How would you secure a KVM VPS, with pre-Wireguard Linux kernel and no
access to ports 80/443?
reddit / selfhosted

----------------------------------------------------------------------
Digital_Voodoo · 2023-10-20 09:22

I have a few VPSes that can only be accessed via Wireguard (full-
tunnel). A some hosted apps with external access are behind a Caddy
authentication.

None of this is possible with an cheap exotic VPS I got recently,
because (1) it's KVM with Linux 4.19 kernel, implying no native
Wireguard support, (2) I have access to only 10 ports, from 2101 to
2110, while Caddy needs access to ports 80 and 443, at least in my
understanding.

I've tried various tutos to compile and install Wireguard for old
kernels, to no avail so far. I've also tried changing the port when
installing Caddy, doesn't go through either.

How would you people secure such a VPS like that? Nothing critical is
hosted on it.

Thanks in advance.

----------------------------------------------------------------------
zfa · 2023-10-20 09:30

When it comes to VPN access I'd just run userspace WireGuard and
pretend it's no different to any of the others.

First Google hit: https://github.com/adrianmihalko/wireguard-old-
kernel

As for *public* access, a Caddy proxy on one of the other VPSes could
still proxy to services on the shitty VPS if you set up a WG link
between them with the appropriate routing. GL.

----------------------------------------------------------------------
lilolalu · 2023-10-20 09:33

OpenVPN like we did it for decades?

----------------------------------------------------------------------
zarlo5899 · 2023-10-20 09:49

you can change what ports Caddy use you might have an issue if you
want to get ssl certs with lets encrypt

----------------------------------------------------------------------
Digital_Voodoo · 2023-10-20 11:12

That's my exact pain point, I'd like to get a SSL cert while I'm at it

----------------------------------------------------------------------
Swedophone · 2023-10-20 11:46

If it's possible to run openvpn then it should also possible to run
wireguard-go, both use tuntap.

----------------------------------------------------------------------
lilolalu · 2023-10-20 12:09

Without Kernel extensions it's probably not faster than OpenVPN or is
it?

----------------------------------------------------------------------
Some-Dare5179 · 2023-10-20 15:21

You can do DNS challenge to get letsencrypt certs with caddy.

----------------------------------------------------------------------
Ordinary_Employer_39 · 2023-10-20 20:35

This Project should help [https://github.com/NOXCIS/Worm-
Hole](https://github.com/NOXCIS/Worm-Hole)

----------------------------------------------------------------------
ompster · 2023-10-21 09:25

Cloudflare tunnel

----------------------------------------------------------------------
Digital_Voodoo · 2023-10-21 23:00

I saw that link. But then there is a `go`error in compiling Wireguard
for the old kernel... Because apparently Debian repos don't have the
latest Go version, and installing it manually + configuring it into
the proper directories is a bit of a headache, at least for me.

Thanks for the suggestion.