# VPN Solutions

## Hardware Acceleration

- Enterprise: crypto offload ASICs/FPGAs (Cisco VAM, Fortinet SPUs, Sophos Xstream NPU)
- Home lab: Intel AES-NI on any modern CPU provides near-hardware performance
- pfSense/OPNsense crypto: https://docs.netgate.com/pfsense/en/latest/hardware/cryptographic-accelerators.html

## WireGuard vs IPsec

WireGuard wins for home lab:
- 4,000 lines of code vs ~400,000 for IPsec
- Faster, simpler, more auditable
- ChaCha20-Poly1305, Curve25519, BLAKE2s, SipHash24, HKDF
- "Opinionated" design prevents weak cipher selection

### WireGuard Hardening
- Never reuse private keys across hosts
- Add PreSharedKey per peer (post-quantum protection layer)
- Restrict firewall to UDP 51820 only
- Store private keys with 600 permissions
- Rotate keys regularly
- WireGuard does not hide traffic characteristics

Guides:
- https://contabo.com/blog/hardening-your-wireguard-security-a-comprehensive-guide/
- https://ubuntu.com/server/docs/how-to/wireguard-vpn/security-tips/

## IPsec/IKEv2 with strongSwan

Config: /etc/ipsec.conf and /etc/ipsec.secrets
- Use `!` suffix to prevent strongSwan appending defaults
- Recommended ESP: aes256gcm128-prfsha256-ecp256
- chmod 600 /etc/ipsec.secrets
- Use X.509 certificates over PSK when possible

NSA guidance: DH group 16, AES-256, SHA-384 (CNSSP 15 compliant)

Guides:
- https://docs.strongswan.org/docs/latest/config/IKEv2.html
- NIST SP 800-77 Rev. 1

## Hardware Recommendation

Intel N100 mini PC with OPNsense:
- WireGuard at 900+ Mbps
- Under $200 complete
- No separate VPN appliance needed

Benchmarks:
- https://blog.lopp.net/hunt-best-gigabit-home-network-vpn/
- https://www.ipfire.org/blog/wireguard-vpn-on-ipfire-benchmarking-the-new-mini-appliance

## fwknop (Single Packet Authorization)

Strictly superior to port knocking. Single encrypted, HMAC-authenticated, non-replayable UDP packet authorizes access.

- Service ports stay closed (default DROP) until SPA packet received
- Invisible to Nmap
- No IP address to attack
- Supports iptables, firewalld, PF, ipfw
- Clients: Linux, macOS, Windows, Android

For SSH: the single best protection tool available.

- Site: https://www.cipherdyne.org/fwknop/
- Tutorial: https://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html
- GitHub: https://github.com/mrash/fwknop