In the past two weeks I set up a new VPS, and I run a small experiment. I share the results for those who are curious.
Consider that this is a backup server only, meaning that there is no outgoing traffic unless a backup is actually to be recovered, or as we will see, because of sshd.
I initially left the standard "port 22 open to the world" for 4-5 days, I then moved sshd to a different port (still open to the whole world), and finally I closed everything and turned on tailscale. You find a visualization of the resulting egress traffic in the image. Different colors are different areas of the world. Ignore the orange spikes which were my own ssh connections to set up stuff.
Main points:
-
there were about 10 Mb of egress per day due just to sshd answering to scanners. Not to mention the cluttering of access logs.
-
moving to a non standard port is reasonably sufficient to avoid traffic and log cluttering even without IP restrictions
-
Tailscale causes a bit of traffic, negligible of course, but continuous.
10mb is pretty much nothing. May as well just use Fail2Ban.
But it depends on the size of the network/system and how many devices have an open port and are open to connection.
It may not make a difference on 1 server, but if you have a full network with managed switches, routers, firewalls and access points would its impact become more significant?
Not a network expert, just a technician, and I'm curious so any insight is appreciated!
Only Internet facing devices would see this kind of traffic 10mb/day/per public IP address is still nothing unless you otherwise have essentially zero traffic. Typically only firewalls would have external IPs of the devices you mentioned and they wouldn't have SSH bound to an external port
If you're going to have lots of hosts running SSH you should setup a bastion/jump host for it anyways.
Well nothing compared to rest of the infrastructure, we are talking of 0.05$ per month per machine at standard egress rates of major cloud providers. Still, why having them?
This would be per public address. Generally you'll keep those to a minimum for a properly configured cloud setup, and only have 1-5 of them for a local setup.