In the past two weeks I set up a new VPS, and I run a small experiment. I share the results for those who are curious.
Consider that this is a backup server only, meaning that there is no outgoing traffic unless a backup is actually to be recovered, or as we will see, because of sshd.
I initially left the standard "port 22 open to the world" for 4-5 days, I then moved sshd to a different port (still open to the whole world), and finally I closed everything and turned on tailscale. You find a visualization of the resulting egress traffic in the image. Different colors are different areas of the world. Ignore the orange spikes which were my own ssh connections to set up stuff.
Main points:
-
there were about 10 Mb of egress per day due just to sshd answering to scanners. Not to mention the cluttering of access logs.
-
moving to a non standard port is reasonably sufficient to avoid traffic and log cluttering even without IP restrictions
-
Tailscale causes a bit of traffic, negligible of course, but continuous.
Please ELI5: How does this solution work? You tunnel yourself in your home network with a VPN on your PI? How is that safer, isn't there still a port open?
I have a port open, yes, but it's not port 22. The problem with Tailscale is you're trusting a third party. With my setup, it's just me connecting directly to my Pi. Thanks to port forwarding the only open port pointing to my Pi is the one that I use for WireGuard.
I already have a DDNS and domain name pointing to my house, so there's effectively no added risk compared to my existing setup with a couple webapps being reverse proxied behind Caddy on a different device.
Thanks! I think I get too hung up on the VPN-part. If I had a setup where I open one Port to a Pi which is set up as a nginx reverse proxy that redirects the connection to my different services depending on the URL - homeassistant.myserver.com, backup.myserver.com,... - would that be considered a VPN?
no, and that’s be a pretty bad idea, you’re opening up all your internal hosts to the public internet.
a VPN is specifically designed to keep all your internal hosts off the public internet. When you authenticate with the VPN server the remote device you are using effectively “joins” the internal network, using the VPN to act like a tunnel between you and your network.
it has the benefits of better security as well as the fact that once you set it up, you can access any services you host, not just HTTP ones.
That sounds good, I will read more about setting up a VPN. Thank you!