Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wireguard-docs: Setup, usage, configuration, and a full example

github.com

Post reply on HN
Print view View original

31–40 of 96 posts

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#31

Post by 3xblah »

jchook wrote: post #5

Gotta say, if you just want a VPN to work now, definitely check out Algo or Streisand. You can get a VPN running in an hour or less. Algo even supports wireguard. I currently have two VPNs — Algo Wireguard & iVPN. Anecdotally the wireguard VPN rocks— crazy fast in every way, including connection/disconnection. Sometimes YouTube is slow.. I just hop on WG and it’s fast again. I’ve achieved faster downloads via WG than…

"2. OpenVPN never borks my resolv.conf but Wireguard often leaves my DNS resolution in a state of confusion."

Checking the source... excerpt from src/tools/wg-quick/openbsd.bash:

   set_dns() {
   [[ ${#DNS[@]} -gt 0 ]] || return 0
   # TODO: this is a horrible way of doing it. Has OpenBSD no resolvconf?
   cmd cp /etc/resolv.conf    "/etc/resolv.conf.wg-quick-backup.$INTERFACE"
   cmd printf 'nameserver %s\n' "${DNS[@]}" >    /etc/resolv.conf
   }

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#34

Post by josteink »

This looks like a very comprehensive guide with lots of practical examples. Good job!

What I cannot see explicitly mentioned anywhere, is a full example of how to set up a central wireguard server which routes client traffic from the VPN subnet out to the Internet.

Is this done automatically/implicitly? If so how? I don’t see enough commands to make this happen.

Am I just stupid? What am I missing?

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#35

Post by alias_neo »

moviuro wrote: post #29

It's seriously weird that `Address=10.0.1.2/32` works at all. An Address should have a correct subnet mask (like your IP at home might be 192.168.1.25/24, not 192.168.1.25/32). The documentation is complete, but I think the most important topic is `AllowedIPs`. The rest is pretty standard and unsurprising (if you have any networking knowledge at all). I had written a bit about AllowedIPs when I switched to WG myself:…

You're aware that /32 is the correct way of specifying one, single IPv4 address using this notation?

There is nothing weird about it at all.

If you've used IPv6 you'll see the equivalent /128 for a single address.

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#36

Post by alels »

I looked a bit into Wireguard.

But it seems it's only really useful with static IPs.

Say my "Server" is behind a DDns Hostname and i want to connect to it from my Phone.

So my problem is. I allow incoming from 0.0.0.0 but on my mobile the DDns Hostname gets compiled to a specific IP.

OpenVpn has no problem with this setup. Is it solvable with Wireguard?

wg-dynamic seems to tackle this but wasn't really ready last time i checked

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#37

Post by zx2c4 »

3xblah wrote: post #31
jchook wrote: post #5

Gotta say, if you just want a VPN to work now, definitely check out Algo or Streisand. You can get a VPN running in an hour or less. Algo even supports wireguard. I currently have two VPNs — Algo Wireguard & iVPN. Anecdotally the wireguard VPN rocks— crazy fast in every way, including connection/disconnection. Sometimes YouTube is slow.. I just hop on WG and it’s fast again. I’ve achieved faster downloads via WG than…

"2. OpenVPN never borks my resolv.conf but Wireguard often leaves my DNS resolution in a state of confusion." Checking the source... excerpt from src/tools/wg-quick/openbsd.bash: set_dns() { [[ ${#DNS[@]} -gt 0 ]] || return 0 # TODO: this is a horrible way of doing it. Has OpenBSD no resolvconf? cmd cp /etc/resolv.conf "/etc/resolv.conf.wg-quick-backup.$INTERFACE" cmd printf 'nameserver %s\n' "${DNS[@]}" > /etc/resol…

We're doing something better on other platforms. But for OpenBSD I'm not entirely sure the best way. Suggestions welcome.

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#39

Post by syedamer »

alels wrote: post #36

I looked a bit into Wireguard. But it seems it's only really useful with static IPs. Say my "Server" is behind a DDns Hostname and i want to connect to it from my Phone. So my problem is. I allow incoming from 0.0.0.0 but on my mobile the DDns Hostname gets compiled to a specific IP. OpenVpn has no problem with this setup. Is it solvable with Wireguard? wg-dynamic seems to tackle this but wasn't really ready last tim…

On Android the problem is the same. The Client only resolves the IP once. When the server gets a new ip, no connections can be made, although the client seem to be still connected.

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#40

Post by mtmsr »

alels wrote: post #36

I looked a bit into Wireguard. But it seems it's only really useful with static IPs. Say my "Server" is behind a DDns Hostname and i want to connect to it from my Phone. So my problem is. I allow incoming from 0.0.0.0 but on my mobile the DDns Hostname gets compiled to a specific IP. OpenVpn has no problem with this setup. Is it solvable with Wireguard? wg-dynamic seems to tackle this but wasn't really ready last tim…

Wireguard comes with an example script [1] that does DNS updates for peers, which works well for me in a cron job. Archwiki also has an example for systemd timers [2]. But if your question is specifically about phones, then this might get a bit more complicated to set up.

[1] https://git.zx2c4.com/WireGuard/tree/contrib/examples/rereso...

[2] https://wiki.archlinux.org/index.php/WireGuard#Endpoint_with...

Post reply on HN