Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Knocker, a knock based access control system for your homelab

github.com

Post reply on HN
Print view View original

161–170 of 175 posts

Re: Knocker, a knock based access control system for your homelab

#161

Post by Joel_Mckay »

tptacek wrote: post #151
Joel_Mckay wrote: post #150

Earlier quoted context omitted.

The relatively benign legacy kernel level pointer-bug CVE chosen is hardly the worst thing from WireGuard or strongSwan over the years. However, it makes the point a priority reliable network side-channel administrative login is more robust under some use-cases. Adding layers of complexity rarely improves security, and doesn't usually address the underlying issue of accountability. And I often ponder if a bastion hos…

The bug you cited is in Netlink . It's not exposed on the network. What's the "worse" thing you're referring to? I think you just searched "WireGuard CVE" and tried to play it off.

In general, doing a qualitative summary of the projects impact is less helpful, and never as verbose as some would prefer on platform specific issues. Additionally, wireguard is now more popular than strongswan these days...

https://www.cve.org/CVERecord/SearchResults?query=ipsec

https://www.cve.org/CVERecord/SearchResults?query=wireguard

https://www.cve.org/CVERecord/SearchResults?query=strongswan

Best of luck, and straw-man arguments are never taken seriously. =3

Re: Knocker, a knock based access control system for your homelab

#162

Post by tptacek »

Joel_Mckay wrote: post #161
tptacek wrote: post #151

Earlier quoted context omitted.

The bug you cited is in Netlink . It's not exposed on the network. What's the "worse" thing you're referring to? I think you just searched "WireGuard CVE" and tried to play it off.

In general, doing a qualitative summary of the projects impact is less helpful, and never as verbose as some would prefer on platform specific issues. Additionally, wireguard is now more popular than strongswan these days... https://www.cve.org/CVERecord/SearchResults?query=ipsec https://www.cve.org/CVERecord/SearchResults?query=wireguard https://www.cve.org/CVERecord/SearchResults?query=strongswan Best of luck, and…

This reads like a long-winded way of saying you aren't bothering to read what the vulnerabilities actually are.

Re: Knocker, a knock based access control system for your homelab

#163

Post by Joel_Mckay »

tptacek wrote: post #162
Joel_Mckay wrote: post #161

Earlier quoted context omitted.

In general, doing a qualitative summary of the projects impact is less helpful, and never as verbose as some would prefer on platform specific issues. Additionally, wireguard is now more popular than strongswan these days... https://www.cve.org/CVERecord/SearchResults?query=ipsec https://www.cve.org/CVERecord/SearchResults?query=wireguard https://www.cve.org/CVERecord/SearchResults?query=strongswan Best of luck, and…

This reads like a long-winded way of saying you aren't bothering to read what the vulnerabilities actually are.

>This reads like a long-winded way of saying you aren't bothering to read what the vulnerabilities actually are.

Almost, it is more that I don't care specifically why a IPSec option is often a liability, and would rather stick with something less silly.

Ad hominem attacks do not change the fact there are new issues in IPSec/VPN approaches found regularly. Pick any failure mode(s) on the list that applies to your specific use-case and platform.... or could find new ones if you are still bored.

Have a great day =3

https://www.youtube.com/watch?v=6vgoEhsJORU

Re: Knocker, a knock based access control system for your homelab

#164

Post by Capricorn2481 »

tptacek wrote: post #119
wolrah wrote: post #118

Earlier quoted context omitted.

They can't get in but they can still fill my logs up, so fail2ban cuts them off after a few failures. Also by collecting data on the IP addresses that are triggering fail2ban I can identify networks and/or ASes that disproportionally host malicious traffic and block them at a global level.

Why bother logging them at all? What is this doing for you? You can't meaningfully characterize attacker traffic this way. They'll come from any AS they want to.

> You can't meaningfully characterize attacker traffic this way. They'll come from any AS they want to

I'm not totally following what Fail2Ban has to do with Wireguard. Are we talking strictly about homelabs you don't expose to the internet?

Because I have a homelab I can connect to with Wireguard. That's great. But there are certain services I want to expose to everybody. So I have a VPS that can connect to my homelab via Wireguard and forward certain domain traffic to it.

That's a safe setup in that I don't expose my IP to the internet and don't have to open ports, but I could still be DDOS'd. Would it not make sense for me to use Fail2Ban (or some kind of rate limiting) even if I'm using Wireguard? I can still be DDOS'd.

Re: Knocker, a knock based access control system for your homelab

#165

Post by DaSHacka »

akerl_ wrote: post #137
dugite-code wrote: post #133

Earlier quoted context omitted.

I can't agree that it's "a tool that isn't improving your security posture", if it's a layer on top of other tools, you might argue it's effectiveness isn't great but to say it's effectively nothing is a reach.

It’s not nothing: it’s one more thing that can break or eat resources or have a vuln. And it’s not improving the thread model. It’s net negative.

