101–110 of 175 posts
I don't want to be a hater, but exposing access to your homelab through a "fully vibe coded" application (it's mentioned at the bottom of the README) is probably not a good idea. The idea itself sounds fun though
I will never, ever understand this "single-packet authentication" "port knocking" fetish. It has never made sense. Bin it, along with fail2ban, and just set up WireGuard. Your network authentication should not be a fun game or series of Rube Goldberg contraptions.
Just skip the plaintext password (the sequence of ports transmitted) and use certificate based auth, as you note below.
I will never, ever understand this "single-packet authentication" "port knocking" fetish. It has never made sense. Bin it, along with fail2ban, and just set up WireGuard. Your network authentication should not be a fun game or series of Rube Goldberg contraptions.
I view port knocking as just a very, very poor form of an unencrypted PSK (replayable) authentication step. Just skip the plaintext password (the sequence of ports transmitted) and use certificate based auth, as you note below.
I use fwknop in a similar manner, the main advantage it has is it's using an encrypted UDP packet. It's ability to call shell scripts for more advanced uses is its best feature. I have a packet set up for a rolling restart of all my services as well as ssh access
Earlier quoted context omitted.
Depends on the use-case, IPsec is often not supported by many LANs. Also, network crossing is 1 badly configured client away from full infrastructure worming. At some point, the idealism of white-listed pears and VPN will fail due to maintenance service costs. Two things may be true at the same time friend. =3 https://www.poetry.com/poem/101535/the-blind-men-and-the-ele...
Yes, and those two true things are: - You should be using WireGuard. - “Port knocking” is pointless theater.
IPSec is simply a luxury unavailable on some LANs =3
Earlier quoted context omitted.
"We had a secure VPN option set up, but then we had to replace our Ivanti VPN solution so we switched to Fortigate. Then there were some concerns so we jumped to Sonicwall. After that debacle we finally got the budget to go with Cisco and I'm sure everything will be fine now!"
I said a secure VPN option. However, even with all those choices, “port knocking” still wouldn’t be a solution for anything. [edit] Are you just searching for random WireGuard CVEs now? CVE-2024-26950 was a *local-only* DoS and potential UaF requiring privileged access to wireguard netlink sockets.
Firewall administrative network port traffic priority is important for systems under abnormal stress.
Its 2025, Just use Tailscale.
If you're running a homelab, the likelihood that you're interested in removing cloud-dependencies from your stack is above average. If that's the case, Tailscale is out. Tailscale is just an added unnecessary external dependency layer (& security attack surface) on top of vanilla Wireguard. And in 2025 it's easier to run vanilla Wireguard than it's ever been.
Earlier quoted context omitted.
Thanks for filling in the details. I agree that an IP allow list works best for users who are alone on an IP that doesn't change often, which is the case for a majority of home internet users but not when they're away from home.
Unfortunately there's an increasing number of home internet connections behind CGNat, as IPv4 adresses run out (and IPv6 doesn't gain momentum, heaven knows why)
IPv6 is slowly growing in popularity. Google stats are close to 50%. If your ISP has IPv6, you might be accessing Hacker News with IPv6 since they added support recently.
Earlier quoted context omitted.
I said a secure VPN option. However, even with all those choices, “port knocking” still wouldn’t be a solution for anything. [edit] Are you just searching for random WireGuard CVEs now? CVE-2024-26950 was a *local-only* DoS and potential UaF requiring privileged access to wireguard netlink sockets.
You mean CVE-2024-26950 ? =3 Firewall administrative network port traffic priority is important for systems under abnormal stress.
Earlier quoted context omitted.
If you're running a homelab, the likelihood that you're interested in removing cloud-dependencies from your stack is above average. If that's the case, Tailscale is out. Tailscale is just an added unnecessary external dependency layer (& security attack surface) on top of vanilla Wireguard. And in 2025 it's easier to run vanilla Wireguard than it's ever been.
Not really. Most things people run in homelabs have tons of cloud dependencies. Try running Home Assistant offline, for example.
I know there's plenty of HA integrations that require some cloud service but the core application is very offline-friendly...