48
Why VPN tunnels are safer than opening a port on my router?
(programming.dev)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 27 May 2024
48 points (94.4% liked)
Selfhosted
39677 readers
357 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 1 year ago
MODERATORS
I completely disagree with recommending exposing a port to someone who's asking this very question about the relative risks.
If they lack the expertise to understand the risk differences, then they very much lack the expertise to securely expose a port.
How can you ever learn the risks of exposing ports if all answers are "if you don't know you shouldn't do it"?
The post explicitly recommends ONLY exposing the wireguard port, not 80/443/22 which one should usually not do anyways. Very different things!
Yes, and to be fair the OP doesn't even need to expose a port on his home network. He can do the opposite and have the port exposed on the VPS and have the local router / server connect to the VPS endpoint instead. This will also remove the issues caused by having dynamic IPs at home as well.
And that's a different animal (moving the goalposts, which is an excellent idea, but OP didn't even think of doing this).
OP asked about exposing a local port, which is a Bad Idea 99.9% of the time, especially for someone asking why it's a risk.
Using a VPS with reverse proxy is an excellent approach to adding a layer between the real resource and the public internet.
By learning before you take on the risk.
It's not like this isn't well documented.
If OP is asking this question, he's nowhere near knowledgeable enough to take on this risk.
Hell, I've been Cisco certified as an instructor since 1998 and I wouldn't expose a port. Fuck that.
I could open a port today, and within minutes I'll be getting hammered with port scans.
I did this about 10 years ago as a demonstration, and was immediately getting thousands of scans per second, eventually causing performance issues on the consumer-grade router.