In the past two weeks I set up a new VPS, and I run a small experiment. I share the results for those who are curious.

Consider that this is a backup server only, meaning that there is no outgoing traffic unless a backup is actually to be recovered, or as we will see, because of sshd.

I initially left the standard “port 22 open to the world” for 4-5 days, I then moved sshd to a different port (still open to the whole world), and finally I closed everything and turned on tailscale. You find a visualization of the resulting egress traffic in the image. Different colors are different areas of the world. Ignore the orange spikes which were my own ssh connections to set up stuff.

Main points:

  • there were about 10 Mb of egress per day due just to sshd answering to scanners. Not to mention the cluttering of access logs.

  • moving to a non standard port is reasonably sufficient to avoid traffic and log cluttering even without IP restrictions

  • Tailscale causes a bit of traffic, negligible of course, but continuous.

    • entropicdrift@lemmy.sdf.orgEnglish
      7·
      11 months ago

      Right? PiVPN is easy AF and uses WireGuard. No reason not to set up something yourself if you’re already selfhosting.

      • glasgitarrewelt@feddit.deEnglish
        10·
        11 months ago

        Please ELI5: How does this solution work? You tunnel yourself in your home network with a VPN on your PI? How is that safer, isn’t there still a port open?

        • entropicdrift@lemmy.sdf.orgEnglish
          7·
          11 months ago

          I have a port open, yes, but it’s not port 22. The problem with Tailscale is you’re trusting a third party. With my setup, it’s just me connecting directly to my Pi. Thanks to port forwarding the only open port pointing to my Pi is the one that I use for WireGuard.

          I already have a DDNS and domain name pointing to my house, so there’s effectively no added risk compared to my existing setup with a couple webapps being reverse proxied behind Caddy on a different device.

            • hatedbad@lemmy.sdf.orgEnglish
              1·
              11 months ago

              no, and that’s be a pretty bad idea, you’re opening up all your internal hosts to the public internet.

              a VPN is specifically designed to keep all your internal hosts off the public internet. When you authenticate with the VPN server the remote device you are using effectively “joins” the internal network, using the VPN to act like a tunnel between you and your network.

              it has the benefits of better security as well as the fact that once you set it up, you can access any services you host, not just HTTP ones.