0

When it comes to securing your home hosted servers, the most common advice appears to be:

1.Have a VPS with a reverse proxy 2.Tunnel to your home network from the VPS using a VPN like Wireguard

Although I understand 1 (hides IP, DDOS protection), I don’t see why doing 2 is any better than simply exposing the relevant port rather than the Wireguard port.

If an application listening to that port is insecure, the attack surface is the same, whether its ingress is an open port or a Wireguard tunnel. Am I right?

1
  • Most non-commercial internet providers specifically disallow home servers. Some actively block, some randomly check. Commented Feb 2, 2023 at 20:20

1 Answer 1

1

Tunnel to your home network from the VPS using a VPN like Wireguard

The suggestion should be slightly different: Tunnel FROM your home network TO the VPS using a VPN. Note the difference: the tunnel is initiated from inside the home network, not from outside.

This means no port forwarding is needed into the home network - which greatly reduces the attack surface. Also the tunnel is fully under control from the home network and can be simply stopped if there is a problem with the VPS like a potential compromise. And if the VPS is compromised no credentials could be leaked which would allow an attacker to build its own tunnel into your network.

Even better than a VPN would be an application based tunnel, which by design limits access to the application from the VPN instead to the whole system.

If an application listening to that port is insecure, the attack surface is the same, whether its ingress is an open port or a Wireguard tunnel.

It is true that a VPN tunnel by itself does not protect against attacks to the application. But the reverse proxy on the VPS in front of the tunnel can do, like requiring additional authentication, implementing a WAF ... Of course, such protection could also be implemented internally directly in front of the internal application.

But a simple port forwarding has another problem - contrary to a VPN (or even better application-based tunnel) from the internal server machine to the external VPS, a port forwarding exposes any internal system/application which happens to run on the given IP:port. This might have been the specific application at the time the port forwarding was created, but it is simpel to change internal things over time and forget that there was some port forwarding from the outside - thus potentially exposing a different application to the internet.

1
  • Great points, thank you
    – user288803
    Commented Feb 2, 2023 at 21:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .