Hi!
I often read suggestions to use something like Tailscale to create a tunnel between a home server and a VPS because it is allegedly safer than opening a port for WireGuard (WG) or Nginx on my router and connecting to my home network that way.
However, if my VPS is compromised, wouldn’t the attacker still be able to access my local network? How does using an extra layer (the VPS) make it safer?
Checking nmap’s documentation it looks like it’s perfectly possible to detect open udp ports
Yes, but only if your firewall is set to reject instead of drop. The documentation you linked mentions this; that’s why open ports are listed as
open|filtered
because any port that’s “open” might actually be being filtered (dropped).On a modern firewall, an nmap scan will show every port as
open|filtered
, regardless of whether it’s open or not.Edit: Here’s the relevant bit from the documentation:
Huh! Thank you very much for the detailed answer that’s extremely interesting!