Infrastructure & data
Secure access without open ports
How a private network secures remote maintenance and home office without opening the firewall.
Remote maintenance and home office need no open port facing the internet. A private, encrypted network connects your devices directly, and the firewall stays shut.
The old pattern
For a long time the habit was to open a port to the outside or stand up a classic VPN gateway. Both widen the attack surface, because anything reachable from outside gets tried from outside.
What is state of the art today
WireGuard has been part of the Linux kernel since version 5.6, in early 2020, lean and easy to audit. Tools like Tailscale build on that protocol and join your devices into a private network without you opening anything at the router. Two devices talk to each other encrypted, as if they stood in the same room.
What is not reachable does not need defending.
Every device gets its own identity. Access is traceable, and a lost or retired device is removed with one entry, rather than a password change across the whole company.
What this means for you
- For one or two servers, such a network is set up in half a day.
- For a whole company it needs a plan for who may reach which systems.
- Open ports and legacy VPNs can then be switched off step by step.
Sources
- WireGuard in the Linux kernel 5.6 (Phoronix, 2020)
- WireGuard, protocol
- Tailscale documentation
- From my own project work
This is what I sort out every day.
Which applications, which provider, where the data lives. This is exactly what I work out for small and mid-sized businesses. If that is on your plate, let us talk.