Hacker News

points by wrxd 2 days ago | 0 comments

I like Tailascale as a product but I decided to move my homelab to plain WireGuard.

I wasn't using any of the additional features, I can get away with exposing a port on my router and I am changing devices rarely.

News like this make me happy I removed a lot of complexity and attack surface

[–] femiagbabiaka 2 days ago

> I can get away with exposing a port on my router

using wireguard is awesome, but I wouldn't say deploying and maintaining it lacks complexity exactly. and you didn't get rid of attack surface, you just made it your responsibility ;)

[–] ectospheno 2 days ago

Always is your responsibility even with tailscale. Now it is his responsibility without tailscale.

[–] LoganDark 2 days ago

Attack surface almost entirely goes away if you just require a good port knock first! I do that with my protection SSH servers and it works just fine. Also prevents anyone from knowing there even is an SSH server there. Or any server if it doesn't respond to pings either, and only uses reverse tunnels to accept public connections

[–] neilalexander 2 days ago

Wireguard doesn’t respond to malformed packets or handshakes from unknown devices by design.

[–] LoganDark 2 days ago

Oh, awesome!

[–] mbreese 2 days ago

Is there a way to automate port knocks in your .ssh/config? I think that’s the main reason why I haven’t added it to my home server.

[–] LoganDark 2 days ago

Technically you could use a ProxyCommand that does the knock and then runs nc to your target.

[–] lakeviewterrace 2 days ago

Port knocking is idiotic and amounts to Biff Tannen's "only I know how to start this car".

[–] Gigachad 2 days ago

Dunno, in combination with having an up to date system following best practices, port knocking is probably going to save you when bots start scanning the internet with the next SSH 0day. Any amount of friction will cause the bots to move to the next IP address.

[–] icedchai 2 days ago

Just moving SSH off a default port gets you 98% there.

[–] LoganDark 2 days ago

An attacker only has to get lucky once, so while I do put SSH on a non-default port too, it's not enough to avoid attacks on its own.

[–] icedchai 2 days ago

I mostly do it to quiet down the noise from the non-stop bots and scanners.

[–] esseph 2 days ago

LLMs port knock for redteam scans. Have for a long time.

[–] LoganDark 2 days ago

My knock for SSH was 20 ports within 2 seconds. knockd resets the sequence if you hit any of its ports out of order. I generated the sequence with a CSPRNG.

[–] esseph 2 days ago

That's not a knock, it's a password :-)

[–] LoganDark 2 days ago

It's more like "only I know how to find this keyhole". You still need the key then, you're just also adding some defense against picking.

It would be idiotic to use the knock as the only authentication, which is why I don't.

To be quite honest, I just like the aesthetics of it.

[–] megous 2 days ago

You're sending your knock over the public network in the clear. It's observable by anything in the path. And then you're not the only one that can find the keyhole.

[–] sersi 2 days ago

Entirely true, it's not true security, same as changing the ssh port. So, relying on it for any security is not useful but it's a good deterrent from automated scans that are not targeted towards you. Defense in depth means not necessarily discarding flawed defenses if they are in addition to proper defense.

[–] swingandamiss 2 days ago

With AI, the complexity doesn't really matter anymore. Codex or Claude can easily configure complex site-to-site setups and peer configurations on mobile devices. I did this by hand before and it was hard and difficult to get right. Now I just tell AI and it does so perfectly, checks and verifies things. AI made life so easy.

[–] drum55 2 days ago

No amount of claude can handle the key thing that Tailscale fixes about wireguard, all of the connection to connection logic is handled be it direct, via all sorts of weird hole punching or via relays. Wireguard itself is horrible to do this with, half the time you're just looking at `wg status` wondering why the packet counter isn't incrementing today. It can never achieve the magic that is a direct connection between plane wifi and a host that's behind NAT on the ground.

[–] hdgvhicv 2 days ago

I can’t think of a single time I’ve wanted to connect between two hosts when I haven’t specifically allowed one through a firewall

[–] drum55 2 days ago

NAT are not firewalls.

[–] hdgvhicv 1 day ago

Functionally they are. Allow traffic aiming at this address and this port to arrive on this server.

Not that my WireGuard connection needs nat as it terminates on my router. And I use private ip ranges as I want to be sure that if WireGuard drops out for some reason traffic doesn’t route over the unencrypted path. Defence in depth.

[–] arcanemachiner 2 days ago

This is true, but I still wouldn't discount the possibility of mistakes. It's good to know how your home network works. Even Opus 5.5 can make some pretty dumb mistakes, particularly if it doesn't have the full picture.

