Hacker News Reader

Correct, but his solution is a hair improvement at best over port knocking.

A VPN means an individual connection is authorized into the interior courtyard.

A Lambda with 2FA to whitelist an IP, then a cron job to cleanup means everyone at your local cafe wireless access point is also authorized into the inner courtyard.

View on HN

No, the IP whitelist is only to allow access to the network entry point. So if you had a VPN, it would open the port to the VPN server. In our case, it opens the port to the cordoned-off SSH-based network entry point. It's not the replacement of an existing authorization layer; its an addition where one usually isn't found.

Reply on news.ycombinator.com