Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is in net-next

git.kernel.org

Post reply on HN
Print view View original

71–80 of 208 posts

Re: WireGuard is in net-next

#71

Post by Agenttin »

fmajid wrote: post #28
axismundi wrote: post #21

Earlier quoted context omitted.

Much faster, as it is UDP-based, it basically just keeps spraying network packets. I noticed that my SSH sessions are resumed after closing and reopening my laptop half an hour later.

IPsec, at least using IKEv2, also uses UDP in most deployments where you are not using IPsec directly without encapsulation (not that it makes a real difference). You may be confusing with OpenVPN, which can run over TCP. In terms of speed, they are comparable. The great benefit of WireGuard is simplicity on Linux compared to the configuration nightmare that is StrongSWAN, but implementing IPsec/IKEv2 on OpenBSD usin…

I've been really happy with the GL.inet Slate, if anyone's looking for recommendations.

Re: WireGuard is in net-next

#72

Post by ndarilek »

chadlavi wrote: post #52
samgranieri wrote: post #46

This is very welcome news! I had a seamless time using wireguard (via a streisand installation) on my honeymoon in Italy on my phone and more importantly, my wife's phone. It worked seamlessly. Next up I'd like to see this be an easy config option in Unifi's network managment tools

After switching to wireguard I've been really blown away at how much better the experience is on a phone than other VPN methods. It's always on on my phone as long as I'm not using my home wifi, and I just never need to think about it.

Do you have an automated way for turning it off when you're on home wifi? Trying a similar setup, and it isn't immediately clear other than via manual activation how to not use Wireguard in that situation.

Thanks.

Re: WireGuard is in net-next

#73

Post by shifto »

pilif wrote: post #14
baybal2 wrote: post #10

How it fares against IPSec?

way simpler (and thus, I would argue, way more secure). way faster. On the other hand: No built-in client in any of the mobile OSes, so a third-party client install is required.

I like my always-on IPsec tunnel on android. Never really understood this entire wireguard hype. Probably because VPN just got a bit easier for some people..?

Re: WireGuard is in net-next

#74

Post by gruez »

7ewis wrote: post #16

Does this mean WireGuard will be moving to stable? My VPN provider has said they won't support WireGuard until it hits 1.0

>My VPN provider has said they won't support WireGuard until it hits 1.0

AFAIK there are some major issues with wireguard that have to be resolved before it's practical for commercial VPNs.

https://old.reddit.com/r/PrivateInternetAccess/comments/d1bl...

Re: WireGuard is in net-next

#76

Post by Hikikomori »

datenwolf wrote: post #32
Havoc wrote: post #19

Yes! Hoping this will will have a pervasive effect like https in the networking world, esp for point to points that glue things together behind the scene. Encrypt all the things!

One would wish so! I recently had to start using PulseSecure. For authentication that damn thing loads a full blown webpage in the background, actually executes the JavaScript therein, fills some forms and submits that via POST. There's a PulseSecure module for openconnect, but it's unable to send the keepalive reauthentications, because it's unable to correctly associate the presented form inputs with the credential…

Currently looking at new vpn solutions where I work. Would like to use WG but it's just not suitable for a corporate environment (and neither is openvpn really, though we use it today), and it likely never will be because of how its designed (not a bad thing).

I've used it privately for a while and it is much better than anything else.

Re: WireGuard is in net-next

#78

Post by jeltz »

loxias wrote: post #56

I'm excited by this, but I'd really love a userspace C or C++ implementation. I know that context switching syscalls take time, but I've enjoyed the trend of the last 10 years towards more userspace services, not less. (I'm particularly thinking of filesystems in userspace and block devices in userspace) Still, cool. cool, cool cool. I wonder how long until it's in debian.

I use BoringTun, it is written in Rust and runs entirely in user space.

Re: WireGuard is in net-next

#79

Post by _verandaguy »

This is great news! I've been a wg user on an EdgeRouter for a little over a year now, and the experience is always just so _seamless_. The architecture of this thing's a beaut.

That news aside, this is an outstanding commit message. The kernel never disappoints on those.

Re: WireGuard is in net-next

#80

Post by GhettoMaestro »

haywirez wrote: post #77

Great experience with WireGuard so far, but does anyone know a simpler way to use it over networks where UDP is blocked (e.g. university Wi-Fi)? I've only found this comment[1]. [1] https://news.ycombinator.com/item?id=17847008

Just a word of warning: Stuffing X inside a TCP wrapper can get nasty fast... VPNe are UDP for a reason.
Post reply on HN