Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is now in Linus' tree

lists.zx2c4.com

Post reply on HN
Print view View original

91–100 of 293 posts

Re: WireGuard is now in Linus' tree

#91

Post by duskwuff »

wbl wrote: post #70
lvh wrote: post #40

Earlier quoted context omitted.

The tunnel does not have to encapsulate messages at the same layer as the tunnel itself. Consider this thought experiment: if you send Ethernet frames over WebSockets, what layer is the protocol? My understanding is the Wireguard messages are IP (L3) but the protocol messages itself are UDP (L4) and it seems reasonable to describe Wireguard as a session layer over UDP given how much state and connection information i…

The internet does not use OSI.

It never ceases to amaze me how stubbornly educators have clung to the OSI model. It describes a non-Internet protocol stack which was designed in the 1970s, and which was never fully implemented. Attempting to use its layers as an ontology for Internet protocols is doomed to failure, as some of its layers (especially Layer 6) describe components which have no direct equivalent on the Internet.

Re: WireGuard is now in Linus' tree

#92

Post by nemosaltat »

SkyPuncher wrote: post #85
jchw wrote: post #49

I’m using WireGuard daily on Linux and iPhone. It’s hard to describe how much better of an experience this is than OpenVPN. Connections are reliable and durable, latency is pretty low, and you can actually understand the software.

I setup WireGuard on my Ubiquiti router and have profiles installed on my phone and Mac. Extremely convenient for some basic privacy when on a public hotspot.

I can’t install the official WireGuard on my Macs that are stuck on High Sierra. Love WireGuard for Android and iOS. I think there’s a way to do it on High Sierra with brew but I haven’t dug too deep.

Re: WireGuard is now in Linus' tree

#93

Post by sdan »

sdan wrote: post #74
tcas wrote: post #38

Earlier quoted context omitted.

Do you set up nginx or haproxy as a reverse proxy to the wireguard network, or something else? Been wondering if there's an easy way to expose an internal service like that. TCP seems easy, but UDP seems much more problematic.

Traefik. Recently they started supporting TCP so now I do both HTTP for websites and TCP for databases

If you need any help, let me know at hn@sdan.cc. I'm going to write a couple blog posts documenting how to do this (because it took me a full brain-wrecking week to figure out how to do this properly).

WireGuard for networking and Traefik for loadbalancing is so easy to do (if you do it correctly).

Re: WireGuard is now in Linus' tree

#94

Post by tptacek »

bitexploder wrote: post #88

WireGuard is cool and we really like it at our company (a bunch of infosec consultants). The management of it for an even small number (20) of users is a no-go. OpenVPN is ultra reliable and provides legit 2FA options when set up well. I look forward to legit management tools and improvements. For personal use it has been great. Much simpler than OpenVPN for a few (3) users.

The way you're managing WireGuard today is like directly configuring KAME IPSEC. The Linux WireGuard implementation is low-level and, from a systems perspective, unopinionated, which is as it should be.

Getting a secure transport integrated safely into the kernel shouldn't be rocket surgery, but it is. That part is done. Getting IdP-managed WireGuard is not rocket surgery, and lots of teams will presumably do it. Those teams, by the way, stand to make a lot more money than Jason will off WireGuard, which is a very good reason to donate.

Nobody who can reasonably avoid it should be using OpenVPN anymore. I get that it's burrowed far into some organizations and am not OpenVPN-shaming anyone. But WireGuard is leagues beyond OpenVPN in terms of nuts-and-bolts protocol and implementation security.

Re: WireGuard is now in Linus' tree

#95

Post by thrwaway69 »

That's good news.

I have been using wireguard via telegram and discord. Bot generates a config, whip it up and send generated QR code/file/instructions. It changes the DNS to the proxy pihole so whenever I connect to vpn, most ads stop bothering me.

It's been great because I can easily give access to others via the bot too. They only need to scan the QR code or download the file, import it in the official app and it works. :D

Re: WireGuard is now in Linus' tree

#96

Post by scrps »

nemosaltat wrote: post #64
therealmarv wrote: post #56

Earlier quoted context omitted.

Same but Linux and Mac. I have the feeling that online live conferences/meetings are working with Wireguard very good. With OpenVPN I always had the feeling to turn the VPN off to reduce the latency overhead.

I can’t install the official WireGuard on my Macs that are stuck on Sierra. Love WireGuard for Android and iOS. I think there’s a way to do it with brew.

In the same situation, it is indeed in brew.

   brew install wireguard-go wireguard-tools
Pretty painless to use and I haven't experienced any issues.

Re: WireGuard is now in Linus' tree

#97

Post by place1 »

This is awesome news. I’ve been using my self written access server deployed as a docker container at my home for ages now with no problems at all. Wg is a pleasure to use and their apps for iOS and desktop are great. The QR code feature in the mobile app is really good.

I can’t wait for better adoption amongst businesses for corporate VPNs.

https://github.com/Place1/wg-access-server

Re: WireGuard is now in Linus' tree

#98

Post by ignoramous »

tcas wrote: post #38
sdan wrote: post #31

WireGuard is absolutely fabulous. I route all my traffic from a couple servers at home to a small GCP instance (don’t want IP to be public) and I added my laptop to this WireGuard network (although technically a peer) and I can ssh into it remotely. I’m serving a 1,000,000+ page views a month through WireGuard and can’t say anything less about it it.

Do you set up nginx or haproxy as a reverse proxy to the wireguard network, or something else? Been wondering if there's an easy way to expose an internal service like that. TCP seems easy, but UDP seems much more problematic.

Check out https://tailscale.com/ a mesh VPN built on top of wireguard.

Re: WireGuard is now in Linus' tree

#100

Post by rochacon »

h4waii wrote: post #86

Very glad to see WireGuard getting more adoption. I've been using it while mobile and traveling and it's been absolutely rock solid. OpenWrt router back at home, multiple Android devices and Fedora machines connecting back that just work seamlessly between different networks. It's been such a treat to use and watch and help it mature. Just need more popular VPN providers to start supporting it -- NordVPN and PIA have…

Mullvad supports WireGuard tunnels, been using it for a couple of months now, pretty solid in any device, in all the regions I tried.
Post reply on HN