4 ms·

Not super related to the OP but since we're discussing network topologies; I've recently had an insane idea that nfs security sucks, nfs traversing firewalls su

Not super related to the OP but since we're discussing network topologies; I've recently had an insane idea that nfs security sucks, nfs traversing firewalls sucks, kerberos really sucks, and that just wrapping it all in a wireguard pipe is way better. How deranged would it be to have every nfs client establish a wireguard tunnel and only have nfs traffic go through the tunnel?

eugenekay 9mo ago
I built a NFS3-over-OpenVPN network for a startup about a decade ago; it worked “okay” for transiting an untrusted internal cloud provider network and even over the internet to other datacenters, but ran into mount issues when the outer tunnels dropped a connection during a write. They ran out of money before it had to scale past a few dozen nodes. Nowadays I would recommend using NFS4+TLS or Gluster+TLS if you need filesystem semantics. Better still would be a proper S3-style or custom REST API that can handle the particulars of whatever strange problem lead to this architecture.
QuantumNomad_ 9mo ago
> How deranged would it be to have every nfs client establish a wireguard tunnel and only have nfs traffic go through the tunnel? Sounds good to me. I have my Wireguard tunnel set up so that only traffic intended for hosts that are in the Wireguard network itself are routed over the Wireguard tunnel. I mostly use it to ssh into different machines. The Wireguard server runs on a VPS on the Internet, and I can connect to it from anywhere (except from networks that filter Wireguard traffic), and that way ssh into my machines at home while I am away from home. Whereas all other normal traffic to other places is unaffected by and unrelated to the tunnel. So for example if I bring my laptop to a coffee shop and I have Wireguard running and I browse the web with a web browser, all my web browsing traffic still gets sent the same normal way that it would even if I didn’t have the tunnel running. I rarely use NFS nor SMB, but if I wanted to connect either of those I would be able to that as well over this Wireguard setup I have.
throw0101c 9mo ago
> How deranged would it be to have every nfs client establish a wireguard tunnel and only have nfs traffic go through the tunnel? See perhaps NFS over TLS: * https://datatracker.ietf.org/doc/html/rfc9289 https://datatracker.ietf.org/doc/html/rfc9289 * https://access.redhat.com/solutions/7079884 https://access.redhat.com/solutions/7079884 * https://www.phoronix.com/news/Linux-6.4-NFSD-RPC-With-TLS https://www.phoronix.com/news/Linux-6.4-NFSD-RPC-With-TLS

eugenekay 9mo ago

I built a NFS3-over-OpenVPN network for a startup about a decade ago; it worked “okay” for transiting an untrusted internal cloud provider network and even over the internet to other datacenters, but ran into mount issues when the outer tunnels dropped a connection during a write. They ran out of money before it had to scale past a few dozen nodes. Nowadays I would recommend using NFS4+TLS or Gluster+TLS if you need filesystem semantics. Better still would be a proper S3-style or custom REST API that can handle the particulars of whatever strange problem lead to this architecture.

QuantumNomad_ 9mo ago

> How deranged would it be to have every nfs client establish a wireguard tunnel and only have nfs traffic go through the tunnel? Sounds good to me. I have my Wireguard tunnel set up so that only traffic intended for hosts that are in the Wireguard network itself are routed over the Wireguard tunnel. I mostly use it to ssh into different machines. The Wireguard server runs on a VPS on the Internet, and I can connect to it from anywhere (except from networks that filter Wireguard traffic), and that way ssh into my machines at home while I am away from home. Whereas all other normal traffic to other places is unaffected by and unrelated to the tunnel. So for example if I bring my laptop to a coffee shop and I have Wireguard running and I browse the web with a web browser, all my web browsing traffic still gets sent the same normal way that it would even if I didn’t have the tunnel running. I rarely use NFS nor SMB, but if I wanted to connect either of those I would be able to that as well over this Wireguard setup I have.

throw0101c 9mo ago

> How deranged would it be to have every nfs client establish a wireguard tunnel and only have nfs traffic go through the tunnel? See perhaps NFS over TLS: * https://datatracker.ietf.org/doc/html/rfc9289 https://datatracker.ietf.org/doc/html/rfc9289 * https://access.redhat.com/solutions/7079884 https://access.redhat.com/solutions/7079884 * https://www.phoronix.com/news/Linux-6.4-NFSD-RPC-With-TLS https://www.phoronix.com/news/Linux-6.4-NFSD-RPC-With-TLS