Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is submitted for Linux kernel inclusion

marc.info

Post reply on HN
Print view View original

101–110 of 189 posts

Re: WireGuard is submitted for Linux kernel inclusion

#101

Post by neilalexander »

cm2187 wrote: post #93
Hello71 wrote: post #89

Earlier quoted context omitted.

OpenVPN is quite configurable, not as much as IPsec, but still a lot, and (from what I hear) has quite a bit of code bloat. I believe that userspace WireGuard has better performance than OpenVPN.

My understanding (and experience) is that OpenVPN on windows is structurally capped at about 5-10 MB/s. I was curious of how that compares to WireGuard.

Performance issues with OpenVPN on Windows arise out of the inefficiencies of the TUN/TAP driver, not the OpenVPN software itself.

Re: WireGuard is submitted for Linux kernel inclusion

#102

Post by neilalexander »

auslander wrote: post #84
nopcode wrote: post #40

I had the pleasure to meet Jason at 34C3 past winter, he's incredibly capable and I really hope this goes through somehow. After using WireGuard you really don't want to go back to the horrible IPSec/OpenVPN solutions.

IPSec IKEv2 is actually pretty good

It's pretty good if you have two devices that support the same proposed ciphers and don't implement other non-standard behaviour (I'm looking at you, Juniper). It's eye-bleed otherwise.

Re: WireGuard is submitted for Linux kernel inclusion

#103

Post by exhilaration »

robotmay wrote: post #3

I've been using WireGuard on my router for the last 6 months, and it's fantastic. I get the full speed of my line through it, when OpenVPN was only giving me 20%. Because of the great plugin they have for Vyatta I'm going to be looking at using it for some stuff at work now too.

How did you install it on your router? I'm assuming this isn't a throwaway $30 consumer router?

Re: WireGuard is submitted for Linux kernel inclusion

#104

Post by exhilaration »

arctux wrote: post #53

I've been using Wireguard on both my laptop and my Android phone for about two months. I've been using the wg-quick systemd units, and everything has worked amazingly well. The only downside I've notice is slightly increased battery consumption on my phone, but that's to be expected (it uses approximately 5% of the battery per day). I use dnsmasq to resolve DNS queries on the server side. Dnsmasq's configuration file…

What's the benefit of running this on your Android phone? Are you connecting back to a home/cloud server and accessing the Internet through that?

Re: WireGuard is submitted for Linux kernel inclusion

#105

Post by zx2c4 »

eximius wrote: post #77
StavrosK wrote: post #11

I started using Wireguard two days ago to access my home LAN and love it, I can access everything with one command, as if I'm home. The only problem I have with it is the complete lack of documentation. The tutorial refers to a configuration file, but nowhere on the site does it tell you how to write one. It also took me days to set up what I think is a common use case, logging in to a server/router at home and acces…

The lack of a forum for discussion is also a problem. (Or maybe I'm just spoiled by github.) There is one feature that I want that should be trivial to add that I don't know how to voice it. There is an AllowIPs config directive, but not an ExcludeIPs directive.

There's the mailing list: https://lists.zx2c4.com/mailman/listinfo/wireguard

And there's the IRC channel: #wireguard on Freenode

And in both of these there is quite a bit of discussion.

> There is an AllowIPs config directive, but not an ExcludeIPs directive.

I think you're mostly just tripped up by the naming here. Everything is excluded by default. Add things to AllowedIPs to have packets sent to those IP get encrypted for that peer.

Re: WireGuard is submitted for Linux kernel inclusion

#106

Post by zx2c4 »

StavrosK wrote: post #11

I started using Wireguard two days ago to access my home LAN and love it, I can access everything with one command, as if I'm home. The only problem I have with it is the complete lack of documentation. The tutorial refers to a configuration file, but nowhere on the site does it tell you how to write one. It also took me days to set up what I think is a common use case, logging in to a server/router at home and acces…

> but I believe Wireguard is held back by its lack of documentation.

