I'm running wireguard in production on ~50 VMs for over a year (centos). Zero problems yet.
WireGuard is in net-next
41–50 of 208 posts
Re: WireGuard is in net-next
#42How it fares against IPSec?
Faster, but more importantly, much more secure due to the simple protocol and implementation.
Re: WireGuard is in net-next
#43Yes! Hoping this will will have a pervasive effect like https in the networking world, esp for point to points that glue things together behind the scene. Encrypt all the things!
One would wish so! I recently had to start using PulseSecure. For authentication that damn thing loads a full blown webpage in the background, actually executes the JavaScript therein, fills some forms and submits that via POST. There's a PulseSecure module for openconnect, but it's unable to send the keepalive reauthentications, because it's unable to correctly associate the presented form inputs with the credential…
> I can only hope that WireGuard is going to drive a solid piece of hardwood through every "commercial grade" VPN appliance out there
I'm not sure that will happen. I mean, we had multiple solutions very close to what wg provides already. They're not as trivial to configure, but it would definitely be easier than creating a custom java applet instead.
Whatever makes enterprise VPN so bad, it doesn't seem to be the availability of better tech.
Re: WireGuard is in net-next
#44This will mean a lot for the future of WireGuard and VPNs if it catches Ubuntu 20.04
There is almost no way that occurs. 5.6 and the compatible wireguard-tools won't be out before the 20.04 freezes.
But its point updates will provide the option to update the kernel. https://wiki.ubuntu.com/Kernel/LTSEnablementStack
Re: WireGuard is in net-next
#45Re: WireGuard is in net-next
#46This is very welcome news! I had a seamless time using wireguard (via a streisand installation) on my honeymoon in Italy on my phone and more importantly, my wife's phone. It worked seamlessly.
Next up I'd like to see this be an easy config option in Unifi's network managment tools
Re: WireGuard is in net-next
#47Yes! Hoping this will will have a pervasive effect like https in the networking world, esp for point to points that glue things together behind the scene. Encrypt all the things!
But outside of DNS (and agree that’s a big outside), aren’t pretty much all major protocols already encrypted these days? SMB2 was the last big one I could think to but SMB3 has (optional) encryption.
Re: WireGuard is in net-next
#48Yes! Hoping this will will have a pervasive effect like https in the networking world, esp for point to points that glue things together behind the scene. Encrypt all the things!
One would wish so! I recently had to start using PulseSecure. For authentication that damn thing loads a full blown webpage in the background, actually executes the JavaScript therein, fills some forms and submits that via POST. There's a PulseSecure module for openconnect, but it's unable to send the keepalive reauthentications, because it's unable to correctly associate the presented form inputs with the credential…
I can tell you that as long as the crypto in WireGuard is DJB stuff that can't be FIPS certified, Cisco and Juniper and such will still do a strong VPN business and you will rarely see it in BigCo, at least in the US.
Security is largely about checking boxes to reduce liability, and FIPS is a checkbox.
Corporate IT is unbelievably conservative. It's all still about Active Directory, Windows domains, and SSL VPNs with FIPS certification and AD support.
Re: WireGuard is in net-next
#49Earlier quoted context omitted.
It means that WireGuard will be included in your distro's kernel, which will ease installation. Before, you had to do some ugly kernel module compilation steps, usually using dkms, which was prone to failure and was a general nightmare to deal with. Moving forward, you'll just run "apt install wireguard-tools", and you'll be all set. To temper expectations, though, this is slated for 5.6, which won't be released for…
Would it mean that changes in Wireguard will require a new version of the kernel ? EDIT: I mean, if I am on debian and I have kernel 5.6-build123, a patch to Wireguard would mean I will need to upgrade to 5.6-build124 ?
Debian will probably ship it as a module, like the other networking modules they ship, which means as long as they don't change ABI, after your `apt upgrade`, you can do the usual `rmmod wireguard && modprobe wireguard` to hot-load the new version at runtime without having to reboot.
Re: WireGuard is in net-next
#50Earlier quoted context omitted.
One would wish so! I recently had to start using PulseSecure. For authentication that damn thing loads a full blown webpage in the background, actually executes the JavaScript therein, fills some forms and submits that via POST. There's a PulseSecure module for openconnect, but it's unable to send the keepalive reauthentications, because it's unable to correctly associate the presented form inputs with the credential…
> I can only hope that WireGuard is going to drive a solid piece of hardwood through every "commercial grade" VPN appliance out there I'm not sure that will happen. I mean, we had multiple solutions very close to what wg provides already. They're not as trivial to configure, but it would definitely be easier than creating a custom java applet instead. Whatever makes enterprise VPN so bad, it doesn't seem to be the av…
[deleted]