Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is submitted for Linux kernel inclusion

marc.info

Post reply on HN
Print view View original

171–180 of 189 posts

Re: WireGuard is submitted for Linux kernel inclusion

#171

Post by auslander »

tptacek wrote: post #162
auslander wrote: post #115

Earlier quoted context omitted.

Why Juniper? I would not trust proprietary stuff over Strongswan, even if it worked correctly :) And Apple IKEv2 native clients work fine too.

strongSwan is literally 2 orders of magnitude more code than WireGuard, and for all that you get 1990s cryptography. Why would you trust it at all?

Trust must be earned. In crypto it is mostly by time, since it takes quite a few research papers to arrive at scientific consensus.

Codebase size is good argument, but consider how many optional components are in Strongswan, tens of RFCs supported. You can build it smaller omitting it in make.

And what is the size of OpenBSD iked?

Re: WireGuard is submitted for Linux kernel inclusion

#172

Post by ubercow13 »

zzzcpan wrote: post #73
swsieber wrote: post #69

So, since lots of people here have experience with VPN, I'd like to ask theoretical project question: I have distant family memebers, and it'd be nice to have a simple way to get devices on the same network easily. My initial thought would be to setup a VPN server somewhere central and fast, and then distribute wireless routers with custom firmware that they could plugin to their network. Then anything they connect t…

Unless you are ok living with pwned routers, printers, you don't want devices with javascript-enabled web browsers and other random 3rd party software, like apps, to have access to anything on local network or at least not when they have access to the internet.

Wait what? Are you saying for example at home you would not allow your PC access to anything else on your LAN?

Re: WireGuard is submitted for Linux kernel inclusion

#173

Post by robotmay »

exhilaration wrote: post #103
robotmay wrote: post #3

I've been using WireGuard on my router for the last 6 months, and it's fantastic. I get the full speed of my line through it, when OpenVPN was only giving me 20%. Because of the great plugin they have for Vyatta I'm going to be looking at using it for some stuff at work now too.

How did you install it on your router? I'm assuming this isn't a throwaway $30 consumer router?

I'm running an EdgeRouter X myself, which is actually not too far off your price at ~£50. Fantastic little router, great for home use.

Re: WireGuard is submitted for Linux kernel inclusion

#174

Post by robotmay »

Improvotter wrote: post #81
robotmay wrote: post #3

I've been using WireGuard on my router for the last 6 months, and it's fantastic. I get the full speed of my line through it, when OpenVPN was only giving me 20%. Because of the great plugin they have for Vyatta I'm going to be looking at using it for some stuff at work now too.

Only 20%? How did you test this? I'm currently using OpenVPN but am looking at Wireguard.

By running speed tests through both tunnels. I was getting ~7Mbps over OpenVPN and get ~35Mbps over WireGuard to the same server :)

I believe the speed difference is primarily related to the processing power of my router. WireGuard is seemingly much quicker because it's less intensive on the router.

Re: WireGuard is submitted for Linux kernel inclusion

#175

Post by apexalpha »

craftyguy wrote: post #158
zx2c4 wrote: post #118

Earlier quoted context omitted.

> The only downside I've notice is slightly increased battery consumption on my phone, but that's to be expected (it uses approximately 5% of the battery per day). Note that if you run a phone that has the WireGuard kernel module (rather than the userspace implementation), battery usage winds up being basically nil in my tests. As for the userspace fallback, we expect performance (and hence battery life) to increase…

>Note that if you run a phone that has the WireGuard kernel module I wonder if LineageOS plans to include this module..

Would adding such a module break SafetyNet? Can you even add modules to the Android ROM / Kernel and then relocking bootloader and disabling root access?

Re: WireGuard is submitted for Linux kernel inclusion

#176

Post by tptacek »

auslander wrote: post #171
tptacek wrote: post #162

Earlier quoted context omitted.

strongSwan is literally 2 orders of magnitude more code than WireGuard, and for all that you get 1990s cryptography. Why would you trust it at all?

Trust must be earned. In crypto it is mostly by time, since it takes quite a few research papers to arrive at scientific consensus. Codebase size is good argument, but consider how many optional components are in Strongswan, tens of RFCs supported. You can build it smaller omitting it in make. And what is the size of OpenBSD iked?

Try again. strongSwan hasn't earned trust. It's had something like 30 vulnerabilities over the last 10 years, including 6 code execution vulnerabilities. And strongSwan is considered one of the better IPSEC implementations! What do I care whether it bought support for "tens of RFCs" with those vulnerabilities? I don't want "tens of RFCs". I want a working VPN and no vulnerabilities.

Bugs scale with C codebase size, full stop.

Re: WireGuard is submitted for Linux kernel inclusion

#177

Post by craftyguy »

apexalpha wrote: post #175
craftyguy wrote: post #158

Earlier quoted context omitted.

>Note that if you run a phone that has the WireGuard kernel module I wonder if LineageOS plans to include this module..

Would adding such a module break SafetyNet? Can you even add modules to the Android ROM / Kernel and then relocking bootloader and disabling root access?

Not everyone cares about 'safetynet', and LineageOS does not support secureboot-style locked bootloader booting.

You can literally build the ROM with any kernel modules you want, provided the module has been backported to the almost-guaranteed ancient kernel your device needs for initializing/using its hardware.

Re: WireGuard is submitted for Linux kernel inclusion

#180

Post by yaleman »

weavie wrote: post #43
ZoomZoomZoom wrote: post #29

Earlier quoted context omitted.

The problem is that a regular user [some of them] can follow documentation, set up a server and a client, use wg to connect them and may be even ping the connection. That's it, congratulations. How is this connection can be used? Which IPs should be used to establish a useful connection? How can a user see their LAN resources through it? How can a user route his web browsing through this connection (here we at least…

That's the thing with a vpn - it is just a single component of a fully setup network. The vpn documentation generally just covers how to setup the vpn connection. The routing and rest of the network setup, as per the questions you are asking, generally falls out of its domain and into general networks.. which is quite a huge area!

That's an OK point, but when half the comments on this thread are "I had to mess around for days to work out the config" then surely some common use cases can be covered by general FAQ's, like every other VPN/networking technology provides?
Post reply on HN