WireGuard is in net-next • Hacker News Board

Re: WireGuard is in net-next

#161

Post by kazen44 » Mon, Dec 09, 2019, 9:01 PM UTC

mschuster91 wrote: post #107

api wrote: post #48

Earlier quoted context omitted.

I can tell you that as long as the crypto in WireGuard is DJB stuff that can't be FIPS certified, Cisco and Juniper and such will still do a strong VPN business and you will rarely see it in BigCo, at least in the US. Security is largely about checking boxes to reduce liability, and FIPS is a checkbox. Corporate IT is unbelievably conservative. It's all still about Active Directory, Windows domains, and SSL VPNs with…

Corp IT is still on AD as AD is literally the foundation of everything MS based. No matter if Exchange, workstations, file servers, even Office 365 - all is stored in Active Directory. Even their cloud services, even Microsoft Partner Program, it's all AD under the hood. Sure you can use Samba / OpenLDAP / half a dozen of IMAP/SMTP servers for groupware but holy hell administering it is an utter hellhole of a mess co…

Also, AD is probably one of microsoft's best products.

It's actually rather stable, and can integrate with nearly everything.

Re: WireGuard is in net-next

#162

Post by kazen44 » Mon, Dec 09, 2019, 9:03 PM UTC

thijsvandien wrote: post #146

yusefnapora wrote: post #86

Earlier quoted context omitted.

You could try setting up a WireGuard server that listens on udp port 53, which is typically used by DNS and unlikely to be blocked. I haven't used it, but algo recently added a configuration option to do so[1]. Of course WireGuard traffic will look much different than DNS, so they could still block it if they really care to. [1]: https://github.com/trailofbits/algo/pull/1594

I would say DNS is more likely to be blocked than other UDP ports, to force the use of a specific DNS server (not uncommon on public networks).

either that or port 53 is simply DNATted to an internal DNS server.

Which will make your wireguard VPN unreachable.

Re: WireGuard is in net-next

#163

Post by brian_herman__ » Mon, Dec 09, 2019, 9:05 PM UTC

tbrock wrote: post #90

When will we see support for this built into iOS?

Probably never because it is licenced under GPLv2. Apple has a history of removing non gpl code from their operating system.

Re: WireGuard is in net-next

#164

Post by duelingjello » Mon, Dec 09, 2019, 9:14 PM UTC

kazen44 wrote: post #161

mschuster91 wrote: post #107

Earlier quoted context omitted.

Corp IT is still on AD as AD is literally the foundation of everything MS based. No matter if Exchange, workstations, file servers, even Office 365 - all is stored in Active Directory. Even their cloud services, even Microsoft Partner Program, it's all AD under the hood. Sure you can use Samba / OpenLDAP / half a dozen of IMAP/SMTP servers for groupware but holy hell administering it is an utter hellhole of a mess co…

Also, AD is probably one of microsoft's best products. It's actually rather stable, and can integrate with nearly everything.

Fun ancient fact from AD administration c. Win2k3:

AD can optionally replicate by sending email (SMTP) between sites.

Re: WireGuard is in net-next

#165

Post by xorcist » Mon, Dec 09, 2019, 9:16 PM UTC

BrandoElFollito wrote: post #154

api wrote: post #48

Earlier quoted context omitted.

I can tell you that as long as the crypto in WireGuard is DJB stuff that can't be FIPS certified, Cisco and Juniper and such will still do a strong VPN business and you will rarely see it in BigCo, at least in the US. Security is largely about checking boxes to reduce liability, and FIPS is a checkbox. Corporate IT is unbelievably conservative. It's all still about Active Directory, Windows domains, and SSL VPNs with…

One of the reasons it is still AD is that the management of users and computers is simplified. You have several layers of admin access etc. I use Linux since 1993 and love it. All my servers are on Linux. Managing them as a group is a nightmare. I would love to have an umbrella à la AD to have all servers and users unified inside.

People regularly manage thousands of servers using Puppet or Ansible and version control. The structured text configuration files all UNIX-like software utilize makes this trivial.

The strengths of AD are more related to client software, where many of them uses the policy mechanisms therein for management. Maintaining servers isn't what it does best.

This is a large part of the reason why "the cloud" is pretty much Linux native.

