Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is now in Linus' tree

lists.zx2c4.com

Post reply on HN
Print view View original

61–70 of 293 posts

Re: WireGuard is now in Linus' tree

#61

Post by oarsinsync »

Noumenon72 wrote: post #11
kennu wrote: post #7

If you're wondering what it is: WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many…

What does it mean to be "in Linus' tree" if it's already on Linux and everywhere else? Like it will be built in somehow?

Right now, it is not part of the Linux kernel. It is just some random external software that you have you download and compile yourself against the source headers of the kernel you're currently running.

It got merged into the net-next tree, which meant it has been approved by the maintainer of the Linux kernel net branch to be included into the kernel. Linus has now pulled it from net-next into his own tree, which means it'll be included in the next release of the Linux kernel.

As far as that means as an end user, it means that you no longer need to recompile your wireguard module every time there's a kernel update, as now it will be handled by your distro.

That said, given that Wireguard is packaged nicely already for most distros, the end effect for you is really pretty little, as you're probably unaware of all of this complexity that's going on right now, as it mostly just works.

Re: WireGuard is now in Linus' tree

#62

Post by big_chungus »

RL_Quine wrote: post #14
m-p-3 wrote: post #5

Earlier quoted context omitted.

The only place where it falls shorts is that it doesn't go through as easily as SSL/IPSec on restrictive networks like corporate firewalls, but maybe that will go away when it becomes more common (and hopefully adopted in enterprises).

I've honestly not had a lot of issues with that up until now. Real world it doesn't seem to be blocked by a whole lot of things, except where you only have port 80 and 443 anyway. I've actually seen it work in a lot of places I wouldn't have expected it to, like hotel wifi.

I've seen the same, likely because the DPI boxes haven't yet caught up.

Re: WireGuard is now in Linus' tree

#63

Post by therealmarv »

Diederich wrote: post #58
jchw wrote: post #49

I’m using WireGuard daily on Linux and iPhone. It’s hard to describe how much better of an experience this is than OpenVPN. Connections are reliable and durable, latency is pretty low, and you can actually understand the software.

I've been using WireGuard on my Android phone for a good while now using a free digital ocean droplet via https://github.com/trailofbits/algo It's fast. It's easy. You never have to think about it. It just works.

Using myself a Wireguard road warrior install script:

https://github.com/l-n-s/wireguard-install

Re: WireGuard is now in Linus' tree

#64

Post by nemosaltat »

therealmarv wrote: post #56
jchw wrote: post #49

I’m using WireGuard daily on Linux and iPhone. It’s hard to describe how much better of an experience this is than OpenVPN. Connections are reliable and durable, latency is pretty low, and you can actually understand the software.

Same but Linux and Mac. I have the feeling that online live conferences/meetings are working with Wireguard very good. With OpenVPN I always had the feeling to turn the VPN off to reduce the latency overhead.

I can’t install the official WireGuard on my Macs that are stuck on Sierra. Love WireGuard for Android and iOS. I think there’s a way to do it with brew.

Re: WireGuard is now in Linus' tree

#65

Post by apearson »

jagger27 wrote: post #24

I just started looking into WireGuard and was disappointed to find out that pfSense has no support for it. I don’t like messing around with packages outside of the pfSense repo, even if it’s kinda supported in FreeBSD.

I run Wireguard on a freebsd server behind pfsense. Works well once you have a nat setup. What is stopping you from going that route?

Re: WireGuard is now in Linus' tree

#66

Post by oarsinsync »

tcas wrote: post #38
sdan wrote: post #31

WireGuard is absolutely fabulous. I route all my traffic from a couple servers at home to a small GCP instance (don’t want IP to be public) and I added my laptop to this WireGuard network (although technically a peer) and I can ssh into it remotely. I’m serving a 1,000,000+ page views a month through WireGuard and can’t say anything less about it it.

Do you set up nginx or haproxy as a reverse proxy to the wireguard network, or something else? Been wondering if there's an easy way to expose an internal service like that. TCP seems easy, but UDP seems much more problematic.

If you've followed standard / generic wireguard configuration, then 'client' peers are all able to route to each other via the server on their wireguard-local peer IPs.

Re: WireGuard is now in Linus' tree

#67

Post by TimTheTinker »

Diederich wrote: post #58
jchw wrote: post #49

I’m using WireGuard daily on Linux and iPhone. It’s hard to describe how much better of an experience this is than OpenVPN. Connections are reliable and durable, latency is pretty low, and you can actually understand the software.

I've been using WireGuard on my Android phone for a good while now using a free digital ocean droplet via https://github.com/trailofbits/algo It's fast. It's easy. You never have to think about it. It just works.

> using a free digital ocean droplet

I can't seem to find any "free" option on their pricing page. Could you elucidate?

Re: WireGuard is now in Linus' tree

#68

Post by zenhack »

ronnier wrote: post #28
3xblah wrote: post #26

Earlier quoted context omitted.

A previous thread about WG had some discussion about obtaining a publicly reachable^1 IP address. No doubt many readers are interested Can you tell us anything about how you obtained one 1. No ISP firewall blocking unsolicited incoming traffic

I think it's pretty common in the US with the various providers. You get a public IP. I didn't do anything special for that.

Yeah, I don't think I've ever encountered an ISP in the US that didn't give you a public IP. Maybe they exist?

You only get one, so you typically NAT everything, port 25 is blocked and often port 80 is as well, but that's about it.

Re: WireGuard is now in Linus' tree

#69

Post by [deleted] »

RL_Quine wrote: post #14
m-p-3 wrote: post #5

Earlier quoted context omitted.

The only place where it falls shorts is that it doesn't go through as easily as SSL/IPSec on restrictive networks like corporate firewalls, but maybe that will go away when it becomes more common (and hopefully adopted in enterprises).

I've honestly not had a lot of issues with that up until now. Real world it doesn't seem to be blocked by a whole lot of things, except where you only have port 80 and 443 anyway. I've actually seen it work in a lot of places I wouldn't have expected it to, like hotel wifi.

[deleted]

Re: WireGuard is now in Linus' tree

#70

Post by wbl »

lvh wrote: post #40
sirtoffski wrote: post #30

Earlier quoted context omitted.

WireGuard operates at layer 3. The first sentence from the white paper by Jason A.: “ WireGuard is a secure network tunnel, operating at layer 3...”. [1] Regardless of the layer, in a few words WireGuard is a simple encrypted tunnel over UDP. Since it’s UDP - there’s no guarantee all packets will be delivered, BUT - what WireGuard places emphasis on is all packets delivered from the WireGuard interface will be authen…

The tunnel does not have to encapsulate messages at the same layer as the tunnel itself. Consider this thought experiment: if you send Ethernet frames over WebSockets, what layer is the protocol? My understanding is the Wireguard messages are IP (L3) but the protocol messages itself are UDP (L4) and it seems reasonable to describe Wireguard as a session layer over UDP given how much state and connection information i…

The internet does not use OSI.
Post reply on HN