[–] swingandamiss 2 days ago

Humans also make mistakes. At this point, I trust AI more than humans when it comes to casually configuring VPNs. I've read many who exposed things by mistake on reddit. AI has nearly solved this, probably is a solved issue at this point.

[–] femiagbabiaka 2 days ago

I would not personally expose my devices over a VPN that I self-hosted and set up purely through AI unless I felt like I understood how it worked completely. But that's probably just personal paranoia.

[–] swingandamiss 2 days ago

Just go read reddit threads on people who do this by hand following half baked guides. There's a huge population doing this, now everyone is switching to AI. It's a big win and safer. Not everyone is a trained network engineer, but now they are with AI

[–] LeBit 2 days ago

It makes no sense at all to configure a >3 nodes wireguard setup with straight wireguard.

Wireguard is the building block for higher level tools like Tailscale to build on.

[–] fooqux 2 days ago

From the sounds of what info they felt was safe to provide, this wouldn't have impacted you anyway.

[–] giwook 2 days ago

Don’t think that refutes their point.

[–] OptionOfT 2 days ago

On the road I find WireGuard to be quirky when connecting to DNS names. When I'm on an IPv6 only network (like T-Mobile), connecting to a DNS name that offers A and AAAA, WireGuard on iOS prefers the A record, making me connect over one of T-Mobile's 464XLAT proxies which time out after x minutes. This then makes the connection look dead until I do something on my phone that re-enables it.

Tailscale doesn't have this issue.

[–] Dagger2 1 day ago

An AAAA-only hostname would sidestep that issue, with the obvious downside.

(This behavior is a deliberate choice from Wireguard. They claim it's not broken, but... it's broken.)

[–] LeBit 2 days ago

You shouldn’t open a port on your router.

Connect from your home to a public VPS and connect your public devices to that VPS.

[–] jon-wood 1 day ago

"Should" and "shouldn't" are dependent on context. In this case, that somewhat depends on what the router you're using is, how much you trust it, and your ISP's configuration. Opening a port isn't an inherently insecure thing, it's a choice that you make while being aware of the tradeoffs between that port being exposed to the internet at large and wanting a given service to be available.

[–] wrxd 1 day ago

What's the advantage of adding a VPS to the mix?

[–] LeBit 1 day ago

Having a VPS gives you a static, non-shared, stable IP with a whois that doesn’t resolve to a residential ISP.

Lot’s of ISP have moved to CGNAT where port forwarding has become a nightmare. That’s one reason. You can look at it as if your router moved from your home behind a public CGNAT, dynamic, shared IP to a public non-shared, static, stable IP on the internet.

In a workplace setting, connecting to your residential IP will raise suspicions or alarms. That being said, if you go for a cheap VPS, it also might raise alarms. Maybe your 'VPS' should be with whichever cloud provider your employer goes with so you don’t even register as a blip.

It is added complexity, but it is really very simple. Using Wireguard, you connect from a always on server in your home to your VPS. Then, using Wireguard, you configure your laptop to always connect to your VPS. Any local LLM can generate the wg-quick config files in seconds.

Also, not opening a port has become a security checkbox. If your home router isn’t a hardened Linux box, why would you prefer to let a ASUS 'WiFi Router' handle that critical networking function instead of a Linux box you can easily update and audit?

[–] jon-wood 1 day ago

This is frankly a bit nonsensical. "In a workplace setting, connecting to your residential IP will raise suspicions or alarms." - so will connecting to literally any unexpected VPN endpoint if the network is halfway competently monitored.

Just because your VPN endpoint is on a VPS somewhere rather than a computer on your home network doesn't make it any more secure, and the scare mongering here that somehow a home router will drastically mess up a function as simple as forwarding traffic coming in on a port to another machine is weird... if you don't trust it to do that then I'd get rid of the thing because that's its entire job.

[–] onel 2 days ago

Using anything on top of wireguard or plain? I heard headscale adds a nice layer

[–] wrxd 1 day ago

I use plain WireGuard. My use case is very simple: I have a server and a few clients (phone, laptop) I want to connect to the server when I'm away. I don't care to have VPN connectivity between my phone and laptop

[–] F_r_k 2 days ago

BTW, netbird is a cool alternative also

[–] dizhn 2 days ago

I prefer it too and I like that it's 100% open source. Server, client, everything. Pangolin also looks interesting if you don't need a full vpn. And if you go that way, Authentik with its embedded proxy is also worth considering.