I've seen many questions regarding the general comparison of security for SSH tunnels versus VPNs.

I am thinking about a solution to manage my home network remotely. I'm technical enough where I can achieve the same goal (though with differing levels of effort) with either solution. My question is whether there is any inherent difference in the level of security offered simply by the port listening for either connection.

That is, I know attackers are always out there scanning ports, so does one make it more difficult to determine what is listening on the port so that an attacker has the least amount of information to craft an attack?

We can assume that the server is internal to the network and I will have to forward some port through the edge router. In either case I can use some random, non-standard port for to forward.

  • I would never place SSH servers in the Internet at large. I once messed up in some firewall rules when installing a web server on an ISP, got 100k-300k SSH probes in a single night, cant remember the exact number, 10 years ago. Nowadays it is much worse. – Rui F Ribeiro Mar 18 '20 at 13:15
  • I generally agree but does that include where you are choosing a non-standard port to forward through or just on port 22? If SSH probes are just more common are effective than VPN probes that may be a big part of the answer to my question. – LJKims Mar 18 '20 at 13:19

A number of considerations:

Yes, a SSH server exposed to the Internet is going to be subject to incessant, large-scale brute-force attacks. At the very least you need some defense like Fail2ban or CSF-LFD. This will quickly ban offending IP addresses at firewall level.

Without this protection, and even if you have a strong password, your server will have to fend off the attacks, creating unnecessary load and waste of bandwidth. Think hundreds, maybe thousands of simultaneous attacks.

You can use a non-standard port for the SSH server, you will still get probes but fewer of them.

Maybe a better solution is to set up port knocking. The trick is to make the port open only to those who know the right combination.

If your home network has a static WAN IP address, then you could restrict the SSH server to predetermined, whitelisted hosts.

Another technique if you have a static/stable IP address is to do reverse SSH: instead of connecting to the server, let the server call 'home'. Use autossh so that the connection is automatically restored between reboots or network outages.

However it seems to me that a VPN is a better alternative. OpenVPN can run in UDP, or TCP, or both. I believe UDP is the default, and UDP is more difficult to scan (see nmap manual regarding UDP scanning), and most attacks focus on TCP services.

Which does not mean UDP cannot be a danger: just think of DNS or NTP reflection attacks.

Here you are, now you can combine several techniques, for example OpenVPN with port knocking and you have a setup that is quite stealth. If you don't want the hassle of installing a VPN and prefer to stick to the already-installed SSH the same steps can be used to protect your server.

  • Your answer also alludes to SSH being attacked more. Presumably VPN uses well-known ports. Is there something about it that prevents or deters from attackers doing the same against VPN servers? – LJKims Mar 18 '20 at 14:02
  • The default ports for Openvpn (or other) can be changed too. Even if you can't or won't touch the configuration it is still possible to do port forwarding at firewall level. – Anonymous Mar 18 '20 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.