Hacker News Reader

Comment by femiagbabiaka | Hacker News Reader

> I can get away with exposing a port on my router

using wireguard is awesome, but I wouldn't say deploying and maintaining it lacks complexity exactly. and you didn't get rid of attack surface, you just made it your responsibility ;)

View on HN

Always is your responsibility even with tailscale. Now it is his responsibility without tailscale.

Attack surface almost entirely goes away if you just require a good port knock first! I do that with my protection SSH servers and it works just fine. Also prevents anyone from knowing there even is an SSH server there. Or any server if it doesn't respond to pings either, and only uses reverse tunnels to accept public connections

Is there a way to automate port knocks in your .ssh/config? I think that’s the main reason why I haven’t added it to my home server.

Technically you could use a ProxyCommand that does the knock and then runs nc to your target.

Port knocking is idiotic and amounts to Biff Tannen's "only I know how to start this car".

Dunno, in combination with having an up to date system following best practices, port knocking is probably going to save you when bots start scanning the internet with the next SSH 0day. Any amount of friction will cause the bots to move to the next IP address.

LLMs port knock for redteam scans. Have for a long time.

My knock for SSH was 20 ports within 2 seconds. knockd resets the sequence if you hit any of its ports out of order. I generated the sequence with a CSPRNG.

That's not a knock, it's a password :-)

I mean, it suffers from some of the same issues with knocks, like being replayable. Wonder if anyone's come up with a TOTP-like thing for port knocks, where the code changes every little bit...

That’s cute. Have Claude do it. There is already an echo system of TOPT QR to communicate it, so you would just need to convert your six digit code to two or more hits on the 16bit port range.

I’m not even sure you need more than two. One seems bad because that’s just a lucky port scanner one time.

Yes something like that has been done, the solution uses asymmetric cryptography instead of symmetric and it protects the entire communication stream instead of just opening the gates - it's called Wireguard.

I jest, but you're describing authentication protocol which uses the UDP destination port field to carry each character of the "one time password" in a roundabout way. You could simply send 1 packet containing the password to the daemon.

I've never seen it used in the wild but apparently, it exists: https://github.com/mrash/fwknop

LOL'd at Wireguard, but I really miss Plan 9-style networking, where you can basically just scope VPNs to a subprocess rather than having to use some system wide network filter with split tunneling or whatever. Wireguard has huge usability issues due to that.

Reading the fwknop README is such a breath of fresh air, thank you for that treat. I hate AI-generated documentation so much.

> where you can basically just scope VPNs to a subprocess rather than having to use some system wide network filter with split tunneling or whatever. Wireguard has huge usability issues due to that.

You can run wireguard in userspace with something like wireproxy which connects to a wireguard peer and acts as a proxy for your subprocess.

[1] https://github.com/windtf/wireproxy

Yep, we used fwknop for several years at work, back when it was written in perl. And now we use Wireguard.

Just moving SSH off a default port gets you 98% there.

An attacker only has to get lucky once, so while I do put SSH on a non-default port too, it's not enough to avoid attacks on its own.

I mostly do it to quiet down the noise from the non-stop bots and scanners.

Being off the IPv4 space completely can be even more effective at that, FWIW, but that can have other issues. Only feasible for some!

It's more like "only I know how to find this keyhole". You still need the key then, you're just also adding some defense against picking.

It would be idiotic to use the knock as the only authentication, which is why I don't.

To be quite honest, I just like the aesthetics of it.

You're sending your knock over the public network in the clear. It's observable by anything in the path. And then you're not the only one that can find the keyhole.

Entirely true, it's not true security, same as changing the ssh port. So, relying on it for any security is not useful but it's a good deterrent from automated scans that are not targeted towards you. Defense in depth means not necessarily discarding flawed defenses if they are in addition to proper defense.

Wireguard doesn’t respond to malformed packets or handshakes from unknown devices by design.

Oh, awesome!

With AI, the complexity doesn't really matter anymore. Codex or Claude can easily configure complex site-to-site setups and peer configurations on mobile devices. I did this by hand before and it was hard and difficult to get right. Now I just tell AI and it does so perfectly, checks and verifies things. AI made life so easy.

I would not personally expose my devices over a VPN that I self-hosted and set up purely through AI unless I felt like I understood how it worked completely. But that's probably just personal paranoia.

Just go read reddit threads on people who do this by hand following half baked guides. There's a huge population doing this, now everyone is switching to AI. It's a big win and safer. Not everyone is a trained network engineer, but now they are with AI

This is true, but I still wouldn't discount the possibility of mistakes. It's good to know how your home network works. Even Opus 5.5 can make some pretty dumb mistakes, particularly if it doesn't have the full picture.

Humans also make mistakes. At this point, I trust AI more than humans when it comes to casually configuring VPNs. I've read many who exposed things by mistake on reddit. AI has nearly solved this, probably is a solved issue at this point.

No amount of claude can handle the key thing that Tailscale fixes about wireguard, all of the connection to connection logic is handled be it direct, via all sorts of weird hole punching or via relays. Wireguard itself is horrible to do this with, half the time you're just looking at `wg status` wondering why the packet counter isn't incrementing today. It can never achieve the magic that is a direct connection between plane wifi and a host that's behind NAT on the ground.

I can’t think of a single time I’ve wanted to connect between two hosts when I haven’t specifically allowed one through a firewall

NAT are not firewalls.

Functionally they are. Allow traffic aiming at this address and this port to arrive on this server.

Not that my WireGuard connection needs nat as it terminates on my router. And I use private ip ranges as I want to be sure that if WireGuard drops out for some reason traffic doesn’t route over the unencrypted path. Defence in depth.

It makes no sense at all to configure a >3 nodes wireguard setup with straight wireguard.

Wireguard is the building block for higher level tools like Tailscale to build on.

Reply on news.ycombinator.com