On Sat, Oct 06, 2018 at 11:21:01AM +0100, Brian Candler wrote: > My even more stupid question is "why use wireguard if the only thing it's > carrying is ssh?" - but I guess it's a convenient way to tunnel to a network > which doesn't have public-routed addresses.
Right -- and I also don't want to expose ssh ports to the world when not necessary. It's still a root-perms daemon with a (remote) possibility of unknown vulnerabilities in it. > (Aside: I wish ssh had a feature like SNI, so that you could build an ssh > proxy that forwards incoming connections to the right host. I have done > this before using an inbound SOCKS proxy, but it's messy to use) It also has important downsides that are similar to those in ssh bastion hosts. When you use a proper VPN, every user gets their own internal IP address, so their traffic can be still easily distinguished from traffic belonging to another admin. This is useful for auditing reasons and for identifying unusual activity (e.g. Alex normally accesses hosts belonging to project X, but suddenly starts accessing a lot of hosts that belong to project Y). With bastion hosts or with DNAT-ing proxies this auditing becomes impossible, since all traffic comes from the same IP. -K _______________________________________________ WireGuard mailing list WireGuard@lists.zx2c4.com https://lists.zx2c4.com/mailman/listinfo/wireguard