In the past two weeks I set up a new VPS, and I run a small experiment. I share the results for those who are curious.
Consider that this is a backup server only, meaning that there is no outgoing traffic unless a backup is actually to be recovered, or as we will see, because of sshd.
I initially left the standard "port 22 open to the world" for 4-5 days, I then moved sshd to a different port (still open to the whole world), and finally I closed everything and turned on tailscale. You find a visualization of the resulting egress traffic in the image. Different colors are different areas of the world. Ignore the orange spikes which were my own ssh connections to set up stuff.
Main points:
-
there were about 10 Mb of egress per day due just to sshd answering to scanners. Not to mention the cluttering of access logs.
-
moving to a non standard port is reasonably sufficient to avoid traffic and log cluttering even without IP restrictions
-
Tailscale causes a bit of traffic, negligible of course, but continuous.
Do you have any tutorial that explains what you did? I'd love to try to better understand your setup
Well for PiVPN I just followed the docs to get it setup: https://docs.pivpn.io/
Then I port forwarded the port I use for Wireguard to that same port on my Pi with PiVPN on it.
For Sunshine: https://docs.lizardbyte.dev/projects/sunshine/en/latest/about/installation.html
So now when I want to remotely access my gaming PC, I use Wireguard on my phone, use the configured PiVPN setup on there which points to the domain name that I have setup with my DDNS, then I use a Wake On Lan app setup with my gaming PC's MAC address to wake it, then I just log into it with Moonlight like normal
Isn't port forwarding dangerous?
Do you use Linux if so, are you on Wayland ?
I use Linux Mint, so no Wayland, but Sunshine/Moonlight works on both X11 and Wayland, generally speaking.
I tried 2 times. It required so many steps it was exhausting, after which I ended up with a half-working install. I just gave up.