. And then since this was on a VPS with a dedicated IP, this made it exposed to the whole internet. I now know better, but there are still a million other pitfalls to fall in to if you are not a full time system admin. So I prefer to just put it all behind a VPN and know that it's safe.
  - drnick1 10mo ago
    > but there are still a million other pitfalls to fall in to if you are not a full time system admin. Pro tip: After you configure a new service, review the output of ss -tulpn. This will tell you what ports are open. You should know exactly what each line represents, especially those that bind on 0.0.0.0 or [::] or other public addresses. The pitfall that you mentioned (Docker automatically punching a hole in the firewall for the services that it manages when an interface isn't specified) is discoverable this way.
    - jsrcout 10mo ago

buran77 10mo ago

> I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. Ideal if you have the resources (time, money, expertise). There are different levels of qualifications, convenience, and trust that shape what people can and will deploy. This defines where you draw the line - at owning every binary of every service you use, at compiling the binaries yourself, at checking the code that you compile. > I am not sure why people are so afraid of exposing ports It's simple, you increase your attack surface, and the effort and expertise needed to mitigate that. > It's the way the Internet is meant to work. Along with no passwords or security. There's no prescribed way for how to use the internet. If you're serving one person or household rather than the whole internet, then why expose more than you need out of some misguided principle about the internet? Principle of least privilege, it's how security is meant to work.

lmm 10mo ago
> It's simple, you increase your attack surface, and the effort and expertise needed to mitigate that. Sure, but opening up one port is a much smaller surface than exposing yourself to a whole cloud hosting company.
- appplication 10mo ago
  Ah… I really could not disagree more with that statement. I know we don’t want to trust BigCorp and whatnot, but a single exposed port and an incomplete understanding of what you’re doing is really all it takes to be compromised.
  - SchemaLoad 10mo ago
    Even if you understand what you are doing, you are still exposed to every single security bug in all of the services you host. Most of these self hosted tools have not been through 1% of the security testing big tech services have.
    - johnisgood 10mo ago

zamadatix 10mo ago

It's the way the internet was meant to work but it doesn't make it any easier. Even when everything is in containers/VMs/users, if you don't put a decent amount of additional effort into automatic updates and keeping that context hardened as you tinker with it it's quite annoying when it gets pwned. There was a popular post less than a month ago about this recently https://news.ycombinator.com/item?id=46305585 https://news.ycombinator.com/item?id=46305585 I agree maintaining wireguard is a good compromise. It may not be "the way the internet was intended to work" but it lets you keep something which feels very close without relying on a 3rd party or exposing everything directly. On top of that, it's really not any more work than Tailscale to maintain.

SoftTalker 10mo ago
I just run an SSH server and forward local ports through that as needed. Simple (at least to me).
- zamadatix 10mo ago
  I do that as well, along with using sshd as a SOCKS proxy for web based stuff via Firefox, but it can be a bit of a pain to forward each service to each host individually if you have more than a few things going on - especially if you have things trying to use the same port and need to keep track of how you mapped it locally. It can also a lot harder to manage on mobile devices, e.g. say you have some media or home automation services - they won't be as easy to access via a single public SSH host via port forwarding (if at all) as a VPN would be, and wireguard is about as easy a personal VPN as there is. That's where wg/Tailscale come in - it's just a traditional IP network at that point. Also less to do to shut up bad login attempts from spam bots and such. I once forgot to configure the log settings on sshd and ended up with GBs of logs in a week. The other big upside (outside of not having a 3rd party) in putting in the slightly more effort to do wg/ssh/other personal VPN is the latency+bandwidth to your home services will be better.
  - jmb99 10mo ago
    > and wireguard is about as easy a personal VPN as there is. I would argue OpenVPN is easier. I currently run both (there are some networks I can’t use UDP on, and I haven’t bothered figuring out how to get wireguard to work with TCP), and the OpenVPN initial configuration was easier, as is adding clients (DHCP, pre-shared cert+username/password). This isn’t to say wireguard is hard. But imo OpenVPN is still easier - and it works everywhere out of the box. (The exception is networks that only let you talk on 80 and 443, but you can solve that by hosting OpenVPN on 443, in my experience.) This is all based on my experience with opnsense as the vpn host (+router/firewall/DNS/DHCP). Maybe it would be a different story if I was trying to run the VPN server on a machine behind my router, but I have no reason to do so - I get at least 500Mbps symmetrical through OpenVPN, and that’s just the fastest network I’ve tested a client on. And even if that is the limit, that’s good enough for me, I don’t need faster throughput on my VPN since I’m almost always going to be latency limited.

