Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is in net-next

git.kernel.org

Post reply on HN
Print view View original

201–208 of 208 posts

Re: WireGuard is in net-next

#201

Post by tptacek »

wolf550e wrote: post #182
api wrote: post #110

Earlier quoted context omitted.

Bureaucratic inertia. I've been hoping for years that it'll be certified. They've talked about Curve25519 and Curve448 for a while but no movement so far. My insider sources tell me there's opposition, but I have no clue why... either the NSA prefers weaker crypto or (more likely) industry wants the status quo because they fear competition from open source superior products like WireGuard among many others.

NIST FIPS 186-5 (Draft) has Ed25519. https://csrc.nist.gov/publications/detail/fips/186/5/draft NIST SP 800-186 (Draft) has the curve definitions. But says only for Ed25519, not for X25519. They have a Weierstrass curve W-25519 that is isomorphic to Curve25519 that might allow using X25519 code, but that's way above my ability to judge. 'tptacek or 'jedisct1 or others will know. https://csrc.nist.gov/publications/det…

I will definitely not know! :)

Re: WireGuard is in net-next

#202

Post by gukov »

nikisweeting wrote: post #120

If anyone wants some more docs and examples for Wireguard usage, I made some here: https://github.com/pirate/wireguard-docs - how it works internally - how the routing works in different topologies - a few complex and simple example setups - performance expectations - security model, key & config distribution - setting up wireguard for, or inside of docker - GUI tools and other wireguard-related software - links to o…

Thanks for the repo!

PS Are you an actual pirate?

Re: WireGuard is in net-next

#203

Post by F00Fbug »

gonzo wrote: post #194
F00Fbug wrote: post #155

Earlier quoted context omitted.

Exactly. Netgate has long said that they won't touch it until it's production-ready; they keep pointing to the warning messages in WireGuard saying that it's beta and when the time is right, they'll consider it. I'm happy they're being cautious. The inclusion in the Linux kernel is perhaps (to Netgate) a sign that things are headed in the right direction. As far as FreeBSD, all that exists today is a userspace packag…

Netgate here, we’re already working on a kernel-resident version for FreeBSD (and thus, pfsense.)

You guys rock!!!

Re: WireGuard is in net-next

#204

Post by wolrah »

ldng wrote: post #138
pedrocr wrote: post #132

I've been using tinc[1] as a way to get a mesh VPN on all my machines that works even if some of them are behind restrictive firewalls. It works really well and I've automated the setup with puppet so I just deploy it automatically any time I bring up a machine. Highly recommended. Anyone know if there has been any recent work on making wireguard cover this use case? I'm not really worried about security as I treat t…

The site mention compression. I was under the impression that encryption and compression don't always play well together ?

Properly encrypted data is basically impossible to compress. Lossless compression requires repeating patterns in the data and lossy compression requires an ability to understand the content. Since properly encrypted data should be indistinguishable from random noise, neither of these things apply.

Compressing first and then encrypting the compressed data works fine though.

Re: WireGuard is in net-next

#205

Post by nikisweeting »

gukov wrote: post #202
nikisweeting wrote: post #120

If anyone wants some more docs and examples for Wireguard usage, I made some here: https://github.com/pirate/wireguard-docs - how it works internally - how the routing works in different topologies - a few complex and simple example setups - performance expectations - security model, key & config distribution - setting up wireguard for, or inside of docker - GUI tools and other wireguard-related software - links to o…

Thanks for the repo! PS Are you an actual pirate?

I am not haha, I just snagged the cool username through a dormant username transfer request.

Re: WireGuard is in net-next

#206

Post by tssva »

tptacek wrote: post #145
tssva wrote: post #54

Earlier quoted context omitted.

It may be way simpler for basic setups but it quickly becomes as or more complex than ipsec for more advanced setups such as those involving dynamic routing and/or fail over routes. The additional complexity is due to the fallout of allowed-ips and how they are used. What you essentially end up with is that a wireguard interface represents a point to multipoint non-broadcast network. Any one that has dealt with Frame…

I think this is a really strong comment. The only observation I'll make is that making the simple base case for VPNs easy is much more important than making dynamically routed VPNs straightforward. More people should be using VPN-like-tunnels as an access solution, but don't, because every VPN other than WireGuard builds in extra complexity to support use cases they don't have. What the industry desperately needed wa…

While I agree that handling the needs of the simple base VPN case easily is important I think that could have been done without complicating things for the more advance uses.

The areas where Wireguard is clever versus simple is where the complexity for advanced scenarios has crept in. If the protocol had implemented a mapping of peers to interfaces or sub-interfaces, left ip filtering purely to the system firewall and depended upon system routing capabilities it would be less complex to use in more advance scenarios and need not be more complex in simple scenarios.

In simple scenarios wg-quick could have been responsible for the needed routing and firewall changes. It already makes some routing and DNS configuration changes.

Re: WireGuard is in net-next

#207

Post by lucb1e »

loeg wrote: post #191
chadlavi wrote: post #119

Earlier quoted context omitted.

I noticed a HUGE battery drain with other VPN clients like PIA's app or just OpenTunnel, but either my 3 year old iPhone X has a great battery, or the battery drain from WireGuard has been unnoticeable for me.

1 year old iphone 8 here and Wireguard was noticeable (vs no VPN). I did not try other VPNs.

I use an iPhone SE for work with a WireGuard VPN, no noticeable drain (beyond that battery life is generally pretty bad compared to my Android, even when WiFi/data/bluetooth/gps are turned off).

Re: WireGuard is in net-next

#208

Post by kazen44 »

duelingjello wrote: post #164
kazen44 wrote: post #161

Earlier quoted context omitted.

Also, AD is probably one of microsoft's best products. It's actually rather stable, and can integrate with nearly everything.

Fun ancient fact from AD administration c. Win2k3: AD can optionally replicate by sending email (SMTP) between sites.

as far as i know this is still supported.

i know this option has existed till atleast 2008.

Post reply on HN