Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is in net-next

git.kernel.org

Post reply on HN
Print view View original

61–70 of 208 posts

Re: WireGuard is in net-next

#62

Post by yjftsjthsd-h »

pferde wrote: post #15
baybal2 wrote: post #10

How it fares against IPSec?

A simple websearch yields following: https://www.wireguard.com/performance/ https://an.undulating.space/post/181227-er_alternate_firmwar... ...and more. Put some minimum effort in yourself, man!

> Put some minimum effort in yourself, man!

It's reasonable to ask the community for opinions/analysis. I'm fine with telling people to do their own research for simple facts/processes, but "how do these things compare" is potentially subjective, depends on experience, and IMO is a suboptimal fit for websearching.

Re: WireGuard is in net-next

#65

Post by moreentropy »

ikeboy wrote: post #61

Is there a simple way to tunnel specific apps only through wireguard?

WG exposes a point to point / l3 network interface like any other to userspace, so an answer would not be specific to wireguard but about networking and routing in general.

Network Namespaces and VRFs are the correct way to approach this I think: https://www.kernel.org/doc/Documentation/networking/vrf.txt

Re: WireGuard is in net-next

#66

Post by ssebastianj »

thequailman wrote: post #33
datenwolf wrote: post #32

Earlier quoted context omitted.

One would wish so! I recently had to start using PulseSecure. For authentication that damn thing loads a full blown webpage in the background, actually executes the JavaScript therein, fills some forms and submits that via POST. There's a PulseSecure module for openconnect, but it's unable to send the keepalive reauthentications, because it's unable to correctly associate the presented form inputs with the credential…

WireGuard is actually pretty awful from an IT security org perspective. There are no logs when someone connects or is trying to connect, so auditing or troubleshooting becomes extremely difficult short of packet captures. Additionally, there is no concept of two step auth, so if your key is compromised, anyone can connect without anyone knowing about the compromise. If security companies adopt WireGuard, expect thing…

> There are no logs when someone connects or is trying to connect, so auditing or troubleshooting becomes extremely difficult short of packet captures.

I'm wondering if this would be a use case for eBPF

Re: WireGuard is in net-next

#67

Post by ajphdiv »

seriesf wrote: post #55
crawshaw wrote: post #36

If you haven't given WireGuard a try yet, now is a good time. Securely and reliably connecting all my devices with WireGuard was a big reminder to me that there's a much better internet hiding under the hub-and-spoke consumer services model. The internet can be so much more than our phones connecting to large data centers.

Can you give us an illuminating example of the fulfillment you’ve gained from ... ip-over-udp tunneling? It doesn’t really sound that revelatory?

Not OP. I have a wireguard server setup on my home network. Client installed on my mobile devices. The always on UDP connection seems to use less battery than my previous setup of a TCP VPN. I use this setup to allow my mobile devices to use my home recursive DNS server, which blocks tons of domains for tracking, ads, etc.

Re: WireGuard is in net-next

#68

Post by close04 »

datenwolf wrote: post #32
Havoc wrote: post #19

Yes! Hoping this will will have a pervasive effect like https in the networking world, esp for point to points that glue things together behind the scene. Encrypt all the things!

One would wish so! I recently had to start using PulseSecure. For authentication that damn thing loads a full blown webpage in the background, actually executes the JavaScript therein, fills some forms and submits that via POST. There's a PulseSecure module for openconnect, but it's unable to send the keepalive reauthentications, because it's unable to correctly associate the presented form inputs with the credential…

> But given the inertia of big orgs, and the that public and governmental institutions for one reason or another seem to trust "BIG" names with "BIG" (i.e. bloated) products and marketing more, than small, easily auditable stuff, I don't see it happening… sadly.

This might quite literally be F5’s reasoning behind their BIG-IP Edge VPN client. :)

Re: WireGuard is in net-next

#69

Post by Agenttin »

ikeboy wrote: post #61

Is there a simple way to tunnel specific apps only through wireguard?

You can choose to only have certain IP address ranges accessible through Wireguard, it also creates a wg0 interface that you should be able to bind software to: https://superuser.com/questions/241178/how-to-use-different-...
Post reply on HN