Etheryte 10mo ago

Every time I put anything anywhere on the open net, it gets bombarded 24/7 by every script kiddie, botnet group , and these days, AI company out there. No matter what I'm hosting, it's a lot more convenient to not have to worry about that even for a second.

drnick1 10mo ago
> Every time I put anything anywhere on the open net, it gets bombarded 24/7 by every script kiddie, botnet group , and these days, AI company out there Are you sure that it isn't just port scanners? I get perhaps hundreds of connections to my STMP server every day, but they are just innocuous connections (hello, then disconnect). I wouldn't worry about that unless you see repeated login attempts, in which case you may want to deploy Fail2Ban.
- fooqux 10mo ago
  Port scanners don't try to ssh into my server with various username/password combinations. I prefer to hide my port instead of using F2B for a few reasons. 1. Log spam. Looking in my audit logs for anything suspicious is horrendous when there's just megs of login attempts for days. 2. F2B has banned me in the past due to various oopsies on my part. Which is not good when I'm out of town and really need to get into my server. 3. Zero days may be incredibly rare in ssh, but maybe not so much in Immich or any other relatively new software stack being exposed. I'd prefer not to risk it when simple alternatives exist. Besides the above, using Tailscale gives me other options, such as locking down cloud servers (or other devices I may not have hardware control over) so that they can only be connected to, but not out of.
  - pferde 10mo ago
    You can tweak rate thresholds for F2B, so that it blocks the 100-attempts-per-second attackers, but doesn't block your three-attempts-per-minute manual fumbling.
    - fooqux 10mo ago

Frotag 10mo ago

Speaking of Wireguard, my current topology has all peers talking to a single peer that forwards traffic between peers (for hole punching / peers with dynamic ips). But some peers are sometimes on the same LAN (eg phone is sometimes on same LAN as pc). Is there a way to avoid forwarding traffic through the server peer in this case?

prima-facie 10mo ago
Two separate WG profiles on the phone; one acting as a Proxy (which forwards everything), and one acting just as a regular VPN without forwarding.
Frotag 10mo ago
I guess I'm looking for wireguard's version of STUN. And now that I know what to google for, finally found some promising leads. https://github.com/jwhited/wgsd https://github.com/jwhited/wgsd https://www.jordanwhited.com/posts/wireguard-endpoint-discovery-nat-traversal/ https://www.jordanwhited.com/posts/wireguard-endpoint-discov... https://github.com/tjjh89017/stunmesh-go https://github.com/tjjh89017/stunmesh-go
megous 10mo ago
Have your network managing software setup a default route with a lower metric than wireguard default route based on wifi SSID. Can be done easily with systemd-networkd, because you can match .network file configurations on SSID. You're probably out of luck with this approach on network-setup-challenged devices like so called smart phones.
torcete 10mo ago
The way I do it is to have two different first level domains. Let's say: - w for the wireguard network. - h for the home network. Nothing fancy, just populate the /etc/hosts on every machine with these names. Now, it's up to me to connect to my server1.h or server1.w depending whether I am at home or somewhere else.
deleted 10mo ago
[deleted]
10mo ago

epistasis 10mo ago

I've managed wireguard in the past, and would never do it again. Generating keys, distributing them, configuring it all...... bleh! Never again, it takes too much time and is too painful. Certs from Tailscale are reason enough to switch, in my opinion! The key with successful self hosting is to make it easy and fast, IMHO.

alpn 10mo ago

> I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale. I’m working on a (free) service that lets you have it both ways. It’s a thin layer on top of vanilla WireGuard that handles NAT traversal and endpoint updates so you don’t need to expose any ports, while leaving you in full control of your own keys and network topology. https://wireplug.org https://wireplug.org

copperx 10mo ago
Apparently I'm ignorant about Tailscale, bacause your service description is exactly what I thought Tailscale was.
- SchemaLoad 10mo ago
  The main issue people have with Tailscale is that it's a centralised service that isn't self hostable. The Tailscale server manages authentication and keeping track of your devices IPs. Your eventual connection is direct to your device, but all the management before that runs on Tailscales server.
  - TOMDM 10mo ago
    Isn't this what headscale is for?
hamandcheese 10mo ago
This is very cool! But I also think it's worth a mention that for basic "I want to access my home LAN" use cases you don't need P2P, you just need a single public IP to your lan and perhaps dynamic dns.
- kevin_thibedeau 10mo ago
  A public IP and DDNS can be impossible behind CGNAT. A VPN link to a VPS eliminates that problem.

