I stumbled upon an interesting infrastructure advice:
I had the same difficulties with the next gen VPNs:
- high battery drain
- poor integration with the rest of the OS networking (DoH, firewalls, oher VPNs, etc.)
- challenges with extended family
- security concerns: a compromised program on a device has all the access that any program on the device needs. This is the usual BeyondCorp critique.
So I went looking for something BeyondCorp-esque:
- All entrypoints are authenticated through a small set of programs: I don’t trust random programs to implement auth correctly.
- Authentication to live as close to the backend as possible: the further it is, the more exposed that backend is to the rest of my infra.
- WebAuthn for everything interactive, with SSO.
- mTLS for non-interactive (OpenSSH, NFS, HTTP monitoring)
- Identity to be provided via OIDC, since Pocket ID is very simple, and there are decent hosted OIDC, which I’m open to (esp for social login).
I’ve mostly now migrated to:
- Pomerium on each of my servers, exposing all its HTTP/TCP services via HTTPS. It had a convenient free-tier hosted control plane, but I’ve since migrated to self-hosted.
- Pocket ID for SSO based on WebAuthn.
I like this because:
- Pomerium is designed for my usecase, making it easy to setup, and hard to get wrong.
- It’s easy for family.
- I don’t have to deal with the problems and limitations that next gen VPNs have.
It’s not perfect though:
- Some Android apps don’t support WebAuthn or mTLS, forcing me to use the website instead.
- Setting it up is more complex than the next gen VPNs.
- It doesn’t address lack of IP reachability. I’m fortunate for that not to be an issue.