Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is in net-next

git.kernel.org

Post reply on HN
Print view View original

101–110 of 208 posts

Re: WireGuard is in net-next

#101

Post by kryogen1c »

ndarilek wrote: post #72
chadlavi wrote: post #52

Earlier quoted context omitted.

After switching to wireguard I've been really blown away at how much better the experience is on a phone than other VPN methods. It's always on on my phone as long as I'm not using my home wifi, and I just never need to think about it.

Do you have an automated way for turning it off when you're on home wifi? Trying a similar setup, and it isn't immediately clear other than via manual activation how to not use Wireguard in that situation. Thanks.

I havent used it so i cant vouch for it personally, but IFTTT has been recommended to me highly.

Re: WireGuard is in net-next

#103

Post by samgranieri »

api wrote: post #48
datenwolf wrote: post #32

Earlier quoted context omitted.

One would wish so! I recently had to start using PulseSecure. For authentication that damn thing loads a full blown webpage in the background, actually executes the JavaScript therein, fills some forms and submits that via POST. There's a PulseSecure module for openconnect, but it's unable to send the keepalive reauthentications, because it's unable to correctly associate the presented form inputs with the credential…

I can tell you that as long as the crypto in WireGuard is DJB stuff that can't be FIPS certified, Cisco and Juniper and such will still do a strong VPN business and you will rarely see it in BigCo, at least in the US. Security is largely about checking boxes to reduce liability, and FIPS is a checkbox. Corporate IT is unbelievably conservative. It's all still about Active Directory, Windows domains, and SSL VPNs with…

Humor me: What would prevent DJB's crypto from being certified by FIPS?

Re: WireGuard is in net-next

#104

Post by alim3 »

GhettoMaestro wrote: post #80
haywirez wrote: post #77

Great experience with WireGuard so far, but does anyone know a simpler way to use it over networks where UDP is blocked (e.g. university Wi-Fi)? I've only found this comment[1]. [1] https://news.ycombinator.com/item?id=17847008

Just a word of warning: Stuffing X inside a TCP wrapper can get nasty fast... VPNe are UDP for a reason.

Udp2raw and similar software could be used to bypass UDP restrictions. Basically it creates valid tcp headers and sends those packets with them through raw socket.

Re: WireGuard is in net-next

#105

Post by Avamander »

doctoboggan wrote: post #102

I recently started using OpenVPN (My router comes with it pre-installed). Does anyone know how this compares with OpenVPN? Is is worth setting up my own wiregaurd machine?

> Does anyone know how this compares with OpenVPN?

Much nicer to use in pretty much every aspect.

Re: WireGuard is in net-next

#106

Post by zx2c4 »

MertsA wrote: post #97
zx2c4 wrote: post #8

Release announcements are here: https://lists.zx2c4.com/pipermail/wireguard/2019-December/00... https://lists.zx2c4.com/pipermail/wireguard/2019-December/00... https://lkml.org/lkml/2019/12/8/257

Congrats, hopefully you'll be able to port it back to Zinc sometime over 2020.

We merged "Frankenzinc" for 5.5, some sort of contorted compromise solution. I'll be working on fixing lingering warts during the 5.5 and 5.6 cycles there.

Re: WireGuard is in net-next

#107

Post by mschuster91 »

api wrote: post #48
datenwolf wrote: post #32

Earlier quoted context omitted.

One would wish so! I recently had to start using PulseSecure. For authentication that damn thing loads a full blown webpage in the background, actually executes the JavaScript therein, fills some forms and submits that via POST. There's a PulseSecure module for openconnect, but it's unable to send the keepalive reauthentications, because it's unable to correctly associate the presented form inputs with the credential…

I can tell you that as long as the crypto in WireGuard is DJB stuff that can't be FIPS certified, Cisco and Juniper and such will still do a strong VPN business and you will rarely see it in BigCo, at least in the US. Security is largely about checking boxes to reduce liability, and FIPS is a checkbox. Corporate IT is unbelievably conservative. It's all still about Active Directory, Windows domains, and SSL VPNs with…

Corp IT is still on AD as AD is literally the foundation of everything MS based. No matter if Exchange, workstations, file servers, even Office 365 - all is stored in Active Directory. Even their cloud services, even Microsoft Partner Program, it's all AD under the hood.

Sure you can use Samba / OpenLDAP / half a dozen of IMAP/SMTP servers for groupware but holy hell administering it is an utter hellhole of a mess compared to the MS offerings.

Corp IT cares about two things: retraining costs for employees and admins, and efficiency. And Apache Directory Studio just doesn't cut it compared with AD Editor.

Re: WireGuard is in net-next

#108

Post by loeg »

zx2c4 wrote: post #106
MertsA wrote: post #97

Earlier quoted context omitted.

Congrats, hopefully you'll be able to port it back to Zinc sometime over 2020.

We merged "Frankenzinc" for 5.5, some sort of contorted compromise solution. I'll be working on fixing lingering warts during the 5.5 and 5.6 cycles there.

Is there a way I can learn more about the compromises made in Frankenzinc / etc without reading LKML? I realize it might not be interesting to document if you hope to clean it up shortly, but I would be curious if you've already got something prepared.

Congrats on getting in for 5.6 and thank you very much for your years of work on this project. It is extremely impressive.

Re: WireGuard is in net-next

#109

Post by tptacek »

doctoboggan wrote: post #102

I recently started using OpenVPN (My router comes with it pre-installed). Does anyone know how this compares with OpenVPN? Is is worth setting up my own wiregaurd machine?

WireGuard is much faster than OpenVPN, much simpler to set up than OpenVPN (except for having to set up IP addresses it's approximately as easy to get working as SSH), and it's much, much more secure than OpenVPN.

Re: WireGuard is in net-next

#110

Post by api »

samgranieri wrote: post #103
api wrote: post #48

Earlier quoted context omitted.

I can tell you that as long as the crypto in WireGuard is DJB stuff that can't be FIPS certified, Cisco and Juniper and such will still do a strong VPN business and you will rarely see it in BigCo, at least in the US. Security is largely about checking boxes to reduce liability, and FIPS is a checkbox. Corporate IT is unbelievably conservative. It's all still about Active Directory, Windows domains, and SSL VPNs with…

Humor me: What would prevent DJB's crypto from being certified by FIPS?

Bureaucratic inertia. I've been hoping for years that it'll be certified. They've talked about Curve25519 and Curve448 for a while but no movement so far. My insider sources tell me there's opposition, but I have no clue why... either the NSA prefers weaker crypto or (more likely) industry wants the status quo because they fear competition from open source superior products like WireGuard among many others.
Post reply on HN