I setup wg-easy, am I somehow exposed to attacks? reddit / selfhosted ---------------------------------------------------------------------- No_Connection1258 · 2023-11-23 18:11 I configured wg-easy on my home-server (docker installation) and want to check if I missed something security-wise: - I port-forwarded UDP 51820 on my router - I have a domain which I purchsed, it's managed in Cloudflare and I created an A record pointing to my WAN IP. - Not sure if it matters, but all I have for my `wg.domain.com` is a username/password authentication and it's secured with an SSL certificate, which is obviously only valid inside of my LAN. I currently assume that since I port-forwarded a UDP port, people can't try and access `MY_WAN:51820`. Is it somewhat correct? Any tips on this would be great. I'm not interested in exposing my setup to the internet, all I want is a secure VPN to sometimes access my network from my phone. By the way, huge props to wg-easy, very quick and simple setup. ---------------------------------------------------------------------- DarkKnyt · 2023-11-23 19:00 Yes the wireguard standard port is open but it is secured with the exchange keys that are very hard to crack. Additionally, all the traffic, I believe is encrypted with the key. You can make it more secure by using a non standard port. No casual attacker is going to scan the entire range of ports with all the available queries, at least not with ssh on 22 being often open. ---------------------------------------------------------------------- Simplixt · 2023-11-23 19:24 \- Don't expose the web interface of wg-easy ( 51821 ) to the internet \- update your docker installation frequently \- Keep the private keys of your clients safe That's all you need to do. Personally I also would change the UDP port of WG (via different port forwards of your router). But more for getting through firewalls in public WiFis (e.g. UDP Port 443, 53 or 123) ---------------------------------------------------------------------- Simplixt · 2023-11-23 19:28 WireGuard is not responding to packets without the correct key. So if you have a good configured firewall that "drops" packets (and not "rejects" them), port scanners cannot even tell on which port you are running wireguard ;) ---------------------------------------------------------------------- tech2but1 · 2023-11-23 19:29 Any open port is open to being breached if you run services on it that can be breached. Your IP will be scanned continuously no matter what you do, the domain is irrelevant. > I currently assume that since I port-forwarded a UDP port, people can't try and access MY_WAN:51820. Is it somewhat correct? People can try and access whatever they want. However, what do you mean by: > it's secured with an SSL certificate, which is obviously only valid inside of my LAN. ---------------------------------------------------------------------- SeirWasTaken · 2023-11-23 19:44 \> You can make it more secure by using a non standard port Randomizing ports isn't considered a security improvement, ever ---------------------------------------------------------------------- DarkKnyt · 2023-11-23 19:53 Yeah I don't really think it is either but l some have mentioned it. I guess in combination with things like fail2ban a brute force attack would result in an ip ban. ---------------------------------------------------------------------- DarkKnyt · 2023-11-23 19:54 Even better ---------------------------------------------------------------------- d4nm3d · 2023-11-23 21:16 agreed on all of this however updating the docker container feels a little pointless with this one.. it's not been updated in over a year.. Unless, by updating it is actually pulling an updated wireguard.. do you know if thats the case? ---------------------------------------------------------------------- j_fan · 2023-11-24 01:06 How can I achieve that? Drop all packets to that port? ---------------------------------------------------------------------- ffimnsr · 2023-11-24 03:25 Wireguard is pretty much secure as any connection that is not authenticated is immediately dropped. If you open port 51820 only, then I think that's okay. Pretty much if you use distro wg, then just keep it up to date. I don't know any 0-day vuln for wireguard yet, so just be cautious and monitor logs. ---------------------------------------------------------------------- tech2but1 · 2023-11-24 07:44 I guess it's considered less insecure rather than more secure? Some bots will do a quick scan on common ports but yes using non-standard ports doesn't hide you from every bot. ---------------------------------------------------------------------- Simplixt · 2023-11-24 08:03 Wireguard is dropping automatically. You must set your firewall, to drop also packets to all other ports (if it is rejecting by default), so that a port scanner can't see which port is "special". ---------------------------------------------------------------------- j_fan · 2023-11-24 14:41 I see, thank you!