| ▲ | wrxd 2 hours ago |
| I like Tailascale as a product but I decided to move my homelab to plain WireGuard. I wasn't using any of the additional features, I can get away with exposing a port on my router and I am changing devices rarely. News like this make me happy I removed a lot of complexity and attack surface |
|
| ▲ | OptionOfT 2 minutes ago | parent | next [-] |
| On the road I find WireGuard to be quirky when connecting to DNS names. When I'm on an IPv6 only network (like T-Mobile), connecting to a DNS name that offers A and AAAA, WireGuard on iOS prefers the A record, making me connect over one of T-Mobile's 464XLAT proxies which time out after x minutes. This then makes the connection look dead until I do something on my phone that re-enables it. Tailscale doesn't have this issue. |
|
| ▲ | LeBit 2 minutes ago | parent | prev | next [-] |
| You shouldn’t open a port on your router. Connect from your home to a public VPS and connect your public devices to that VPS. |
|
| ▲ | femiagbabiaka 2 hours ago | parent | prev | next [-] |
| > I can get away with exposing a port on my router using wireguard is awesome, but I wouldn't say deploying and maintaining it lacks complexity exactly. and you didn't get rid of attack surface, you just made it your responsibility ;) |
| |
| ▲ | ectospheno an hour ago | parent | next [-] | | Always is your responsibility even with tailscale. Now it is his responsibility without tailscale. | |
| ▲ | LoganDark 2 hours ago | parent | prev | next [-] | | Attack surface almost entirely goes away if you just require a good port knock first! I do that with my protection SSH servers and it works just fine. Also prevents anyone from knowing there even is an SSH server there. Or any server if it doesn't respond to pings either, and only uses reverse tunnels to accept public connections | | |
| ▲ | neilalexander an hour ago | parent | next [-] | | Wireguard doesn’t respond to malformed packets or handshakes from unknown devices by design. | | | |
| ▲ | mbreese an hour ago | parent | prev | next [-] | | Is there a way to automate port knocks in your .ssh/config? I think that’s the main reason why I haven’t added it to my home server. | | |
| ▲ | LoganDark an hour ago | parent [-] | | Technically you could use a ProxyCommand that does the knock and then runs nc to your target. |
| |
| ▲ | lakeviewterrace an hour ago | parent | prev [-] | | Port knocking is idiotic and amounts to Biff Tannen's "only I know how to start this car". | | |
| ▲ | Gigachad an hour ago | parent | next [-] | | Dunno, in combination with having an up to date system following best practices, port knocking is probably going to save you when bots start scanning the internet with the next SSH 0day. Any amount of friction will cause the bots to move to the next IP address. | | |
| ▲ | icedchai an hour ago | parent | next [-] | | Just moving SSH off a default port gets you 98% there. | | |
| ▲ | LoganDark an hour ago | parent [-] | | An attacker only has to get lucky once, so while I do put SSH on a non-default port too, it's not enough to avoid attacks on its own. | | |
| ▲ | icedchai 43 minutes ago | parent [-] | | I mostly do it to quiet down the noise from the non-stop bots and scanners. | | |
| ▲ | LoganDark 16 minutes ago | parent [-] | | Being off the IPv4 space completely can be even more effective at that, FWIW, but that can have other issues. Only feasible for some! |
|
|
| |
| ▲ | esseph an hour ago | parent | prev | next [-] | | LLMs port knock for redteam scans. Have for a long time. | | |
| ▲ | LoganDark an hour ago | parent [-] | | My knock for SSH was 20 ports within 2 seconds. knockd resets the sequence if you hit any of its ports out of order. I generated the sequence with a CSPRNG. |
| |
| ▲ | an hour ago | parent | prev [-] | | [deleted] |
| |
| ▲ | LoganDark an hour ago | parent | prev [-] | | It's more like "only I know how to find this keyhole". You still need the key then, you're just also adding some defense against picking. It would be idiotic to use the knock as the only authentication, which is why I don't. To be quite honest, I just like the aesthetics of it. |
|
| |
