Hi!

I often read suggestions to use something like Tailscale to create a tunnel between a home server and a VPS because it is allegedly safer than opening a port for WireGuard (WG) or Nginx on my router and connecting to my home network that way.

However, if my VPS is compromised, wouldn’t the attacker still be able to access my local network? How does using an extra layer (the VPS) make it safer?

  • BearOfaTime@lemm.ee
    link
    fedilink
    English
    arrow-up
    2
    arrow-down
    16
    ·
    5 months ago

    I completely disagree with recommending exposing a port to someone who’s asking this very question about the relative risks.

    If they lack the expertise to understand the risk differences, then they very much lack the expertise to securely expose a port.

    • Poutinetown@lemmy.ca
      link
      fedilink
      English
      arrow-up
      13
      arrow-down
      1
      ·
      5 months ago

      How can you ever learn the risks of exposing ports if all answers are “if you don’t know you shouldn’t do it”?

      The post explicitly recommends ONLY exposing the wireguard port, not 80/443/22 which one should usually not do anyways. Very different things!

      • TCB13@lemmy.world
        link
        fedilink
        English
        arrow-up
        5
        ·
        edit-2
        5 months ago

        Yes, and to be fair the OP doesn’t even need to expose a port on his home network. He can do the opposite and have the port exposed on the VPS and have the local router / server connect to the VPS endpoint instead. This will also remove the issues caused by having dynamic IPs at home as well.

        • BearOfaTime@lemm.ee
          link
          fedilink
          English
          arrow-up
          1
          arrow-down
          1
          ·
          5 months ago

          And that’s a different animal (moving the goalposts, which is an excellent idea, but OP didn’t even think of doing this).

          OP asked about exposing a local port, which is a Bad Idea 99.9% of the time, especially for someone asking why it’s a risk.

          Using a VPS with reverse proxy is an excellent approach to adding a layer between the real resource and the public internet.

      • BearOfaTime@lemm.ee
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        1
        ·
        edit-2
        5 months ago

        By learning before you take on the risk.

        It’s not like this isn’t well documented.

        If OP is asking this question, he’s nowhere near knowledgeable enough to take on this risk.

        Hell, I’ve been Cisco certified as an instructor since 1998 and I wouldn’t expose a port. Fuck that.

        I could open a port today, and within minutes I’ll be getting hammered with port scans.

        I did this about 10 years ago as a demonstration, and was immediately getting thousands of scans per second, eventually causing performance issues on the consumer-grade router.