I always come up with the weirdest hobby projects. I’ve been thinking a lot the last week or two about what it would be like to build a high side network that allows specific wireguard connections but otherwise nothing else to the internet. Would it even be possible? - ThreadSky

About ThreadSky

0xda.de • 1 day ago

I always come up with the weirdest hobby projects. I’ve been thinking a lot the last week or two about what it would be like to build a high side network that allows specific wireguard connections but otherwise nothing else to the internet. Would it even be possible?

Comments

0xda.de•1 day ago

Like, could I reasonably build something that requires managed devices with hardware backed keys that can’t be exfiltrated, can’t be used with an unmanaged device, and could actually be safe if shipped to a recipient?

0xda.de•1 day ago

Could I confidently restrict network connections at the host level if it’s on someone else’s network and they can manipulate whatever they want at the network layer?

0xda.de•1 day ago

Then there’s the IO and data exfiltration to consider. Assuming I’ve sent someone a device that they don’t have root access to and somehow can’t get root access to (and that’s a big if), could I prevent mass exfil via USB? Prevent HID injection attacks?

0xda.de•1 day ago

Probably not, unless the device shipped was a laptop that had its own built in IO and all USB lines were hardware disabled. Plus some OS level things to try to prevent unauthorized access, just in case.

kevinriggle.bsky.social•1 day ago

Sure. Any decent firewall like pfSense can implement this. Wireguard creates a virtual NIC, and you allowlist traffic over the Wireguard NIC and block all but the VPN traffic on the public interface

0xda.de•1 day ago

Oh yeah it’s trivial for me to do purely on my devices, I’m curious about solving it for a situation where, say, I ship devices to a group that should have access to the network, and want high confidence in the security of those devices.

0xda.de•1 day ago

I think it’s one of those things where there’s only so much you can do if you’re shipping devices on the network to other people. But I’m curious in exploring all those things you can do, and seeing where the limit actually is.

Posting Rules

Be respectful to others
No spam or self-promotion
Stay on topic
Follow Bluesky's terms of service

Comments

Posting Rules

Reply