That post is here
Summary of that post is that OP is using mTLS on the open internet to host his services, rather than a VPN.
My creds: I am a security engineer with specialization in offensive embedded systems security research.
mTLS, or “client certificate authentication”, on a web server is equally as secure as running a VPN. In fact, OpenVPN can be configured to use mTLS just like a web server can. There was a lot of misinformation in that thread and I’d like to address it here:
1: If you use TailScale, it is only an outbound connection from your home so no ports are exposed.
This is a half-truth. With TailScale, TailScale itself exposes ports. You authenticate and connect to those ports, which then connect you back to the reverse connection from your home. Ports are exposed at TailScale. If your security requirements and threat model allow for using TailScale then it’s totally fine to use it, but the idea that TailScale doesn’t expose ports is a half-truth.
2: If you use a reverse proxy the way OP does, attackers will be able to scan your web server, identify web server vulnerabilities, and pop into your network!
No. mTLS requires the attacker to have a valid private key to authenticate to the reverse proxy. If a valid private key and certificate are not there, then the attacker cannot begin scanning the web app. The mTLS handshake happens before the attacker can probe the web service. If you don’t believe me, use WireShark and see how a TLS connection works. Even over regular TLS, you will see that the TLS connection happens first, before any HTTP traffic is transmitted. Better yet, host your own mTLS instance, scan 443 without a private key and see what data you get back.
3: If you expose a port, even if it requires a private key to connect to it, you are less secure than if you use WireGuard, which requires an authenticated packet before it responds.
No. WireGuard allows you to avoid confirming or denying that a port is open, since it’s over UDP and most systems don’t respond if you try to interact to a nonexistent service over UDP. This, on its own, does not make WireGuard more secure than say TCP OpenVPN or mTLS. It does, however, prevent people looking at your IP address from knowing if you are running some sort of authentication-required service. If this increases your risk, then you can choose to use WireGuard, instead, but this is not the case for a vast majority of people.
For more information on mTLS, see Hello mTLS by the awesome people at Smallstep. They also have a cool tutorial on using Yubikeys with mTLS here to connect back to the homelab, similar to how OP is running his homelab.
The great part about using Yubikeys for mTLS is it allows you to have a hardware-backed, two-factor authentication method at layer 6, rather than traditional MFA which is at layer 7. This allows MFA with a lower attack surface, since the attacker can’t look for any web vulnerabilities to bypass MFA.