| ▲ | swingandamiss 2 hours ago | parent | prev [-] | | With AI, the complexity doesn't really matter anymore. Codex or Claude can easily configure complex site-to-site setups and peer configurations on mobile devices. I did this by hand before and it was hard and difficult to get right. Now I just tell AI and it does so perfectly, checks and verifies things. AI made life so easy. | | |
| ▲ | LeBit 8 minutes ago | parent | next [-] | | It makes no sense at all to configure a >3 nodes wireguard setup with straight wireguard. Wireguard is the building block for higher level tools like Tailscale to build on. | |
| ▲ | drum55 an hour ago | parent | prev | next [-] | | No amount of claude can handle the key thing that Tailscale fixes about wireguard, all of the connection to connection logic is handled be it direct, via all sorts of weird hole punching or via relays. Wireguard itself is horrible to do this with, half the time you're just looking at `wg status` wondering why the packet counter isn't incrementing today. It can never achieve the magic that is a direct connection between plane wifi and a host that's behind NAT on the ground. | | |
| ▲ | swingandamiss an hour ago | parent [-] | | [dead] | | |
| ▲ | LoganDark 44 minutes ago | parent [-] | | It makes me happy that I can automate some menial tasks or replace a search engine sometimes, but this is just because I already have knowledge of the field and the skill to apply it. You're not wrong that it'll probably get even better, but I don't see a path right now to unskilled people being able to effectively use an agent. Only time will tell if that can happen. I do disagree with GP's assertion that Claude can never make something comparable to Tailscale, but that's just because I believe I (and probably many others here) could probably prompt that, not because I think just anyone could. LLMs can one-shot a fair few things based on unskilled prompts, but I don't believe this is one of them yet. | | |
| ▲ | swingandamiss 39 minutes ago | parent [-] | | Right now it's not unskilled. It's managers, PMs, TPM's, or people with some tech knowledge but who previously couldn't do these types tasks (not that they weren't capable, but it takes a lot of effort and time to get skilled in these areas and they didn't devote the time). They know what they want at a high level and now can do it with AI. | | |
| ▲ | LoganDark 36 minutes ago | parent [-] | | This is mostly true. I think this is a sweet spot for LLMs, too. Maybe with the right approach, a user could know or figure out how to articulate what they're missing, if the first attempt doesn't work well enough for them. I just worry that e.g. if they forget to review things like protocol details, they could silently end up with flaws and such, or jank. But yeah, there's potential where there wasn't before, and I'm all for that. |
|
|
|
| |
| ▲ | arcanemachiner 2 hours ago | parent | prev | next [-] | | This is true, but I still wouldn't discount the possibility of mistakes. It's good to know how your home network works. Even Opus 5.5 can make some pretty dumb mistakes, particularly if it doesn't have the full picture. | | |
| ▲ | swingandamiss an hour ago | parent [-] | | Humans also make mistakes. At this point, I trust AI more than humans when it comes to casually configuring VPNs. I've read many who exposed things by mistake on reddit. AI has nearly solved this, probably is a solved issue at this point. |
| |
| ▲ | femiagbabiaka 2 hours ago | parent | prev [-] | | I would not personally expose my devices over a VPN that I self-hosted and set up purely through AI unless I felt like I understood how it worked completely. But that's probably just personal paranoia. | | |
| ▲ | swingandamiss an hour ago | parent [-] | | Just go read reddit threads on people who do this by hand following half baked guides. There's a huge population doing this, now everyone is switching to AI. It's a big win and safer. Not everyone is a trained network engineer, but now they are with AI |
|
|
|
|
| ▲ | fooqux 2 hours ago | parent | prev | next [-] |
| From the sounds of what info they felt was safe to provide, this wouldn't have impacted you anyway. |
| |
|
| ▲ | F_r_k an hour ago | parent | prev [-] |
| BTW, netbird is a cool alternative also |