Indeed having good documentation is super important. I'm not so arrogant as to proclaim, "I don't have time to write docs! Understand it yourself!", but I am stretched super thin, and I suspect that often times documentation from somebody who _isn't_ the creator winds up being a bit better, because exterior perspectives are useful. So it's my hope that somebody can chip in and help out writing tutorials and docs and walkthroughs and whatnot. We really do need it.

From the sound of your message, though, I wonder if maybe you haven't found the man pages (primary documentation source):

https://git.zx2c4.com/WireGuard/about/src/tools/man/wg.8

https://git.zx2c4.com/WireGuard/about/src/tools/man/wg-quick...

Re: WireGuard is submitted for Linux kernel inclusion

#107

Post by [deleted] »

pas wrote: post #60
throwaway2048 wrote: post #59

Earlier quoted context omitted.

After that point it works exactly like any other network connection. I'm not sure what you feel needs to be documented here.

Common use cases. People will hear about WireGuard the new OpenVPN, and they'll want to "just set up a quick VPN" with it, to "hide their IP address" or whatever. Of course it's up to WG to decide if they want to deal with this kind of community education/outreach.

[deleted]

Re: WireGuard is submitted for Linux kernel inclusion

#108

Post by zx2c4 »

alias_neo wrote: post #25
StavrosK wrote: post #11

I started using Wireguard two days ago to access my home LAN and love it, I can access everything with one command, as if I'm home. The only problem I have with it is the complete lack of documentation. The tutorial refers to a configuration file, but nowhere on the site does it tell you how to write one. It also took me days to set up what I think is a common use case, logging in to a server/router at home and acces…

I agree. I've been using Wireguard for about 6 months now. The quick start is great for getting a quick overview but it doesn't really document properly how a configuration file should be made. There is no real detail about how a wg-quick config differs from a wg one, and they're not compatible; it'll complain about unknown keys/values or something if you use a wg-quick config with extra firewall rules and the like w…

> I also saw nothing anywhere about how if you modify your config file and down/up with wg-quick it'll delete anything you entered in your config as the 'down' will write back the current state of the interface.

No. Only if you've explicitly chosen to add "SaveConfig = true" to the config file, which by default is not there.

Re: WireGuard is submitted for Linux kernel inclusion

#109

Post by therealx »

zaarn wrote: post #51

I can't wait until pfSense supports it. That'll be the moment I'll set the OpenVPN config on fire, because honestly, OpenVPN configs are magic and if it's not generated by some UI wizard, it's probably broken in some scenario. And even if you do the wizard, it's probably broken. Atm I have that funny bug where my laptop drops connection after 3 seconds but my desktop does fine. With the same configuration! Thank OVPN…

OpenVPN is really not that hard to configure, and I'm pretty darn sure my config isnt broken (it's been audited at least twice.)

Re: WireGuard is submitted for Linux kernel inclusion

#110

Post by zx2c4 »

Hello71 wrote: post #83
StavrosK wrote: post #32

Earlier quoted context omitted.

> it'll complain about unknown keys/values or something if you use a wg-quick config with extra firewall rules and the like with plain wg. Really? I didn't even know that, thanks. > if you modify your config file and down/up with wg-quick it'll delete anything you entered in your config Ouch. Yeah, these things definitely need to be documented, I had no idea about this either. I would also like to see an easier way t…

> I would also like to see an easier way to configure authentications, having them in the same file as the config means I can't version control it, share it easily, etc. The config file is designed to be very straightforward and contain only the bare minimum required configuration stanzas. If you want to separate the keys, or use a higher level key negotiation protocol (e.g. TLS), you can write your own script that c…

Exactly this. WireGuard and wg(8) are meant as building blocks. For example, the wg-quick(8) tool is a simple bash script I built out of wg(8) and ip(8) that mostly works for my use cases and those of some other folks. But if you want something more complicated, then it's supposed to be easy to build that out of the building blocks presented.
Post reply on HN