I’d like to run a VPN locally, and am just double checking I understand the security correctly.
I want to run Wirwguard easy via Casaos on Ubuntu server.
My router will port forward a high port number, check daily for updates, and I’ll update the server weekly.
Is there anything I’m missing?
Good point, kernel updates should be paired with reboots to get kernel patches applied quickly.
Yes wireguard would only accept connections clfrom clients with known certificates, but this is “belt and suspenders” approach. What happens if there’s a bug in wireguards packet parsing or certificate processing? Using port knocking would protect against this —very remote— possibility.
Not to knock on the security, but what is the threat model you are protecting against?
I see people harp on about security and you can do X or you need to do Y as if they hold a million bucks in Bitcoin to protect.
We make concessions every day with security for convenience. Most people’s threat model doesn’t include wire guard might respond to connection attempts without the proper key AND this will somehow allow an attacker to leverage a vulnerability in wire guard to gain access. However, I admit that some people’s paranoia makes them want to add every bit of security they possibly can even if it’s the most frustrating day to day usage.
Self hosting individuals aren’t a lucrative target for ransomware. Nor is it for most targeted hacking attempts.
i also think that it’s overkill, especially for a minimalistic tool like wireguard. That’s why I mentioned “if you want to be extra paranoid”. This forum is for learning, and this question is an open ended learning question, hence, an opportunity to learn about port knocking, even if the actual real life benefit of that would be minuscule.