Is there a way to connect from macOS to the VPN?
As mentioned in the roadmap and the cross-platform page, we're working on a cross-platform userspace client, so Mac and Windows users can use it too. It's in the works!
Thank you!
WireGuard: next generation in-kernel modern VPN
31–40 of 157 posts
Re: WireGuard: next generation in-kernel modern VPN
#32Is it possible to use TCP-only?
Re: WireGuard: next generation in-kernel modern VPN
#33A couple questions:
How do you deal with MTU? OpenVPN's handing is particularly bad [1]?
Is the whole protocol in-kernel or just the data plane?
For admins who want to provision large number of clients, do you ever plan to implement some kind of certificate hierarchy?
Re: WireGuard: next generation in-kernel modern VPN
#34Why would I want this over softether?
Re: WireGuard: next generation in-kernel modern VPN
#35A couple questions: How do you deal with MTU? OpenVPN's handing is particularly bad [1]? Is the whole protocol in-kernel or just the data plane? For admins who want to provision large number of clients, do you ever plan to implement some kind of certificate hierarchy? [1] https://community.openvpn.net/openvpn/ticket/375
> How do you deal with MTU? OpenVPN's handing is particularly bad [1]?
MTU is dealt with the same way as other kernel space tunneling devices.
> Is the whole protocol in-kernel or just the data plane?
All of it, which is why there's so much emphasis on simplicity.
> For admins who want to provision large number of clients, do you ever plan to implement some kind of certificate hierarchy?
Rather, the goal is to make the kernel interface very simple and minimal, so that admins can then glue ontop whatever situation they want. This could be certificates, or pigeons, but the important thing is that it's a layer ontop (in userspace), and not intimately bound to the core.
Re: WireGuard: next generation in-kernel modern VPN
#36Looks awesome! I can't wait to play with it when it hits 1.0. In advance of that, I'm curious: What's the tl;dr: on how this compares to Tinc? In particular, I'm wondering what WireGuard's mobile story looks like, especially in comparison with Tinc's (which is pretty rudimentary as far as I can tell), and about the extent of effort that's likely to be involved in ongoing configuration management.
Faster, more secure, and works quite well with mobile thanks to built-in roaming.
Re: WireGuard: next generation in-kernel modern VPN
#37Is it possible to use TCP-only?
WireGuard is UDP only. For TCP or SSL tunneling, look at a million other things that already do this.
Re: WireGuard: next generation in-kernel modern VPN
#38Earlier quoted context omitted.
Thanks for being here, I have a few questions. Does the server get a separate wg interface for every client that connects? Or does it do something like multipoint GRE interfaces with next hop addresses in the arp table? Does this do a DH key agreement to guarantee forward secrecy or does it literally encrypt the packet with the peers public key? Also is it in the scope of this project for peers to discover each other…
> Does the server get a separate wg interface for every client that connects? No. Each wg interface has a public/private key. It then has a list of peers' public keys and associated allowed IPs. By tying each public key to the allowed IPs of that public key, you can be sure that if a packet comes from wg0 and comes from a particular src IP, it comes from who you want. So no need for a new wg0 for each peer. > Does th…
The idea of Phase3 is that you have multiple node routers connected to a VPN hub. Think branch offices. When one node starts to talk to another node, the Hub initially facilitates the traffic, but it sends a NHRP(Next Hop Resolution Protocol) packet to the nodes telling them the public IPs of eachother, the nodes then negotiate their own VPN tunnel and start communicating directly without passing all traffic through the hub.
If I understand wireguard correctly it seems NHRP could be run using wiregard for transport, but it would cool if a separate NHRP daemon wasn't required, especially since wiregard is already tracking the mapping of internal to public IPs.
Re: WireGuard: next generation in-kernel modern VPN
#39Earlier quoted context omitted.
Don't have time for a detailed review. However, I like that you're working to replace IPsec with something simpler, easier to use, and with flexible deployment. Crypto algorithms look better than most VPN's I see as well. Good work on all that. Just remember to aid others' verification efforts later on by keeping it modular, minimal shared state, simple constructions in code, and so on. Whatever passes through a dece…
> Just remember to aid others' verification efforts later on by keeping it modular, minimal shared state, simple constructions in code, and so on. Whatever passes through a decent static analysis tool. Yes this absolutely is the goal. I'm trying to keep the codebase as small and clear as possible. > Design by Contract Working out the precise pre and post conditions of every state would indeed be worthwhile. For all s…
"Working out the precise pre and post conditions of every state would indeed be worthwhile. For all state transitions of the protocol, I've worked out by hand every possible combination and accounted it for it. I should publicize this work (i.e. type up my handwritten notes), and then let others join building on top of it."
That's actually... great. It's exactly what high-assurance security did in kernels and VPN's. I'm impressed. You should definitely write that up and share it for peer review. Also, since you've done it, the next step is to review each one to make sure security properties are maintained or it fails fast, safe, and loud. :)
Re: WireGuard: next generation in-kernel modern VPN
#40A couple questions: How do you deal with MTU? OpenVPN's handing is particularly bad [1]? Is the whole protocol in-kernel or just the data plane? For admins who want to provision large number of clients, do you ever plan to implement some kind of certificate hierarchy? [1] https://community.openvpn.net/openvpn/ticket/375
> How do you deal with MTU? OpenVPN's handing is particularly bad [1]? MTU is dealt with the same way as other kernel space tunneling devices. > Is the whole protocol in-kernel or just the data plane? All of it, which is why there's so much emphasis on simplicity. > For admins who want to provision large number of clients, do you ever plan to implement some kind of certificate hierarchy? Rather, the goal is to make t…
Are there currently methods where unknown public keys are passed to a userspace application to be verified? Or is this something that will be implemented in the future?