Re: WireGuard is in net-next

#166

Post by xorcist » Mon, Dec 09, 2019, 9:23 PM UTC

fmajid wrote: post #28

axismundi wrote: post #21

Earlier quoted context omitted.

Much faster, as it is UDP-based, it basically just keeps spraying network packets. I noticed that my SSH sessions are resumed after closing and reopening my laptop half an hour later.

IPsec, at least using IKEv2, also uses UDP in most deployments where you are not using IPsec directly without encapsulation (not that it makes a real difference). You may be confusing with OpenVPN, which can run over TCP. In terms of speed, they are comparable. The great benefit of WireGuard is simplicity on Linux compared to the configuration nightmare that is StrongSWAN, but implementing IPsec/IKEv2 on OpenBSD usin…

> OpenVPN, which can run over TCP

Can run. OpenVPN is UDP 1194 by default.

TCP-over-TCP is a well known tricky problem, so it's not something you want to run unless you have to.

Re: WireGuard is in net-next

#167

Post by BrandoElFollito » Mon, Dec 09, 2019, 9:23 PM UTC

xorcist wrote: post #165

BrandoElFollito wrote: post #154

Earlier quoted context omitted.

One of the reasons it is still AD is that the management of users and computers is simplified. You have several layers of admin access etc. I use Linux since 1993 and love it. All my servers are on Linux. Managing them as a group is a nightmare. I would love to have an umbrella à la AD to have all servers and users unified inside.

People regularly manage thousands of servers using Puppet or Ansible and version control. The structured text configuration files all UNIX-like software utilize makes this trivial. The strengths of AD are more related to client software, where many of them uses the policy mechanisms therein for management. Maintaining servers isn't what it does best. This is a large part of the reason why "the cloud" is pretty much L…

I use ansible and salt to provision servers. It works great.

It has limited to no use to manage users and their passwords or authorizations, their control over machines, remote access to a share and zillons other usages you need specialized software for. AD has it all natively.

Re: WireGuard is in net-next

#168

Post by heavyset_go » Mon, Dec 09, 2019, 9:25 PM UTC

seriesf wrote: post #55

crawshaw wrote: post #36

If you haven't given WireGuard a try yet, now is a good time. Securely and reliably connecting all my devices with WireGuard was a big reminder to me that there's a much better internet hiding under the hub-and-spoke consumer services model. The internet can be so much more than our phones connecting to large data centers.

Can you give us an illuminating example of the fulfillment you’ve gained from ... ip-over-udp tunneling? It doesn’t really sound that revelatory?

It has a relatively seamless setup and is far from bloated, encryption is efficient on low-powered ARM devices and it works surprisingly well in environments where internet connections are shoddy at best.

Re: WireGuard is in net-next

#169

Post by AceJohnny2 » Mon, Dec 09, 2019, 9:47 PM UTC

nikisweeting wrote: post #120

If anyone wants some more docs and examples for Wireguard usage, I made some here: https://github.com/pirate/wireguard-docs - how it works internally - how the routing works in different topologies - a few complex and simple example setups - performance expectations - security model, key & config distribution - setting up wireguard for, or inside of docker - GUI tools and other wireguard-related software - links to o…

> (they do have docs, they're just hidden away in the manpages)

I feel old and obsolete.

Re: WireGuard is in net-next

#170

Post by e12e » Mon, Dec 09, 2019, 9:50 PM UTC

pedrocr wrote: post #132

I've been using tinc[1] as a way to get a mesh VPN on all my machines that works even if some of them are behind restrictive firewalls. It works really well and I've automated the setup with puppet so I just deploy it automatically any time I bring up a machine. Highly recommended. Anyone know if there has been any recent work on making wireguard cover this use case? I'm not really worried about security as I treat t…

I use zerotier[1] in a similar fashion, and I don't think there's any out of box solution to get wireguard to do "smart" routing (have two hosts on same switch talk directly, still be able to talk to server in a remote datacenter and a client roaming on cellular - with multicast and mDNS/bonjour working seamlessly).

It should be possible to set something up - but I believe you'd need some kind of managing daemon that helped nodes rendevouz and set up routes.

[1] https://www.zerotier.com