Comment by NikolaNovak | Hacker News Reader

Comment by NikolaNovak | Hacker News Reader

Parent Full thread

I've had a question for a long time: I've been involved with infra most of my life but not strictly networking. Given the vulnerabilities, AI adversaries, etc; understanding I'm a tiny fish in a massive pool; it's still been 15 years since I've felt comfortable allowing external access through VPN into my home network (which has my NAS etc).

I have a friend who does, exposing his Synology NAS and Windows server through Ubiquiti UDR7 on Bell Gigahub, but honestly, I feel he's doing that more out of different risk assessment / "Little knowledge is a dangerous thing" rather than sheer expertise and assurance.

For those who allow VPN access from outside into your home network - how do you have confidence that your configuration is correct, you understand all the config options and their interplay on your modem/router/firewall/OS stack, you're up to date with vulnerabilities and permissions, trust the apps and containers, etc? Are you network admin during daytime, or have fully nerded out about it for years, or have a risk threshold that's met, or something else? :)

My first tech job was working alongside the network admin at a regional ISP. I feel like a n00b on the subject, but objectively, I'm pretty good at it. So basically, I've nerded out about it for years. I do allow VPN access to my LAN, but even that is tightly firewalled with a default-deny policy. Connecting to the VPN just lets you make connections into the LAN's address space, but only for certain IPs and ports. I can connect into Plex running on the LAN, and specific ports on the NAS. I can SSH into a Linux box that doesn't have credentials to connect to anything else. That's about it, really.

I didn't set out to make a hypersecure setup, but approached it with "least access" in mind. I started with the default-deny firewall, and when I needed an exception, I added that one single exception. Honestly, if you follow that principle — don't allow it if you don't require it — you've done 95% of the work a dedicated expert would do.

Thanks for the response :)

That's the approach I took when I had VPN to my LAN ~20 -> ~10 years ago; now I worry about the massive "unknown unknowns" - sure, that Linux box doesn't have access to anything else... officially. But what vulnerability is there on that Linux box, or on the plex server, or anything else on your network, that might enable massive expansion of access?

Oh, I get it, trust me! Professional paranoia is a skill that's served me very well over the years! Especially with AI-driven attacks now: we might be little fish, but it's cheaper and easier to catch little fish than it ever has been.

But there's still a calculated risk. To get into this, someone would have to compromise the VPN, then compromise the firewall, then compromise the reasonably-hardened servers running behind it. Sure, those things might be possible. Even with AI, though, is it likely? I don't think it is.

"A ship in port is safe. But that’s not what ships were built for." - Grace Hopper

Reply on news.ycombinator.com