Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard: Next Generation Secure Kernel Network Tunnel

fosdem.org

Post reply on HN
Print view View original

11–20 of 44 posts

Re: WireGuard: Next Generation Secure Kernel Network Tunnel

#11

Post by xorcist »

dguido wrote: post #4

If you want a reliable VPN you can use today on nearly every platform, try Algo VPN. It uses simplifies using IPSEC so that anyone who can run a few command line scripts can use it. https://github.com/trailofbits/algo It's great that someone is working on what comes next after IPSEC, but the platform support for everyone won't come any time soon. If you need a VPN today, Algo is your best answer.

Another good alternative to IPsec is OpenVPN. It's called a "TLS VPN" but really, it simplifies TLS a lot and doesn't use many of the complicated parts of the protocol. It's much more sane than I had expected, and likely easier to secure than IPsec.

I've recently started recommending it for a everyone who doesn't have IPsec hardware, something I should have done long ago (but I mistakenly thought it to be less thought out than it was). Android support is solid too.

Re: WireGuard: Next Generation Secure Kernel Network Tunnel

#12

Post by xorcist »

sargun wrote: post #7
lgierth wrote: post #5

Earlier quoted context omitted.

I'm less worried about that because it's so small. WireGuard is ~4k LOC -- thus measurably less complicated than OpenVPN (~100k LOC + OpenSSL), StrongSwan (~410k), or SoftEther (~330k). Numbers taken from slide 5 of https://www.wireguard.io/talks/codeblue2016-slides-en.pdf Moving to kernelspace brings it up to par with plain IP networking, minus a bit of overhead for the cryptographic operations. Userspace networking…

Yeah, but BPF can operate in kernel space directly on SKBs. If you look at the XDP work, there's a lot of promise. In fact I've implemented ECC in BPF -- other than the state, and negotiation components, I don't see why this can't adapt BPF.

That sounds crazy! Was it just for fun or is there a use case? What's performance like?

Re: WireGuard: Next Generation Secure Kernel Network Tunnel

#13

Post by kijiki »

nl wrote: post #9

Speaking of VPNs.... Is there a guide somewhere on how to partition applications on Linux so different apps use different VPNs? Obviously the easier way is SSH SOCKS tunnels if the app supports it, but I'd like a more general method. I believe it is possible by namespacing the apps (or I guess going all the way and containerizing them) and then setting the routing on a per-namespace basis. Is there anywhere this is w…

Namespacing would work, but it might be simpler to use multiple routing tables and "ip rule" to match each app and direct it to the right routing table. You can use iptables to match on the process and set a mark on the packet that "ip rule" will match on.

Re: WireGuard: Next Generation Secure Kernel Network Tunnel

#14

Post by nl »

kijiki wrote: post #13
nl wrote: post #9

Speaking of VPNs.... Is there a guide somewhere on how to partition applications on Linux so different apps use different VPNs? Obviously the easier way is SSH SOCKS tunnels if the app supports it, but I'd like a more general method. I believe it is possible by namespacing the apps (or I guess going all the way and containerizing them) and then setting the routing on a per-namespace basis. Is there anywhere this is w…

Namespacing would work, but it might be simpler to use multiple routing tables and "ip rule" to match each app and direct it to the right routing table. You can use iptables to match on the process and set a mark on the packet that "ip rule" will match on.

Nice..

So:

>Is there anywhere this is written down so I don't have to spent 6 hours trying to work out how to do it?

Edit, I found https://freeaqingme.tweakblogs.net/blog/9340/netflix-using-a... which seems to cover at least some. It is done on a per-user basis though.

Re: WireGuard: Next Generation Secure Kernel Network Tunnel

#16

Post by wallace_f »

nl wrote: post #9

Speaking of VPNs.... Is there a guide somewhere on how to partition applications on Linux so different apps use different VPNs? Obviously the easier way is SSH SOCKS tunnels if the app supports it, but I'd like a more general method. I believe it is possible by namespacing the apps (or I guess going all the way and containerizing them) and then setting the routing on a per-namespace basis. Is there anywhere this is w…

Out of curiosity, what's the use case for this?

Re: WireGuard: Next Generation Secure Kernel Network Tunnel

#17

Post by zx2c4 »

sargun wrote: post #7
lgierth wrote: post #5

Earlier quoted context omitted.

I'm less worried about that because it's so small. WireGuard is ~4k LOC -- thus measurably less complicated than OpenVPN (~100k LOC + OpenSSL), StrongSwan (~410k), or SoftEther (~330k). Numbers taken from slide 5 of https://www.wireguard.io/talks/codeblue2016-slides-en.pdf Moving to kernelspace brings it up to par with plain IP networking, minus a bit of overhead for the cryptographic operations. Userspace networking…

Yeah, but BPF can operate in kernel space directly on SKBs. If you look at the XDP work, there's a lot of promise. In fact I've implemented ECC in BPF -- other than the state, and negotiation components, I don't see why this can't adapt BPF.

Sidechannel free? High performance? Multi core? I'd love to see this. Sounds really interesting. What curve? Got source?

Re: WireGuard: Next Generation Secure Kernel Network Tunnel

#19

Post by nl »

wallace_f wrote: post #16
nl wrote: post #9

Speaking of VPNs.... Is there a guide somewhere on how to partition applications on Linux so different apps use different VPNs? Obviously the easier way is SSH SOCKS tunnels if the app supports it, but I'd like a more general method. I believe it is possible by namespacing the apps (or I guess going all the way and containerizing them) and then setting the routing on a per-namespace basis. Is there anywhere this is w…

Out of curiosity, what's the use case for this?

One is scraping sites that limit traffic/accounts per IP. (And yes, I understand how to be a good citizen. And no, this isn't the only use case)

Re: WireGuard: Next Generation Secure Kernel Network Tunnel

#20

Post by popey456963 »

xorcist wrote: post #11
dguido wrote: post #4

If you want a reliable VPN you can use today on nearly every platform, try Algo VPN. It uses simplifies using IPSEC so that anyone who can run a few command line scripts can use it. https://github.com/trailofbits/algo It's great that someone is working on what comes next after IPSEC, but the platform support for everyone won't come any time soon. If you need a VPN today, Algo is your best answer.

Another good alternative to IPsec is OpenVPN. It's called a "TLS VPN" but really, it simplifies TLS a lot and doesn't use many of the complicated parts of the protocol. It's much more sane than I had expected, and likely easier to secure than IPsec. I've recently started recommending it for a everyone who doesn't have IPsec hardware, something I should have done long ago (but I mistakenly thought it to be less though…

If you're looking to install OpenVPN, can I suggest you use the following bash file?

> https://github.com/Nyr/openvpn-install

It automates the process of installing & creating OpenVPN, and means so that anyone who can download a file & run a bash file will be able to make a VPN.

Post reply on HN