Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is in net-next

git.kernel.org

Post reply on HN
Print view View original

81–90 of 208 posts

Re: WireGuard is in net-next

#81

Post by jeltz »

gruez wrote: post #74
7ewis wrote: post #16

Does this mean WireGuard will be moving to stable? My VPN provider has said they won't support WireGuard until it hits 1.0

>My VPN provider has said they won't support WireGuard until it hits 1.0 AFAIK there are some major issues with wireguard that have to be resolved before it's practical for commercial VPNs. https://old.reddit.com/r/PrivateInternetAccess/comments/d1bl...

Yeah, there are some issues which makes it harder than it has to be but e.g. Mulllvad has been providing it to their customers for a long time. Required extra work but not insane amounts of it according to a guy at Mullvad who I was talking to.

Re: WireGuard is in net-next

#82

Post by ralala »

Agenttin wrote: post #70
ralala wrote: post #41

I'm running wireguard in production on ~50 VMs for over a year (centos). Zero problems yet.

So, it scales well with multiple peers? Are all peers aware of each other or are you using some sort of hub and spoke topology?

I created a script to distribute the configuration to all relevant VMs.

A network configuration is basically: a port, a name, a set of peers(public key, external ip, wireguard ip). If you want, you can distinguish between master and slave peers (=the slaves do not know/trust each other; master knows everyone)

Re: WireGuard is in net-next

#83

Post by kylek »

ndarilek wrote: post #72
chadlavi wrote: post #52

Earlier quoted context omitted.

After switching to wireguard I've been really blown away at how much better the experience is on a phone than other VPN methods. It's always on on my phone as long as I'm not using my home wifi, and I just never need to think about it.

Do you have an automated way for turning it off when you're on home wifi? Trying a similar setup, and it isn't immediately clear other than via manual activation how to not use Wireguard in that situation. Thanks.

The built-in "on-demand activation" is quite good. Can set it to specific SSIDs (white or blacklist) or cellular. I've it on for everything except my home SSID.

Edit: I'm talking about the iOS version, not sure what platform you're using.

Re: WireGuard is in net-next

#84

Post by Diederich »

samgranieri wrote: post #46

This is very welcome news! I had a seamless time using wireguard (via a streisand installation) on my honeymoon in Italy on my phone and more importantly, my wife's phone. It worked seamlessly. Next up I'd like to see this be an easy config option in Unifi's network managment tools

> I had a seamless time using wireguard (via a streisand installation) ...

I've been using Wireguard via https://github.com/trailofbits/algo for a while now. Of all of the VPN experiences over the last couple of decades, Wireguard has been light-years ahead of the rest.

First: it's fast. If the server is up and you don't have packet loss, you can't tell when it is turned on. For fun, I wrote some trivial automation to automatically and randomly switch between a few wireguard back ends, and I generally can't detect it.

Second: it's easy. For me, an experienced technical user. I don't know enough about the ecosystem to recommend it to less technical people, though given how basically sound it is, I'll be surprised if there aren't really easy and robust front-ends coming up.

Re: WireGuard is in net-next

#85

Post by apexalpha »

ndarilek wrote: post #72
chadlavi wrote: post #52

Earlier quoted context omitted.

After switching to wireguard I've been really blown away at how much better the experience is on a phone than other VPN methods. It's always on on my phone as long as I'm not using my home wifi, and I just never need to think about it.

Do you have an automated way for turning it off when you're on home wifi? Trying a similar setup, and it isn't immediately clear other than via manual activation how to not use Wireguard in that situation. Thanks.

On Android this can be easily achieved by Tasker.

Personally I have the luxury of running the VPN server at home, so I can just always leave it on.

Re: WireGuard is in net-next

#86

Post by yusefnapora »

haywirez wrote: post #77

Great experience with WireGuard so far, but does anyone know a simpler way to use it over networks where UDP is blocked (e.g. university Wi-Fi)? I've only found this comment[1]. [1] https://news.ycombinator.com/item?id=17847008

You could try setting up a WireGuard server that listens on udp port 53, which is typically used by DNS and unlikely to be blocked. I haven't used it, but algo recently added a configuration option to do so[1]. Of course WireGuard traffic will look much different than DNS, so they could still block it if they really care to.

[1]: https://github.com/trailofbits/algo/pull/1594

Re: WireGuard is in net-next

#87

Post by tialaramex »

cm2187 wrote: post #47
Havoc wrote: post #19

Yes! Hoping this will will have a pervasive effect like https in the networking world, esp for point to points that glue things together behind the scene. Encrypt all the things!

But outside of DNS (and agree that’s a big outside), aren’t pretty much all major protocols already encrypted these days? SMB2 was the last big one I could think to but SMB3 has (optional) encryption.

You should encrypt DNS. DPRIVE standardised DNS over HTTPS or if wrapping yet more things inside HTTP makes you want to vomit DNS over TLS directly. You can use it today.

Re: WireGuard is in net-next

#89

Post by 416chad »

kylek wrote: post #83
ndarilek wrote: post #72

Earlier quoted context omitted.

Do you have an automated way for turning it off when you're on home wifi? Trying a similar setup, and it isn't immediately clear other than via manual activation how to not use Wireguard in that situation. Thanks.

The built-in "on-demand activation" is quite good. Can set it to specific SSIDs (white or blacklist) or cellular. I've it on for everything except my home SSID. Edit: I'm talking about the iOS version, not sure what platform you're using.

No such luck on Android, you need to use tasker or similar. Really a nuisance but not a deal breaker. It would be dreamy to set up the client to not use specific SSIDs.
Post reply on HN