You can lock down a wireguard vpn server pretty hard, because wireguard itself is essentially invisible unless you know it's there. It doesn't respond to anything but well formed, correctly signed (in the case of connection initiation) or encrypted (for the actual network itself) packets. So conceivably, you can have your vpn server not respond to public icmp, not expose even ssh without wireguard under it, and be essentially invisible to the internet.

If you are not replying to ICMP you let everyone know that you are there. If you we're not there, the error would be 'no route to host', but there is a route, so you must bei there

The VPS is running sshd (pubkey auth only) and Wireguard, and I also see bound UDP sockets for dhclient and ntpd. And that's it, at least for the public interface.

Also, things I want to look at on my home network mostly work fine over ssh (console stuff, git, etc). So I haven't actually gotten around to setting up full routing yet, and use the wireguard endpoint box as an ssh jumphost / bastion (and can forward ports if I do have something to get at that doesn't like to play nice).

I have a similar setup and I was also quite paranoid at first. Wireguard is a very solid solution that does precisely what it claims to do and allows you to layer extra network controls on top of it, so the vpn clients only get routed where you allow them to.

A bit less hands-on solution could be something like tailscale.

One of the benefits to Tor is you don’t need to open any ports, the Tor acts as a reverse proxy for onion services. A lot of Tor services run over port 443 because it gets passed through with little to no issue. With Wireguard you have to deal with all the networks, particularly airports and businesses, that don’t allow UDP. I’ve had a good bit of luck using the dns and ntp ports for wireguard but if your on a network that has something filtering/monitoring dns or only wants you to use their time server, those can stop you also. Once http/3 is official that should make things better for everyone using wireguard.

Plus tor hidden services -or whatever the current nomenclature is- offer a fairly robust and painless story for authentication in this "sorta VPN" scenario. Generate a couple extra keys and invite a friend and his bots.

https://community.torproject.org/onion-services/advanced/cli...

I do the client auth feature. The chances of someone stumbling across my hidden service is pretty low I think, but it’s not zero. With auth set up I don’t think a Tor client can even get the Id of the rendezvous server without having the correct key.

For me, https://tailscale.com/ gives me an easy-to-use personal network. It uses wireguard with custom configuration on top of it.