[deleted]
WireGuard is now in Linus' tree
101–110 of 293 posts
Re: WireGuard is now in Linus' tree
#102Very glad to see WireGuard getting more adoption. I've been using it while mobile and traveling and it's been absolutely rock solid. OpenWrt router back at home, multiple Android devices and Fedora machines connecting back that just work seamlessly between different networks. It's been such a treat to use and watch and help it mature. Just need more popular VPN providers to start supporting it -- NordVPN and PIA have…
Mullvad supports WireGuard tunnels, been using it for a couple of months now, pretty solid in any device, in all the regions I tried.
I found the speeds to be lacking quite a bit and it was never completely reliable with both the WireGuard app and the official Android app, which also doesn't support split tunneling or allowing specific apps to bypass the interface. I will revisit when my subscription with current provider expires.
Re: WireGuard is now in Linus' tree
#103So,curious here: I'v been reading about how the focus these days is to move networking code to userspace because you can squeeze out more PPS performance,does the fact that WC makes use of kernel code heavily give it a performance disadvantage?
I don’t know what PPS is, but that is an inaccurate sentiment. Running as a kernel module allows you to achieve higher throughout and lower latency.
You're correct. I don't know why you're downvoted. Anything you can do to get performance with kernel bypass techniques can be done inside the kernel as well.
Re: WireGuard is now in Linus' tree
#104Re: WireGuard is now in Linus' tree
#105Earlier quoted context omitted.
A major difference, besides WireGuard's simplicity, is that IPSec is a layer 4 protocol (ESP packets instead of TCP/UDP packets) whereas WireGuard is a layer 5 protocol (runs over UDP), so switches don't choke on it, and so a WireGuard peer doesn't need a public-routable IP address, but can be behind NAT.
IPSec works fine with UDP and NAT.
Try having more than one IKE responser behind same nat gw. Gets tricky to have both/all respond to udp 500...
Re: WireGuard is now in Linus' tree
#106Earlier quoted context omitted.
For most people it's dynamic. Mine is dynamic with the PPPoE fibre session.
I have a rpi set up with a minutely cron job to update my domain name to point to home. Works pretty well. At the worst you lose connection for a minute but usually the IP address only changes when the home connection fails which can take more than a minute to reset anyway.
Isn't this what the DynDNS protocol and various daemons are for? Why write your own? :P
Re: WireGuard is now in Linus' tree
#107As someone who regularly deals with IPSec in conservative network environments, Wireguard can’t gain broad adoption soon enough, in my opinion. Now that it’s merged into Linus’s tree, any word on it getting an official release and the “this isn’t production ready, so no CVEs” disclaimer going away? EDIT: Further back in the thread, Donenfeld says “Please note that until Linux 5.6 is released, this snapshot is a snaps…
If you value WireGuard and can spare a few bucks the inventor/maintainer is getting about 1/10th what they publicly ask for to maintain: https://www.patreon.com/zx2c4
If you work for a company that uses Wireguard, please ask your employer to contribute.
Re: WireGuard is now in Linus' tree
#108I’m using WireGuard daily on Linux and iPhone. It’s hard to describe how much better of an experience this is than OpenVPN. Connections are reliable and durable, latency is pretty low, and you can actually understand the software.
I've been using WireGuard on my Android phone for a good while now using a free digital ocean droplet via https://github.com/trailofbits/algo It's fast. It's easy. You never have to think about it. It just works.
Do you have any issues with sites blocking the DO IP addresses? I ran this for a while and a number of sites block connections for coming from a data center.
Re: WireGuard is now in Linus' tree
#109Earlier quoted context omitted.
I have a rpi set up with a minutely cron job to update my domain name to point to home. Works pretty well. At the worst you lose connection for a minute but usually the IP address only changes when the home connection fails which can take more than a minute to reset anyway.
Isn't this what the DynDNS protocol and various daemons are for? Why write your own? :P
That's precisely how they work. You install a client that pings their server. They see if there's an IP address change and switch the A DNS record.
If your DNS provider has an API, this is probably the very first example in the docs.
Re: WireGuard is now in Linus' tree
#110WireGuard is cool and we really like it at our company (a bunch of infosec consultants). The management of it for an even small number (20) of users is a no-go. OpenVPN is ultra reliable and provides legit 2FA options when set up well. I look forward to legit management tools and improvements. For personal use it has been great. Much simpler than OpenVPN for a few (3) users.
The way you're managing WireGuard today is like directly configuring KAME IPSEC. The Linux WireGuard implementation is low-level and, from a systems perspective, unopinionated, which is as it should be. Getting a secure transport integrated safely into the kernel shouldn't be rocket surgery, but it is. That part is done. Getting IdP-managed WireGuard is not rocket surgery, and lots of teams will presumably do it. Tho…
I would dearly love to see it make its way into pfsense, at which point I could reasonably execute on that vision. Right now I'm using both OpenVPN and Wireguard, and I'd rather not be.