Hi all, I am behind CGNAT, but my ISP router is allocating real IPv6 addresses to my devices that can be exposed. I have a Proxmox and I have installed Wireguard on an LXC container and configured it to listen to the IPv6 address.

I was wondering if I need to do something else to protect my Wireguard installation? I have exposed only the default UDP port to the outside and port scanners are not working on UDP ports as far as I know. Shall I do something else to protect my installation or the attack vector is already minimal and doesn’t require further hardening? What’s your opinion?

  • carrylex@lemmy.worldEnglish
    1·
    6 days ago

    I did basically the same a few months ago, works really well in combination with DDNS.

    Just make sure to keep WireGuard up to date from time to time to get rid of any potential vulnerabilities :)

  • Oha@lemmy.ohaa.xyzEnglish
    1·
    29 days ago

    You are pretty much as safe as it gets as long as you update that container. Ip/Port scanning basically isnt a thing in ipv6 land as youd have to scan the entire /64 which amounts to 18,446,744,073,709,551,616 addresses.