Hi!
I often read suggestions to use something like Tailscale to create a tunnel between a home server and a VPS because it is allegedly safer than opening a port for WireGuard (WG) or Nginx on my router and connecting to my home network that way.
However, if my VPS is compromised, wouldn’t the attacker still be able to access my local network? How does using an extra layer (the VPS) make it safer?
It’s very hard to compromise a VPN, they’re designed specifically to prevent that.
A random service being exposed to the entire Internet may not be secure, and could provide a way in to your network for someone.
VPN also have their attack surface: https://www.paloaltonetworks.com/cyberpedia/ivanti-VPN-vulnerability-what-you-need-to-know
Both can be true, a hardened service with strict segmentation and authorization can be harder to compromise than a loosely maintained VPN appliance.
Even when designing secure software, appliances and protocols, they can have their flaws.
I would say there is no definite answer for the question, it’s still on a case-by-case basis.
True, but at least you only have 1 VPN exposed that you need to secure and keep up to date, vs a bunch of random services that may or may not be built well for security.