Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is in net-next

git.kernel.org

Post reply on HN
Print view View original

111–120 of 208 posts

Re: WireGuard is in net-next

#111

Post by loeg »

chadlavi wrote: post #52
samgranieri wrote: post #46

This is very welcome news! I had a seamless time using wireguard (via a streisand installation) on my honeymoon in Italy on my phone and more importantly, my wife's phone. It worked seamlessly. Next up I'd like to see this be an easy config option in Unifi's network managment tools

After switching to wireguard I've been really blown away at how much better the experience is on a phone than other VPN methods. It's always on on my phone as long as I'm not using my home wifi, and I just never need to think about it.

On iOS it's still a userspace client, as I understand it, and the additional battery drain was very noticeable for me.

Re: WireGuard is in net-next

#112

Post by tptacek »

samgranieri wrote: post #103
api wrote: post #48

Earlier quoted context omitted.

I can tell you that as long as the crypto in WireGuard is DJB stuff that can't be FIPS certified, Cisco and Juniper and such will still do a strong VPN business and you will rarely see it in BigCo, at least in the US. Security is largely about checking boxes to reduce liability, and FIPS is a checkbox. Corporate IT is unbelievably conservative. It's all still about Active Directory, Windows domains, and SSL VPNs with…

Humor me: What would prevent DJB's crypto from being certified by FIPS?

Convincing the USG to raise Chapoly to the level of AES, thus essentially defeating the purpose of standardizing AES in the first place.

The more productive approach is to work on convincing stodgy enterprises that FIPS is a bad thing (which it is).

Re: WireGuard is in net-next

#113

Post by doctoboggan »

tptacek wrote: post #109
doctoboggan wrote: post #102

I recently started using OpenVPN (My router comes with it pre-installed). Does anyone know how this compares with OpenVPN? Is is worth setting up my own wiregaurd machine?

WireGuard is much faster than OpenVPN, much simpler to set up than OpenVPN (except for having to set up IP addresses it's approximately as easy to get working as SSH), and it's much, much more secure than OpenVPN.

Thanks for the information. What is your recommended way to set up a wireguard server on a home network? Some quick googling tells me it is possible to do it with a raspberry pi, but I would be worried about that being a bottleneck.

Re: WireGuard is in net-next

#114

Post by doctoboggan »

Avamander wrote: post #105
doctoboggan wrote: post #102

I recently started using OpenVPN (My router comes with it pre-installed). Does anyone know how this compares with OpenVPN? Is is worth setting up my own wiregaurd machine?

> Does anyone know how this compares with OpenVPN? Much nicer to use in pretty much every aspect.

It can't be easier to setup that OpenVPN was on my router (just clicking a checkbox), but I am very interested in switching to a new VPN as I would like to be able to stay continuously connected from my mobile phone, and I understand that OpenVPN isn't great for this.

What is your preferred method for getting a WireGuard server installed on your home network?

Re: WireGuard is in net-next

#115

Post by jedberg »

Diederich wrote: post #84
samgranieri wrote: post #46

This is very welcome news! I had a seamless time using wireguard (via a streisand installation) on my honeymoon in Italy on my phone and more importantly, my wife's phone. It worked seamlessly. Next up I'd like to see this be an easy config option in Unifi's network managment tools

> I had a seamless time using wireguard (via a streisand installation) ... I've been using Wireguard via https://github.com/trailofbits/algo for a while now. Of all of the VPN experiences over the last couple of decades, Wireguard has been light-years ahead of the rest. First: it's fast . If the server is up and you don't have packet loss, you can't tell when it is turned on. For fun, I wrote some trivial automation…

> Second: it's easy.

To give you some perspective, it's so easy that my four year old knows how to turn it on when we're traveling and she wants to watch PBS Kids.

Re: WireGuard is in net-next

#116

Post by zamadatix »

zx2c4 wrote: post #8

Release announcements are here: https://lists.zx2c4.com/pipermail/wireguard/2019-December/00... https://lists.zx2c4.com/pipermail/wireguard/2019-December/00... https://lkml.org/lkml/2019/12/8/257

Does this mean WG will no longer be considered a WIP or are there still more steps?

Re: WireGuard is in net-next

#117

Post by themattress »

doctoboggan wrote: post #113
tptacek wrote: post #109

Earlier quoted context omitted.

WireGuard is much faster than OpenVPN, much simpler to set up than OpenVPN (except for having to set up IP addresses it's approximately as easy to get working as SSH), and it's much, much more secure than OpenVPN.

Thanks for the information. What is your recommended way to set up a wireguard server on a home network? Some quick googling tells me it is possible to do it with a raspberry pi, but I would be worried about that being a bottleneck.

Ive had a WireGuard install running for about 6 months on a pi and as far as I can tell it hasn’t been a bottleneck. Plenty of spare cpu and bandwidth. And I’m using the 3 which only has 100mbit Ethernet.

Granted I don’t generally watch a ton of streaming video and it’s mostly just me on my network, but no issues watching YouTube or doing anything else.

I really can’t state enough how much I love my wireguard/pi hole setup.

Re: WireGuard is in net-next

#118

Post by chadlavi »

kylek wrote: post #83
ndarilek wrote: post #72

Earlier quoted context omitted.

Do you have an automated way for turning it off when you're on home wifi? Trying a similar setup, and it isn't immediately clear other than via manual activation how to not use Wireguard in that situation. Thanks.

The built-in "on-demand activation" is quite good. Can set it to specific SSIDs (white or blacklist) or cellular. I've it on for everything except my home SSID. Edit: I'm talking about the iOS version, not sure what platform you're using.

Yep, this is what I do. It just doesn't connect when I'm connected to my home WiFi

Re: WireGuard is in net-next

#119

Post by chadlavi »

loeg wrote: post #111
chadlavi wrote: post #52

Earlier quoted context omitted.

After switching to wireguard I've been really blown away at how much better the experience is on a phone than other VPN methods. It's always on on my phone as long as I'm not using my home wifi, and I just never need to think about it.

On iOS it's still a userspace client, as I understand it, and the additional battery drain was very noticeable for me.

I noticed a HUGE battery drain with other VPN clients like PIA's app or just OpenTunnel, but either my 3 year old iPhone X has a great battery, or the battery drain from WireGuard has been unnoticeable for me.

Re: WireGuard is in net-next

#120

Post by nikisweeting »

If anyone wants some more docs and examples for Wireguard usage, I made some here: https://github.com/pirate/wireguard-docs

- how it works internally

- how the routing works in different topologies

- a few complex and simple example setups

- performance expectations

- security model, key & config distribution

- setting up wireguard for, or inside of docker

- GUI tools and other wireguard-related software

- links to other tutorials, references, guides

Post reply on HN