Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is now in Linus' tree

lists.zx2c4.com

Post reply on HN
Print view View original

71–80 of 293 posts

Re: WireGuard is now in Linus' tree

#71

Post by CrazyStat »

RL_Quine wrote: post #43
braindeath wrote: post #25

Earlier quoted context omitted.

In the US for home connections (cable, fiber, DSL) everybody gets an accessible IP address pretty much -- the worst is that some ports are blocked like port 80 or 25. Phones don't get a dedicated IPv4.

For most people it's dynamic. Mine is dynamic with the PPPoE fibre session.

Dynamic in theory, but for many people the IP is unchanged for a long time. I remember reading an article that said the average length of time between dynamic IP changes tracked by some company was something like seven months, though I can't find it now.

I have cable with a theoretically dynamic DNS but it's changed once in >4 years.

Re: WireGuard is now in Linus' tree

#72

Post by therealmarv »

m-p-3 wrote: post #5
0xADEADBEE wrote: post #2

Glad to see it finally officially accepted. I've been using it on all my devices for over a year now and it's been rock solid. The ease of setup and initial connection speed alone blow any of the alternatives (that I'm aware of, at least) out of the water. Long may it continue!

The only place where it falls shorts is that it doesn't go through as easily as SSL/IPSec on restrictive networks like corporate firewalls, but maybe that will go away when it becomes more common (and hopefully adopted in enterprises).

Actually there are workarounds to get Wireguard running over TCP and port 80/443 described here (like udp tunnel). I also wanted to check them out for very restrictive networks in the near future:

https://github.com/StreisandEffect/streisand/issues/1633

Re: WireGuard is now in Linus' tree

#73

Post by Diederich »

TimTheTinker wrote: post #67
Diederich wrote: post #58

Earlier quoted context omitted.

I've been using WireGuard on my Android phone for a good while now using a free digital ocean droplet via https://github.com/trailofbits/algo It's fast. It's easy. You never have to think about it. It just works.

> using a free digital ocean droplet I can't seem to find any "free" option on their pricing page. Could you elucidate?

> Could you elucidate?

I sure can.

It looks like I'm using the $5/month 1GB/1CPU/25GB droplet running Ubuntu 18 LTS, and just imagined that I was using a free one.

Memory sucks.

Re: WireGuard is now in Linus' tree

#74

Post by sdan »

tcas wrote: post #38
sdan wrote: post #31

WireGuard is absolutely fabulous. I route all my traffic from a couple servers at home to a small GCP instance (don’t want IP to be public) and I added my laptop to this WireGuard network (although technically a peer) and I can ssh into it remotely. I’m serving a 1,000,000+ page views a month through WireGuard and can’t say anything less about it it.

Do you set up nginx or haproxy as a reverse proxy to the wireguard network, or something else? Been wondering if there's an easy way to expose an internal service like that. TCP seems easy, but UDP seems much more problematic.

Traefik.

Recently they started supporting TCP so now I do both HTTP for websites and TCP for databases

Re: WireGuard is now in Linus' tree

#75

Post by sirtoffski »

lvh wrote: post #40
sirtoffski wrote: post #30

Earlier quoted context omitted.

WireGuard operates at layer 3. The first sentence from the white paper by Jason A.: “ WireGuard is a secure network tunnel, operating at layer 3...”. [1] Regardless of the layer, in a few words WireGuard is a simple encrypted tunnel over UDP. Since it’s UDP - there’s no guarantee all packets will be delivered, BUT - what WireGuard places emphasis on is all packets delivered from the WireGuard interface will be authen…

The tunnel does not have to encapsulate messages at the same layer as the tunnel itself. Consider this thought experiment: if you send Ethernet frames over WebSockets, what layer is the protocol? My understanding is the Wireguard messages are IP (L3) but the protocol messages itself are UDP (L4) and it seems reasonable to describe Wireguard as a session layer over UDP given how much state and connection information i…

I see what you mean. Specifically in the context of VPNs I’ve always interpreted the layer in terms of the payload that’s being encapsulated - which as far as I understand is IP (L3) packets in Wireguard’s case.

Maybe due to my own ignorance I misunderstood the meaning of derefr’s comment. Apologies if I sounded rude!

Re: WireGuard is now in Linus' tree

#76

Post by willis936 »

jchw wrote: post #49

I’m using WireGuard daily on Linux and iPhone. It’s hard to describe how much better of an experience this is than OpenVPN. Connections are reliable and durable, latency is pretty low, and you can actually understand the software.

I’ve been playing with wireguard for the past few days for my personal network. It is likely that I just don’t know what I’m doing yet, but I’ve been having connection issues that I haven’t had with openVPN. One set of issues is from overlapping IP ranges (192.168.1.0/24 is bad news) and another with something I haven’t figured out yet when connecting from work. OpenVPN doesn’t have issues but wireguard does. My thought is the specific port is filtered by my work, but I’m using a rather obscure and high value port.

Re: WireGuard is now in Linus' tree

#77

Post by EvanAnderson »

zenhack wrote: post #68
ronnier wrote: post #28

Earlier quoted context omitted.

I think it's pretty common in the US with the various providers. You get a public IP. I didn't do anything special for that.

Yeah, I don't think I've ever encountered an ISP in the US that didn't give you a public IP. Maybe they exist? You only get one, so you typically NAT everything, port 25 is blocked and often port 80 is as well, but that's about it.

Come to rural western Ohio, where the only non-dial-up options, in some places, are super-high latency satellite and a local "WISP" who NATs their whole Customer base into what appears to be a /29 (your "public" IP assigned by their CPE lands in 10.0.0.0/8).

Re: WireGuard is now in Linus' tree

#78

Post by Polylactic_acid »

RL_Quine wrote: post #43
braindeath wrote: post #25

Earlier quoted context omitted.

In the US for home connections (cable, fiber, DSL) everybody gets an accessible IP address pretty much -- the worst is that some ports are blocked like port 80 or 25. Phones don't get a dedicated IPv4.

For most people it's dynamic. Mine is dynamic with the PPPoE fibre session.

I have a rpi set up with a minutely cron job to update my domain name to point to home. Works pretty well. At the worst you lose connection for a minute but usually the IP address only changes when the home connection fails which can take more than a minute to reset anyway.

Re: WireGuard is now in Linus' tree

#79

Post by 3xblah »

CrazyStat wrote: post #71
RL_Quine wrote: post #43

Earlier quoted context omitted.

For most people it's dynamic. Mine is dynamic with the PPPoE fibre session.

Dynamic in theory, but for many people the IP is unchanged for a long time. I remember reading an article that said the average length of time between dynamic IP changes tracked by some company was something like seven months, though I can't find it now. I have cable with a theoretically dynamic DNS but it's changed once in >4 years.

Can you be sure that during 4yrs it never changed >1 even for a short time, maybe hours or days, then reverted back
Post reply on HN