Live data from Hacker News

WireGuard is submitted for Linux kernel inclusion

marc.info

111–120 of 189 posts

Re: WireGuard is submitted for Linux kernel inclusion

#111

Why does this need to be included in the kernel directly and not just as a loadable module?

There are three related decisions in how software can be constructed in relation to linux, and it sounds like you might be confusing them a bit. They are: user space vs kernel space, base kernel vs kernel module, in tree vs out of tree.

User space vs kernel space is the biggest decision and has a huge impact on nearly every aspect of the software. Wireguard has both user space and kernel space implementations. I'll link you to the Wireguard author's explanation as to why he chose to do a kernel space implementation: https://news.ycombinator.com/item?id=11994544

Base kernel vs kernel module is usually an easy one: almost everything that CAN go in a kernel module SHOULD go in a kernel module. Since modules can be loaded only when needed, it avoids using everyone's computing resources on features that not everyone might want. Wireguard is a kernel module.

In tree vs out of tree means whether you commit your code into the main linux source tree, or whether you distribute it outside of the linux project. Linux software development practices make it pretty annoying to distribute kernel software out of tree, even if it's a module. Basically, linux doesn't maintain stable APIs or ABIs in kernel space, so if you distribute in binary form you'll need to distribute different versions for every kernel version, and if you distribute in source form, your users will need to recompile whenever they update their kernel, which is pretty often if they're keeping up with security updates. DKMS helps with the recompilation process, but it's still pretty annoying for users. This announcement is about the proposed transition of the wireguard kernel module from out of tree to in tree.

Re: WireGuard is submitted for Linux kernel inclusion

#112
post #82

Earlier quoted context omitted.

> I also saw nothing anywhere about how if you modify your config file and down/up with wg-quick it'll delete anything you entered in your config as the 'down' will write back the current state of the interface. It's not a big deal, but it messes with the usual workflow of editing the config file of a service (you don't want to down it while updating your config, which could take time). `down` only writes the state o…

> `down` only writes the state of the interface if you put SaveConfig = true in your configuration file. If so... you asked for it. Nope, it's not in my config file. I didn't even know the option existed until you mentioned it, again, nothing on the Quick Start about it. > WireGuard uses the standard Linux routing infrastructure... I meant more in terms of the Android app, not really a WG issue, but it has a check bo…

> I meant more in terms of the Android app, not really a WG issue, but it has a check box to add exclusions to the allowed ip list, by basically adding ranges inverse to what you'd input if you were saying "exclude these".

The Android app now has a little checkbox to toggle a common set complement operation ("Exclude private IPs"). If you want to do something wild and include or exclude very particular ranges, then you can compute that yourself and put it in there, since ostensibly you have a very particular networking idea in mind.

Re: WireGuard is submitted for Linux kernel inclusion

#113
post #106

I started using Wireguard two days ago to access my home LAN and love it, I can access everything with one command, as if I'm home. The only problem I have with it is the complete lack of documentation. The tutorial refers to a configuration file, but nowhere on the site does it tell you how to write one. It also took me days to set up what I think is a common use case, logging in to a server/router at home and acces…

> but I believe Wireguard is held back by its lack of documentation. Indeed having good documentation is super important. I'm not so arrogant as to proclaim, "I don't have time to write docs! Understand it yourself!", but I am stretched super thin, and I suspect that often times documentation from somebody who _isn't_ the creator winds up being a bit better, because exterior perspectives are useful. So it's my hope t…

I had, indeed, not found the man pages, thank you. I also intend to write up how to deploy Wireguard with a simple "access the home LAN from the outside" configuration in the next few days, which will hopefully be useful to people.

Re: WireGuard is submitted for Linux kernel inclusion

#114
post #3

I've been using WireGuard on my router for the last 6 months, and it's fantastic. I get the full speed of my line through it, when OpenVPN was only giving me 20%. Because of the great plugin they have for Vyatta I'm going to be looking at using it for some stuff at work now too.

How did you install it on your router? I'm assuming this isn't a throwaway $30 consumer router?

I use it on an EdgeRouter Lite 3 which is about $99. See:

https://github.com/Lochnair/vyatta-wireguard

https://community.ubnt.com/t5/EdgeRouter/Release-WireGuard-f... (discussion)

Re: WireGuard is submitted for Linux kernel inclusion

#115

Earlier quoted context omitted.

IPSec IKEv2 is actually pretty good

It's pretty good if you have two devices that support the same proposed ciphers and don't implement other non-standard behaviour (I'm looking at you, Juniper). It's eye-bleed otherwise.

Why Juniper? I would not trust proprietary stuff over Strongswan, even if it worked correctly :) And Apple IKEv2 native clients work fine too.

Re: WireGuard is submitted for Linux kernel inclusion

#116

Earlier quoted context omitted.

I actually gave up after trying for a while. They mention an "easy" way to do traditional VPN usage, but it never worked, and various blogs have differing opinions on how to properly do that. I wish there was better hands-on documentation for WG, but I guess it really is an addition to iptables and thus restricted to people versed in that area. Which I am not. I do intend to try again though.

Here you go, plug and play: https://www.pastery.net/gvfyub+hacbne/#gvfyub Use with `wg-quick up ` and you're done. I don't know why this isn't in the documentation, it strikes me as what 99% of users want, and the other 1% knows how to do whatever they need.

Adding the masquerade rules and forward rules as an example in the wg-quick(8) man page sounds like a good idea. Want to send a patch to the mailing list?

Re: WireGuard is submitted for Linux kernel inclusion

#117
post #80

Earlier quoted context omitted.

> Are the other TCP ports, as well as UDP blocked by a force of nature? :) Yes; the force in question is usually spelled out as "auditors." :(

Ah, that force. Does this force allow VPNs, or are you just reusing existing open ports for... alternative purposes? :) In case of the former, then Wireguard will likely be permitted some day as the status quo of VPNs. OpenVPN and IPSec appear as dead ends, so it's just a matter of time. If Wireguard is successfully upstreamed soon, I wouldn't be surprised if it rose to the throne of VPN monopoly sooner rather than l…

Unfortunately, it's the latter. :)

Re: WireGuard is submitted for Linux kernel inclusion

#118
post #53

I've been using Wireguard on both my laptop and my Android phone for about two months. I've been using the wg-quick systemd units, and everything has worked amazingly well. The only downside I've notice is slightly increased battery consumption on my phone, but that's to be expected (it uses approximately 5% of the battery per day). I use dnsmasq to resolve DNS queries on the server side. Dnsmasq's configuration file…

> The only downside I've notice is slightly increased battery consumption on my phone, but that's to be expected (it uses approximately 5% of the battery per day).

Note that if you run a phone that has the WireGuard kernel module (rather than the userspace implementation), battery usage winds up being basically nil in my tests.

As for the userspace fallback, we expect performance (and hence battery life) to increase on that once these are merged:

https://go-review.googlesource.com/c/crypto/+/107628 https://go-review.googlesource.com/c/crypto/+/105896

Re: WireGuard is submitted for Linux kernel inclusion

#119
post #116

Earlier quoted context omitted.

Here you go, plug and play: https://www.pastery.net/gvfyub+hacbne/#gvfyub Use with `wg-quick up ` and you're done. I don't know why this isn't in the documentation, it strikes me as what 99% of users want, and the other 1% knows how to do whatever they need.

Adding the masquerade rules and forward rules as an example in the wg-quick(8) man page sounds like a good idea. Want to send a patch to the mailing list?

Err, sure, I'll have to figure out how to do that first, though. I'm assuming I can't make a pull request somewhere?
Post reply on HN