SSL needed for LAN sites over Wireguard?
reddit / selfhosted

----------------------------------------------------------------------
sean_999 · 2023-12-04 18:43

Currently just accessing my home lab via wireguard. If I'm connecting
to my wireguard on public WiFi and accessing my non encrypted LAN
sites, can other users on the public WiFi see my unencrypted traffic?
Or does Wireguard encrypt from my home LAN to the remote pubic WiFi?

----------------------------------------------------------------------
AlexisColoun · 2023-12-04 18:54

The traffic travels within an encrypted tunnel from your client to
your gateway at home, therfore yes, wireguard will encrypt your data
and no, you don't need ssl for this.

----------------------------------------------------------------------
harlekintiger · 2023-12-04 19:18

Is there a benefit to using one anyway?

----------------------------------------------------------------------
AlexisColoun · 2023-12-04 19:23

Depends on your general network setup and if you expose services
directly and not only through a VPN

----------------------------------------------------------------------
harlekintiger · 2023-12-04 19:24

Please elaborate. We're assuming all of the exposing happens only
through a vpn

----------------------------------------------------------------------
AlexisColoun · 2023-12-04 19:36

Technical details aside, SSL/TLS and a VPN are doing something
similar, encapsulating your traffic and encrypting it, with the main
difference being that a VPN adds a pre shared keypair as an additional
security layer.


SSL would help to secure your internal network traffic from being
listened to, but that would require someone already being in your
network, or home to begin with.

----------------------------------------------------------------------
tenekev · 2023-12-04 20:31

There is benefit to using one, yes. I think of http, https, tcp and
other protocols as pipes. The fewer pipes you need to pipe traffic
through, the easier it is to manage.

It's a lot more realistic to need https than http so piping everything
through https makes the setup a lot simpler.

----------------------------------------------------------------------
zfa · 2023-12-04 20:31

I always use SSL even on internal resources, just like how I always
password protect internal services.

Neither are necessary but they are good practice and add another layer
of protection which is never a bad thing.

Even people who should know better can be compromised at some point
(case in point - LastPass' whole user db was compromised by a dev
simply not updating his Plex server at home!) so security in depth is
always wise.

SSL is somewhat trivial these days so a no brainer for me.