#VPN Solutions

#Hardware Acceleration

• Enterprise: crypto offload ASICs/FPGAs (Cisco VAM, Fortinet SPUs, Sophos Xstream NPU)
• Home lab: Intel AES-NI on any modern CPU provides near-hardware performance
• pfSense/OPNsense crypto: https://docs.netgate.com/pfsense/en/latest/hardware/cryptographic-accelerators.html

#WireGuard vs IPsec

WireGuard wins for home lab:

• 4,000 lines of code vs ~400,000 for IPsec
• Faster, simpler, more auditable
• ChaCha20-Poly1305, Curve25519, BLAKE2s, SipHash24, HKDF
• "Opinionated" design prevents weak cipher selection

#WireGuard Hardening

• Never reuse private keys across hosts
• Add PreSharedKey per peer (post-quantum protection layer)
• Restrict firewall to UDP 51820 only
• Store private keys with 600 permissions
• Rotate keys regularly
• WireGuard does not hide traffic characteristics

Guides:

• https://contabo.com/blog/hardening-your-wireguard-security-a-comprehensive-guide/
• https://ubuntu.com/server/docs/how-to/wireguard-vpn/security-tips/

#IPsec/IKEv2 with strongSwan

Config: /etc/ipsec.conf and /etc/ipsec.secrets

• Use ! suffix to prevent strongSwan appending defaults
• Recommended ESP: aes256gcm128-prfsha256-ecp256
• chmod 600 /etc/ipsec.secrets
• Use X.509 certificates over PSK when possible

NSA guidance: DH group 16, AES-256, SHA-384 (CNSSP 15 compliant)

Guides:

• https://docs.strongswan.org/docs/latest/config/IKEv2.html
• NIST SP 800-77 Rev. 1

#Hardware Recommendation

Intel N100 mini PC with OPNsense:

• WireGuard at 900+ Mbps
• Under $200 complete
• No separate VPN appliance needed

Benchmarks:

• https://blog.lopp.net/hunt-best-gigabit-home-network-vpn/
• https://www.ipfire.org/blog/wireguard-vpn-on-ipfire-benchmarking-the-new-mini-appliance

#fwknop (Single Packet Authorization)

Strictly superior to port knocking. Single encrypted, HMAC-authenticated, non-replayable UDP packet authorizes access.

• Service ports stay closed (default DROP) until SPA packet received
• Invisible to Nmap
• No IP address to attack
• Supports iptables, firewalld, PF, ipfw
• Clients: Linux, macOS, Windows, Android

For SSH: the single best protection tool available.

• Site: https://www.cipherdyne.org/fwknop/
• Tutorial: https://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html
• GitHub: https://github.com/mrash/fwknop