Risks posed by a wireguard connection to a compromised server

Question

I am trying to understand the risks posed by having a wireguard connection under a very specific and narrow set of circumstances.

1. I have a desktop at home that is behind a router/firewall and is not exposed to the internet in any way.

2. I am planning to have a wireguard tunnel from this desktop to a server in the cloud.

3. The circumstances I am concerned about is if/when this server is fully compromised.

4. Since there is a wireguard tunnel between this server and my desktop, I expect any intruder who gains root on the server will be able to attack my desktop?

5. Precisely what will they be able to do (with regard to my desktop) once they manage to get root on the server?

6. Is the net effect as though my desktop were on the open internet exposed to this intruder? So they can directly reach all ports on wg0? And if one of the ports happens to be open/unsecured they can get into the desktop too?

7. Is there anything I can do to mitigate the risks of this? I will not be having ssh (or any other daemon) listening on the wg0 interface. I also plan to have a firewall set on my desktop to reject incoming connections but I don't know if this will work as intended if they are piggybacking off of an existing wireguard tunnel.

Thanks!

Answer 1

You can imagine the the wireguard VPN as a exclusive network cable between your desktop and your server. It is plugged in into an additional network interface on both devices. So they can send packages to each other over that cable in both directions.

I will try to answer you questions 4-7.

4. The attacker does not realy need root acccess to access the VPN tunnel. It is sufficient to have access to the server with any user who is allowed to send packages. But yes, if an attacker gets access to your server, he or she will be able send arbitrary packages to your desktop and attack it.

5. With root access the attacker can send any crafted network package over the VPN to your desktop. With normal user privileges, some special attacks can not be performed. But most of them are possible in both cases. The damage depends on your desktop. The attacker can definitively scan your desktop system for open ports and interact with them. If there are any open ports, he or she can call the services on that ports and try to abuse them. The attacker could also try to exploit bugs in the operating system of your desktop.

6. This is correct.

7. There are some possibilities to reduce the possible damage:

• Use a firewall to allow only the needed traffic from your server to your desktop.
• Disable all unused services and ports on your desktop to minimize the attack surface.
• Depending on the operating system and service, you could configure the services on your desktop to only listen to network interfaces other than the virtual one from the VPN. The attacker will be unable ti see or interact with them.
• You could only temporarily enable the VPN, if you want to manage your server but don't need a connection all the time in both directions.