Sending just ssh traffic via wg

[Konstantin Ryabitsev]

On Sat, Oct 06, 2018 at 11:21:01AM +0100, Brian Candler wrote:
> My even more stupid question is "why use wireguard if the only thing it's
> carrying is ssh?" - but I guess it's a convenient way to tunnel to a network
> which doesn't have public-routed addresses.

Right -- and I also don't want to expose ssh ports to the world when not
necessary. It's still a root-perms daemon with a (remote) possibility of
unknown vulnerabilities in it.

> (Aside: I wish ssh had a feature like SNI, so that you could build an ssh
> proxy that forwards incoming connections to the right host.  I have done
> this before using an inbound SOCKS proxy, but it's messy to use)

It also has important downsides that are similar to those in ssh bastion
hosts. When you use a proper VPN, every user gets their own internal IP
address, so their traffic can be still easily distinguished from traffic
belonging to another admin. This is useful for auditing reasons and for
identifying unusual activity (e.g. Alex normally accesses hosts
belonging to project X, but suddenly starts accessing a lot of hosts
that belong to project Y). With bastion hosts or with DNAT-ing proxies
this auditing becomes impossible, since all traffic comes from the same
IP.

-K