How is it not improving the threat model to not have a service directly connected to the internet, but instead put behind a layer of protection?

Re: Knocker, a knock based access control system for your homelab

#166

Post by Capricorn2481 »

akerl_ wrote: post #127
Joel_Mckay wrote: post #100

Earlier quoted context omitted.

In general, bots/worms/clowns will first check if a host/router is already infected or vulnerable to a shim. Thus, tripwires on those checks or URI often auto-ban infected/hostile hosts before a scan fully escalates to a successful payload. Note, people don't want a VM delta-snapshot of their zero-day around for automated analysis. 99.98% of hostile traffic simply reuse already published testing tools, or services li…

You're just sort of loosely interweaving unrelated comments? You're back on prevention instead of detection, but also no: an attacker with valid creds isn't going to run other checks first before using them. And yes: by volume, most attacks on the internet are just spam reusing published tools and IP lists. And that traffic is zero percent risky unless your auth is already busted.

> And that traffic is zero percent risky unless your auth is already busted

Well it's a waste of our time and resources. I'm not just going to let people make 100 requests per second for no reason?

Re: Knocker, a knock based access control system for your homelab

#167

Post by DaSHacka »

tptacek wrote: post #88
mdhb wrote: post #68

Earlier quoted context omitted.

Just to be super clear.. using this in place of something like WireGuard is absolutely not an improvement. It’s actively worse in the majority of scenarios assuming you can manage to secure your keys.

Just to clarify: it's actively worse in every scenario. It's engineering malpractice.

I somehow doubt that it is quite truly worse in every single scenario, and that there is not one single scenario that port knocking may be better utilized than WireGuard.

I also find it hard to believe it is engineering malpractice to use one technology over another.

What happens if there is a vulnerability in WireGuard? Or if WireGuard traffic is not allowed in or out of a network due to a policy or security restriction?

Re: Knocker, a knock based access control system for your homelab

#168

Post by Capricorn2481 »

bakugo wrote: post #74
lucideer wrote: post #10

Earlier quoted context omitted.

If you're running a homelab, the likelihood that you're interested in removing cloud-dependencies from your stack is above average. If that's the case, Tailscale is out. Tailscale is just an added unnecessary external dependency layer (& security attack surface) on top of vanilla Wireguard. And in 2025 it's easier to run vanilla Wireguard than it's ever been.

Normally I'd agree with the philosophy, but I don't really see how you can say this about vanilla Wireguard in particular considering how involved it is, especially if you have more than 2 devices that you want to connect together. Not only do you need to manually manage the keys for each device and make sure they're present in every other device's configuration, but plain Wireguard also cannot punch through NATs and…

> but plain Wireguard also cannot punch through NATs and firewalls without any open ports like Tailscale can, as far as I know

I could be wrong, but I think Tailscale just does what you can do on Wireguard, which is `PersistentKeepAlive`. It lets a wireguard client periodically ping another to keep the NAT mapping open.

Re: Knocker, a knock based access control system for your homelab

#169

Post by hrimfaxi »

akerl_ wrote: post #145
hrimfaxi wrote: post #141

Earlier quoted context omitted.

I was thinking of: > The need to limit unsuccessful logon attempts and take subsequent action when the maximum number of attempts is exceeded applies regardless of whether the logon occurs via a local or network connection. Due to the potential for denial of service, automatic lockouts initiated by systems are usually temporary and automatically release after a predetermined, organization-defined time period. https:/…

That’s almost always going to be a setting in your IDP, not based on log capture/retention. The IDP will have some settings for max fails before lockout, and apply it by counting.

A centralized IDP that touches every service is not mandated by NIST though. So while you are right that an IDP can handle that, the organization may not have the IDP integrated with a given system and you will still need compensating controls or mitigations. Outright incredulity over logging failed access attempts is surprising.

Re: Knocker, a knock based access control system for your homelab

#170

Post by bakugo »

Capricorn2481 wrote: post #168
bakugo wrote: post #74

Earlier quoted context omitted.

Normally I'd agree with the philosophy, but I don't really see how you can say this about vanilla Wireguard in particular considering how involved it is, especially if you have more than 2 devices that you want to connect together. Not only do you need to manually manage the keys for each device and make sure they're present in every other device's configuration, but plain Wireguard also cannot punch through NATs and…

> but plain Wireguard also cannot punch through NATs and firewalls without any open ports like Tailscale can, as far as I know I could be wrong, but I think Tailscale just does what you can do on Wireguard, which is `PersistentKeepAlive`. It lets a wireguard client periodically ping another to keep the NAT mapping open.

What that does is allow existing outgoing connections through a NAT to remain open long-term, it doesn't actually help with establishing an initial connection if both sides are behind a NAT or closed firewall.

Tailscale handles this, and can establish a direct connection between two machines without either of them needing an open port listening for new connections.

There's an article on their website that explains how they do it: https://tailscale.com/blog/how-nat-traversal-works

Post reply on HN