digiown 10mo ago

A mesh-type wireguard network is rather annoying to set up if you have more than a few devices, and a hub-type network (on a low powered router) tends to be so slow that it necessitates falling back to alternate interfaces when you're at home. Tailscale does away with all this and always uses direct connections. In principle it is more secure than hosting it on some router without disk encryption (as the keys can be extracted via a physical attack, and a pwned router can also eavesdrop on traffic).

byb 10mo ago

My biggest source of paranoia is my open home assistant port, while it requires a strong password and is TLS-encrypted, I'm sure that one day someone will find an exploit letting them in, and then the attacker will rapidly turn my smart home devices on and off until they break/overheat the power components until they start a fire and burn down my house.

seszett 10mo ago
That seems like a very irrational fear. Attackers don't go around trying to break into Home Assistant to turn the lights on at some stranger's house. There's also no particular reason to think Home Assistant's authentication has to have a weakness point. And your devices are also unlikely to start a fire just by being turned on and off, if that's your fear you should replace them at once because if they catch fire it doesn't matter if it's an attacker or yourself turning them on and off.
- deleted 10mo ago
  [deleted]
- timc3 10mo ago
  People are putting their whole infrastructure onto HA - cars, Apple/Google/other accounts, integrations to grid companies, managing ESP software etc.. I think that has more potential for problems than turning lights on and off and warrants strong security.
wao0uuno 10mo ago
Why expose HA to the internet? I’m genuinely curious.

catlifeonmars 10mo ago

Honestly the managed PKI is the main value-add from Tailscale over plain wireguard. I’ve been meaning to give this a try this winter: https://github.com/juanfont/headscale https://github.com/juanfont/headscale

BatteryMountain 10mo ago

Which router OS are you using? I have openwrt + daily auto updates configure with a couple of packages blacklisted that I manually update now & then.

PeterStuer 10mo ago

Defence in dept. You have a layer of security even before a packet reaches your port. I might have a zero day on your service, but now I also need to breach your reverse proxy to get to it.

nialv7 10mo ago

> introduce a third party like Tailscale. Well just use headscale and you'll have control over everything.

vladvasiliu 10mo ago
That just moves the problem, since headscale will require a server you manage with an open port. Sure, tailscale is nice, but from an open-port-on-the-net perspective it's probably a bit below just opening wireguard.

arjie 10mo ago

I used to do that, but Tailscale with your own headscale server is pretty snazzy. The other thing is with cloudflared running your server doesn't have to be Internet-routable. Everything is tunneled.

eqvinox 10mo ago

> I am not sure why people are so afraid of exposing ports. Similar here, I only build & run services that I trust myself enough to run in a secure manner by themselves. I still have a VPN for some things, but everything is built to be secure on its own. It's quite a few services on my list at this point and really don't want to have a break in one thing lead to a break in everything. It's always possible to leave a hole in one or two things by accident. On the other side this also means I have a Postgres instance with TCP/5432 open to the internet - with no ill effects so far, and quite a bit of trust it'll remain that way, because I understand its security properties and config now.

twelvedogs 10mo ago

i tried wireguard and ended up giving up on it, too many isps just block it here or use some kind of tech that fucks with it and i have no idea why, i couldn't connect to my home network because it was blocked on whatever random wifi i was on the new problem is now my isp uses cgnat and there's no easy way around it tailscale avoids all that, if i wanted more control i'd probably use headscale rather than bother with raw wireguard

pferde 10mo ago
And there's nothing wrong with it. That is what wireguard is meant to be - a rock-solid secure tunneling implementation that's easy to build higher-level solutions on.

pacija 10mo ago

Of course. A port is a door. If service listening on a port is secure and properly configured (e.g. ssh), whole Internet can bang on it all day every day, they won't let through without proper key. Same for imap, xmpp or any othet service. But what can you expect from people who provide services but won't even try to understand how they work and how they are configured as it's 'not fun enough', expecting claude code to do it right for them. Asking AI to do thing you did 100 times before is OK I guess. Asking AI to do thing you never did and have no idea how it's properly done - not so much I'd say. But this guy obviously does not signal his sysadmin skills but his AI skills. I hope it brings him the result he aimed for.

