Live data from Hacker News

WireGuard is in net-next

git.kernel.org

171–180 of 208 posts

Re: WireGuard is in net-next

#171

Earlier quoted context omitted.

People regularly manage thousands of servers using Puppet or Ansible and version control. The structured text configuration files all UNIX-like software utilize makes this trivial. The strengths of AD are more related to client software, where many of them uses the policy mechanisms therein for management. Maintaining servers isn't what it does best. This is a large part of the reason why "the cloud" is pretty much L…

I use ansible and salt to provision servers. It works great. It has limited to no use to manage users and their passwords or authorizations, their control over machines, remote access to a share and zillons other usages you need specialized software for. AD has it all natively.

People with large environments that needs to be managed homogenously would beg to differ. How else would people manage these things large scale? It's exactly the kind of functionality that this software provides. Expressing rules in code might be radically different to someone used to a product like AD, but the learning curve is pretty quick and it is inherently more powerful.

Re: WireGuard is in net-next

#172

Earlier quoted context omitted.

At the terminal with wg-quick, in NetworkManager, on a phone? Just wondering how impressive your kid is.

On my Macbook there's a drop-down menu hanging off a menu bar icon. I feel like I could definitely show a little kid how to get themselves on the VPN.

[deleted]

Re: WireGuard is in net-next

#173
post #56

I'm excited by this, but I'd really love a userspace C or C++ implementation. I know that context switching syscalls take time, but I've enjoyed the trend of the last 10 years towards more userspace services, not less. (I'm particularly thinking of filesystems in userspace and block devices in userspace) Still, cool. cool, cool cool. I wonder how long until it's in debian.

> I wonder how long until it's in debian. I know you mean in stable, but it's been in unstable for 3+ years now!

I think he/she means "when will Debian ship with kernel 5.6 or greater".

Re: WireGuard is in net-next

#174
post #156

Earlier quoted context omitted.

> WireGuard is much faster than OpenVPN Not relevant for most home internet connections > much simpler to set up than OpenVPN +1 > and it's much, much more secure than OpenVPN. That’s uselessly vague. Do you mean the protocol, the implementation approach, the underlying crypto, or what?

>> WireGuard is much faster than OpenVPN > Not relevant for most home internet connections Why it is not relevant?

I'd say it is. While I'm handwaving based on what I've read - wg should be better for voice and video chat, due to being low-overhead udp - which should translate to lower latency.

Re: WireGuard is in net-next

#175

Earlier quoted context omitted.

> Second: it's easy. To give you some perspective, it's so easy that my four year old knows how to turn it on when we're traveling and she wants to watch PBS Kids.

But can your 4 year old set up Wireguard on a Debian server? Psh, didn't think so. Amateur.

Her first desktop interface will be a command line, so after she learns to spell, give her a year. :P

Re: WireGuard is in net-next

#176
post #170

I've been using tinc[1] as a way to get a mesh VPN on all my machines that works even if some of them are behind restrictive firewalls. It works really well and I've automated the setup with puppet so I just deploy it automatically any time I bring up a machine. Highly recommended. Anyone know if there has been any recent work on making wireguard cover this use case? I'm not really worried about security as I treat t…

I use zerotier[1] in a similar fashion, and I don't think there's any out of box solution to get wireguard to do "smart" routing (have two hosts on same switch talk directly, still be able to talk to server in a remote datacenter and a client roaming on cellular - with multicast and mDNS/bonjour working seamlessly). It should be possible to set something up - but I believe you'd need some kind of managing daemon that…

I use zerotier in a similar fashion. It has been great.

Re: WireGuard is in net-next

#177
post #159

What is the timeline for making wireguard viable for commerical VPNs? """ There's a few fundamental issues with wireguard that make it relatively unsuitable for commercial VPNs with many customers. For a start, if you want to offer customers multiple concurrent devices, each device needs it's own key, and all keys for all customers' devices need to be loaded into kernel memory and cross checked against every packet r…

Mullvad VPN already supports wireguard fyi

Re: WireGuard is in net-next

#178

Earlier quoted context omitted.

But can your 4 year old set up Wireguard on a Debian server? Psh, didn't think so. Amateur.

Her first desktop interface will be a command line, so after she learns to spell, give her a year. :P

my 4-year-old son learns English using sheLL :)

Re: WireGuard is in net-next

#179

This is very welcome news! I had a seamless time using wireguard (via a streisand installation) on my honeymoon in Italy on my phone and more importantly, my wife's phone. It worked seamlessly. Next up I'd like to see this be an easy config option in Unifi's network managment tools

It works great on mullvad for me, never any issues. I just installed the PPA for Ubuntu 18.04 and everything else was easy peasy. Some people say it's faster for them but I don't see that on my Gigabit connection, just a bit less CPU compared to openvpn, but neither really uses all that much, it's a fraction of a single processor on my 6 core machine.

Re: WireGuard is in net-next

#180

Earlier quoted context omitted.

Her first desktop interface will be a command line, so after she learns to spell, give her a year. :P

my 4-year-old son learns English using sheLL :)

Now I'm wondering if sheLL is a special thing or if you just held the shift key down by accident. Sadly you can't easily do a case sensitive search so I can't figure it out.

But either way, that seems like a good idea.

Post reply on HN