I am trying to understand the risks posed by having a wireguard connection under a very specific and narrow set of circumstances.
I have a desktop at home that is behind a router/firewall and is not exposed to the internet in any way.
I am planning to have a wireguard tunnel from this desktop to a server in the cloud.
The circumstances I am concerned about is if/when this server is fully compromised.
Since there is a wireguard tunnel between this server and my desktop, I expect any intruder who gains root on the server will be able to attack my desktop?
Precisely what will they be able to do (with regard to my desktop) once they manage to get root on the server?
Is the net effect as though my desktop were on the open internet exposed to this intruder? So they can directly reach all ports on wg0? And if one of the ports happens to be open/unsecured they can get into the desktop too?
Is there anything I can do to mitigate the risks of this? I will not be having ssh (or any other daemon) listening on the wg0 interface. I also plan to have a firewall set on my desktop to reject incoming connections but I don't know if this will work as intended if they are piggybacking off of an existing wireguard tunnel.