rubatuga 10mo ago

Yggdrasil network is probably the future. At Hoppy Network we're about to release private yggdrasil relays as a service so you don't get spammed with "WAN" traffic. With Yggdrasil, IP addresses aren't allocated by an authority - they are owned and proven by public key cryptography.

gambiting 10mo ago

"Back in the day"(just few years ago) I used to expose a port for RDP on my router, on a non-standard port. Typically it would be fine and quiet for a few weeks, then I assume some automatic scanner would find it and from that point onwards I could see windows event log reporting a log in attempt every second, with random login/password combinations, clearly just looking for something that would work. I would change the port and the whole dance would repeat all over again. Tens of thousands of login attempts every day, all year round. I used to just ignore it, since clearly they weren't going to log in with those random attempts, but eventually just switched to OpenVPN. So yeah, the lesson there is that if you have a port open to the internet, someone will scan it and try to attack it. Maybe not if it's a random game server, but any popular service will get under attack.

drnick1 10mo ago
> someone will scan it and try to attack it. Maybe not if it's a random game server, but any popular service will get under attack. That's fine, it's only people knocking on a closed door. You cannot host things such as email or HTTP without open ports, your service needs to be publicly accessible by definition.

inapis 10mo ago

Skill issue. Not to mention the ongoing effort required to maintain and secure the service. But even before that, a lot of people are behing CGNAT. Tailscale makes punching a hole through that very easy. Otherwise you have to run your own relay server somewhere in the cloud.

abc123abc123 10mo ago

This is the truth. I've been exposing 22 and 80 for decades, and nothing has happened. The ones I know who had something bad happen to them exposed proprietary services or security nightmares like wordpress.

dpacmittal 10mo ago

Tailscale works behind NAT, wireguard does not unless you also have a publicly reachable relay server which introduces its own maintenance headaches and cost.

1vuio0pswjnm7 10mo ago

"I'd rather expose a Wireguard port and control my keys than introduce a third party like Tailscale." It's always perplexing to me how HN commenters replying to a comment with a statement like this, e.g., something like "I prefer [choice with some degree of DIY]", will try to "argue" against it The "arguments" are rarely, "I think that is a poor choice because [list of valid reasons]" Instead the responses are something like, "Most people...". In other words, a nonsensical reference to other computer users It might make sense for a commercial third party to care about what other computer users do, but why should any individual computer user care what others do (besides genuine curiosity or commercial motive) For example, telling family, friends, colleagues how you think they should use their computers usually isn't very effective. They usually do not care about your choices or preferences. They make their own Would telling strangers how to use their computers be any more effective Forum commenters often try to tell strangers what to do, or what not to do But every computer user is free to make their own choices and pursue their own preferences NB. I am not commenting on the open ports statement

1vuio0pswjnm7 10mo ago
O5QXGIBLGMQC4LQK

zobzu 10mo ago

put simply and fairly bluntly: because they do not know how things work. but actually it's worse. this is HN - supposedly, most commenters are curious by nature and well versed into most basic computer stuff. in practice, it's slowly less and less the case. worse: what is learned and expected is different from what you'd think. for example, separating service users sure is better than nothing, but the OS attack surface as a local user is still huge, hence why we use sandboxes, which really are just OS level firewalls to reduce the attack surface. the open port attack surface isnt terrible though: you get a bit more of the very well tested tcp/ip stack and up to 65k ports all doing the exact same thing, not terrible at all. Now, add to it "AI" which can automatically regurgitate and implement whatever reddit and stack overflow says.. it makes for a fun future problem - such forums will end up with mostly non-new AI content (new problem being solved will be a needle in the haystack) - and - users will have learned that AI is always right no matter what it decides (because they don't know any better and they're being trained to blindly trust it). Heck, i predict there will be a chat, where a bunch of humans will argue very strongly that an AI is right while its blatantly wrong, and some will likely put their life on the line to defend it. Fun times ahead. As for my take: humans _need_ learning to live, but are lazy. Nature fixes itself.

cirelli94 10mo ago

I did it and I was just hacked because of a CVE on my pangolin reverse proxy! Sadly, I didn't knew of the CVE soon enough and I only noticed when a crypto malware took my fan 100% all day long...

Ir0nMan 10mo ago

It's worth considering: Run the PiVPN script on a Ubuntu/Debian based VM. Set it to use a non-standard random port. That will be your only port exposed to the internet. Add the generated Wireguard key to any device (laptops, phones, etc) and access your home LAN as if it was local from anywhere in the world for free. Works well, super easy to setup, secure, and fast.