Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is in net-next

git.kernel.org

Post reply on HN
Print view View original

121–130 of 208 posts

Re: WireGuard is in net-next

#121

Post by Avamander »

doctoboggan wrote: post #114
Avamander wrote: post #105

Earlier quoted context omitted.

> Does anyone know how this compares with OpenVPN? Much nicer to use in pretty much every aspect.

It can't be easier to setup that OpenVPN was on my router (just clicking a checkbox), but I am very interested in switching to a new VPN as I would like to be able to stay continuously connected from my mobile phone, and I understand that OpenVPN isn't great for this. What is your preferred method for getting a WireGuard server installed on your home network?

> What is your preferred method for getting a WireGuard server installed on your home network?

Have a Linux machine that listens for incoming WireGuard connections, then it only takes generating server keys (private, public) and then adding your client's keys to the WireGuard configuration file. Setting up an OpenVPN server on a Linux box is quite a bit more involved.

Re: WireGuard is in net-next

#122

Post by xur17 »

apexalpha wrote: post #85
ndarilek wrote: post #72

Earlier quoted context omitted.

Do you have an automated way for turning it off when you're on home wifi? Trying a similar setup, and it isn't immediately clear other than via manual activation how to not use Wireguard in that situation. Thanks.

On Android this can be easily achieved by Tasker. Personally I have the luxury of running the VPN server at home, so I can just always leave it on.

Why does this allow you to allows leave it on?

Re: WireGuard is in net-next

#123

Post by loeg »

samgranieri wrote: post #103
api wrote: post #48

Earlier quoted context omitted.

I can tell you that as long as the crypto in WireGuard is DJB stuff that can't be FIPS certified, Cisco and Juniper and such will still do a strong VPN business and you will rarely see it in BigCo, at least in the US. Security is largely about checking boxes to reduce liability, and FIPS is a checkbox. Corporate IT is unbelievably conservative. It's all still about Active Directory, Windows domains, and SSL VPNs with…

Humor me: What would prevent DJB's crypto from being certified by FIPS?

NIST doesn't like non-NIST ciphers.

Re: WireGuard is in net-next

#124

Post by loeg »

F00Fbug wrote: post #37

This is a big step forward! I'm hoping that the 1.0 release will prompt Netgate to consider inclusion in pfSense.

pfSense is a FreeBSD downstream, right? First you'd have to port Wireguard to FreeBSD. Or you could run the userspace server, but expect poor performance.

Re: WireGuard is in net-next

#125

Post by jlgaddis »

loxias wrote: post #56

I'm excited by this, but I'd really love a userspace C or C++ implementation. I know that context switching syscalls take time, but I've enjoyed the trend of the last 10 years towards more userspace services, not less. (I'm particularly thinking of filesystems in userspace and block devices in userspace) Still, cool. cool, cool cool. I wonder how long until it's in debian.

> I wonder how long until it's in debian.

I know you mean in stable, but it's been in unstable for 3+ years now!

Re: WireGuard is in net-next

#126

Post by blueberry_47 »

kylek wrote: post #83
ndarilek wrote: post #72

Earlier quoted context omitted.

Do you have an automated way for turning it off when you're on home wifi? Trying a similar setup, and it isn't immediately clear other than via manual activation how to not use Wireguard in that situation. Thanks.

The built-in "on-demand activation" is quite good. Can set it to specific SSIDs (white or blacklist) or cellular. I've it on for everything except my home SSID. Edit: I'm talking about the iOS version, not sure what platform you're using.

What iOS client are you using? I am using the Wireguard one (the the twisty snake/dragon) and don't see any of these options. Is this stuff that is done in the config files? Sorry, all new to me.

Re: WireGuard is in net-next

#127

Post by loeg »

bauerd wrote: post #58
sascha_sl wrote: post #57

Earlier quoted context omitted.

wireguard-go https://git.zx2c4.com/wireguard-go/about/

There is also https://github.com/cloudflare/boringtun Edit: Someone running wg in userspace and can share some experiences with either implementation?

The userspace wireguard-go implementation is slower than the kernel one. Some (I don't know how much) of that is the userspace kernel barrier, but they're also totally different implementations (Go vs C).

Re: WireGuard is in net-next

#128

Post by loeg »

zamadatix wrote: post #116
zx2c4 wrote: post #8

Release announcements are here: https://lists.zx2c4.com/pipermail/wireguard/2019-December/00... https://lists.zx2c4.com/pipermail/wireguard/2019-December/00... https://lkml.org/lkml/2019/12/8/257

Does this mean WG will no longer be considered a WIP or are there still more steps?

https://news.ycombinator.com/item?id=21742102

Re: WireGuard is in net-next

#129

Post by mendelmaleh »

Diederich wrote: post #84
samgranieri wrote: post #46

This is very welcome news! I had a seamless time using wireguard (via a streisand installation) on my honeymoon in Italy on my phone and more importantly, my wife's phone. It worked seamlessly. Next up I'd like to see this be an easy config option in Unifi's network managment tools

> I had a seamless time using wireguard (via a streisand installation) ... I've been using Wireguard via https://github.com/trailofbits/algo for a while now. Of all of the VPN experiences over the last couple of decades, Wireguard has been light-years ahead of the rest. First: it's fast . If the server is up and you don't have packet loss, you can't tell when it is turned on. For fun, I wrote some trivial automation…

Third: it doesn't wreck my battery life, like others do.

I've been using now wireguard for the past two years, really happy with it!

Re: WireGuard is in net-next

#130

Post by iudqnolq »

jedberg wrote: post #115
Diederich wrote: post #84

Earlier quoted context omitted.

> I had a seamless time using wireguard (via a streisand installation) ... I've been using Wireguard via https://github.com/trailofbits/algo for a while now. Of all of the VPN experiences over the last couple of decades, Wireguard has been light-years ahead of the rest. First: it's fast . If the server is up and you don't have packet loss, you can't tell when it is turned on. For fun, I wrote some trivial automation…

> Second: it's easy. To give you some perspective, it's so easy that my four year old knows how to turn it on when we're traveling and she wants to watch PBS Kids.

At the terminal with wg-quick, in NetworkManager, on a phone? Just wondering how impressive your kid is.
Post reply on HN