How it fares against IPSec?
Much faster, as it is UDP-based, it basically just keeps spraying network packets. I noticed that my SSH sessions are resumed after closing and reopening my laptop half an hour later.
WireGuard is in net-next
21–30 of 208 posts
Re: WireGuard is in net-next
#22Great news. They've been hard at work for a while and it's finally come to fruition. Congrats
Well, to be fair, it was already pretty straight-forward to run WireGuard in production (if your distribution of choice has a WireGuard DKMS package). What I'm more excited about is more people building products on top of WireGuard, thus making it more accessible for the non-sysadmins out there.
This is what we (https://tailscale.com) are working on! WireGuard is incredible, but adding some key management (that integrates with your IAM system) and NAT traversal really helps to round things out. I'd love to hear suggestions and feedback on what we're building.
Re: WireGuard is in net-next
#23Earlier quoted context omitted.
I installed wireguard via ppa on my ubuntu based distro, which wasn't too much of a pain. Are you referring to the "hacks" needed in your install section on the website for e.g. Red Hat/Cent OS? very happy with the performance and stability, thanks a lot for your work!
No, I'm referring to that PPA, which includes the error-prone DKMS stuff. I'm glad it worked for you. Indeed we've put a lot of effort into ensuring that our DKMS stuff mostly _does_ work properly. Sometimes it doesn't though, and then it's a huge hassle. It's this hassle, for people less lucky than yourself with DKMS, that will go away with Linux 5.6.
I see. Thanks again, have a great day!
Re: WireGuard is in net-next
#24Great news. They've been hard at work for a while and it's finally come to fruition. Congrats
Well, to be fair, it was already pretty straight-forward to run WireGuard in production (if your distribution of choice has a WireGuard DKMS package). What I'm more excited about is more people building products on top of WireGuard, thus making it more accessible for the non-sysadmins out there.
My experience with dealing with the DKMS implementation of the Nvidia drivers left a sour taste in my mouth. Not fun when something goes sideways with an update and thousand nodes need to be recovered
Re: WireGuard is in net-next
#25Does this mean WireGuard will be moving to stable? My VPN provider has said they won't support WireGuard until it hits 1.0
Get a better VPN provider. Or better yet, run your own.
Re: WireGuard is in net-next
#26Earlier quoted context omitted.
It means that WireGuard will be included in your distro's kernel, which will ease installation. Before, you had to do some ugly kernel module compilation steps, usually using dkms, which was prone to failure and was a general nightmare to deal with. Moving forward, you'll just run "apt install wireguard-tools", and you'll be all set. To temper expectations, though, this is slated for 5.6, which won't be released for…
It works mostly without problems, but be careful relying on it as a sole means of accessing your server. I've locked myself out (luckily it was just a test server) by closing SSH port on public IP and allowing it only on Wireguard interface. One day I updated the kernel, dev headers got mixed up and my wg0 interface didn't come up after reboot.
The issue you described (DKMS wasn't able to build the module for the new version of the kernel) will go away once Wireguard is in the kernel "properly" (which is what this announcement is about)
Re: WireGuard is in net-next
#27This will mean a lot for the future of WireGuard and VPNs if it catches Ubuntu 20.04
There is almost no way that occurs. 5.6 and the compatible wireguard-tools won't be out before the 20.04 freezes.
Re: WireGuard is in net-next
#28How it fares against IPSec?
Much faster, as it is UDP-based, it basically just keeps spraying network packets. I noticed that my SSH sessions are resumed after closing and reopening my laptop half an hour later.
IPsec, at least using IKEv2, also uses UDP in most deployments where you are not using IPsec directly without encapsulation (not that it makes a real difference). You may be confusing with OpenVPN, which can run over TCP.
In terms of speed, they are comparable. The great benefit of WireGuard is simplicity on Linux compared to the configuration nightmare that is StrongSWAN, but implementing IPsec/IKEv2 on OpenBSD using OpenIKEd is roughly comparable if you use Let's Encrypt certificates.
You can get really inexpensive GL.inet GL-MT300N-V2 "mango" boxes (about $20) that will provide transparent WireGuard or OpenVPN encryption for a device that doesn't support VPNs out of the box (ahem, a Smart TV or streaming box, to bypass geo restrictions). They don't support IPsec.
Re: WireGuard is in net-next
#29Does this mean WireGuard will be moving to stable? My VPN provider has said they won't support WireGuard until it hits 1.0
Get a better VPN provider. Or better yet, run your own.
This is what I've advising people with a little bit of know-how to do. Using Algo [0] (If you only need Wireguard and little else) or Streisand [1] (If you need Wireguard in addition to many other things) makes it pretty much trivial.
Re: WireGuard is in net-next
#30what does this mean for users of wireguard? An explanation for linux noobs?
It means that WireGuard will be included in your distro's kernel, which will ease installation. Before, you had to do some ugly kernel module compilation steps, usually using dkms, which was prone to failure and was a general nightmare to deal with. Moving forward, you'll just run "apt install wireguard-tools", and you'll be all set. To temper expectations, though, this is slated for 5.6, which won't be released for…
Would it mean that changes in Wireguard will require a new version of the kernel ?
EDIT: I mean, if I am on debian and I have kernel 5.6-build123, a patch to Wireguard would mean I will need to upgrade to 5.6-build124 ?