klyubin

SSH daemons bound to WireGuard interface only can still be accessed from non-WireGuard network

1

https://github.com/simonw/til/blob/master/tailscale/lock-down-sshd.md suggests binding SSH daemon to the WireGuard interface only. This security measure can be bypassed because most modern Linux hosts use the Weak Host Model (see rp_filter settings). Packets...