Comment by r0b05
2 hours ago
The large attack surface is a good point. I started using it initially and the ease of setting up a vpn was nice, but then I came across few security vulnerability postings which led to concern so I went to Wireguard. I think they should reign in the features and treat it as a secure vpn first and foremost and remove unnecessary features to minimize the attack surface.
If you architect properly it doesn’t necessarily follow that more features means more attacks, or certainly not more system wide attacks.
If you layer and segment correctly you can build atop a secure core and have some decent security.
If you want a hard-to-use VPN with minimal features and minimal surface area, as you said, Wireguard is right there. Tailscale is convenient Wireguard.
I use Wireguard for several site-to-site VPNs. It just works. I never have to worry about it, and there are very few configuration settings to mess up (unlike, say, IPsec, which is a nightmare.)
Yes, for a permanent site-to-site link. Now try configuring 300 nodes in a mesh, where nodes are coming and going every half hour.