Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is now in Linus' tree

lists.zx2c4.com

Post reply on HN
Print view View original

141–150 of 293 posts

Re: WireGuard is now in Linus' tree

#141

Post by zx2c4 »

johnebgd wrote: post #83
numbsafari wrote: post #59

As someone who regularly deals with IPSec in conservative network environments, Wireguard can’t gain broad adoption soon enough, in my opinion. Now that it’s merged into Linus’s tree, any word on it getting an official release and the “this isn’t production ready, so no CVEs” disclaimer going away? EDIT: Further back in the thread, Donenfeld says “Please note that until Linux 5.6 is released, this snapshot is a snaps…

If you value WireGuard and can spare a few bucks the inventor/maintainer is getting about 1/10th what they publicly ask for to maintain: https://www.patreon.com/zx2c4

Thanks for posting this; we appreciate it. More generally, donation options for the project are listed here: https://www.wireguard.com/donations/

Re: WireGuard is now in Linus' tree

#142

Post by rhn_mk1 »

tcas wrote: post #38
sdan wrote: post #31

WireGuard is absolutely fabulous. I route all my traffic from a couple servers at home to a small GCP instance (don’t want IP to be public) and I added my laptop to this WireGuard network (although technically a peer) and I can ssh into it remotely. I’m serving a 1,000,000+ page views a month through WireGuard and can’t say anything less about it it.

Do you set up nginx or haproxy as a reverse proxy to the wireguard network, or something else? Been wondering if there's an easy way to expose an internal service like that. TCP seems easy, but UDP seems much more problematic.

I'm doing something similar with a random VPS provider, using and some NAT rules to forward selected ports across the VPN interface. If there's interest, I could write up a more detailed explanation.

Re: WireGuard is now in Linus' tree

#143

Post by cpach »

ta999999171 wrote: post #112

Check your place very carefully for mold. And/or ease up on the alcohol. Just a hunch, nothing intended

“And/or ease up on the alcohol.”

Say what...? This is just rude. I assume you don’t even know 'Diederich. Don’t post stuff like this here, it is against the site’s guidelines.

https://news.ycombinator.com/newsguidelines.html

Re: WireGuard is now in Linus' tree

#144

Post by 3xblah »

3xblah wrote: post #19
ronnier wrote: post #3

I’ve been nothing but happy with WireGuard. Connecting from my iPhone to my home and it works great, it’s fast and reliable. I’m never waiting to connect. Switching between WiFi, mobile, and sleeping go unnoticed.

Your home has publicly accessible^1 IP address Or you are using a third party-controlled server with direct internet access to make home IP accessible 1. No ISP firewall blocking unsolicited incoming traffic Do you configure WG to use persistent keepalives

"This means you can use it to create inbound network tunnels to computers that don't have a public IP, are behind firewalls or get assigned new IPs frequently."

Sure enough, look what appears on HN front page a few hours later...

https://news.ycombinator.com/item?id=22167627

People's home public IP addresses are not universally reachable/accessible^1 from the internet. It varies.

What does "reachable/accessible" mean. It means that transferring a file would be as easy as person A typing something like

    nc -lnp [port] [person A home IP adddress]
and person B typing

    nc -w1 -vvn [person A home IP address] [port] > file
where port is not one that is blocked, e.g., 80, 25, etc. and is known by both persons.

Regardless of what anyone says in an HN comment, in the real world, people at home are sometimes behind firewalls, or other software that performs NAT, that are running on computers that do not belong to them and are not under their control.

That's why WG has persistent keepalives. No one answered that question.

Re: WireGuard is now in Linus' tree

#145

Post by vbezhenar »

throwaway2048 wrote: post #53
vbezhenar wrote: post #45

Earlier quoted context omitted.

IPSec works fine with UDP and NAT.

"fine" with NAT is a bit of an overstatement, I don't think anyone who has seriously interacted with IPSEC would call it anything but a gigantic pain in the ass

I'm not "seriously" interacted, but I have VPN server and I'm using it on all devices in my hope (laptop, PC, phone) which are behind WiFi NAT. They work just fine. I'm using strongswan and IKEv2 on server.

Re: WireGuard is now in Linus' tree

#146

Post by [deleted] »

ignoramous wrote: post #98
tcas wrote: post #38

Earlier quoted context omitted.

Do you set up nginx or haproxy as a reverse proxy to the wireguard network, or something else? Been wondering if there's an easy way to expose an internal service like that. TCP seems easy, but UDP seems much more problematic.

Check out https://tailscale.com/ a mesh VPN built on top of wireguard.

[deleted]

Re: WireGuard is now in Linus' tree

#148

Post by pferde »

tptacek wrote: post #94
bitexploder wrote: post #88

WireGuard is cool and we really like it at our company (a bunch of infosec consultants). The management of it for an even small number (20) of users is a no-go. OpenVPN is ultra reliable and provides legit 2FA options when set up well. I look forward to legit management tools and improvements. For personal use it has been great. Much simpler than OpenVPN for a few (3) users.

The way you're managing WireGuard today is like directly configuring KAME IPSEC. The Linux WireGuard implementation is low-level and, from a systems perspective, unopinionated, which is as it should be. Getting a secure transport integrated safely into the kernel shouldn't be rocket surgery, but it is. That part is done. Getting IdP-managed WireGuard is not rocket surgery, and lots of teams will presumably do it. Tho…

I'm a big fan of Wireguard, and am using it in a few places, but OpenVPN still has its place - namely if you need a VPN tunnel from behind a firewall that only allows outgoing connections to small number of TCP ports, and no UDP ports.

Re: WireGuard is now in Linus' tree

#149

Post by gjhr »

core-questions wrote: post #106
Polylactic_acid wrote: post #78

Earlier quoted context omitted.

I have a rpi set up with a minutely cron job to update my domain name to point to home. Works pretty well. At the worst you lose connection for a minute but usually the IP address only changes when the home connection fails which can take more than a minute to reset anyway.

Isn't this what the DynDNS protocol and various daemons are for? Why write your own? :P

Why not? It is pretty simple and very fun! My first project in golang was a program that polled for the machine's IP address and updated a AWS Route53 record.

Re: WireGuard is now in Linus' tree

#150

Post by adevx »

Fantastic news. I deploy WireGuard to provide a private network (mesh) between VPS servers. Each VPS instance has each other vps as peer. So no single source of failure. I run PostgreSQL with Patroni and GlusterFS over this mesh with no issues. When I add or destroy a VPS with Ansible all VPS nodes get an updated config and reload. This way I don't rely on a single cloud provider because I do not use their private network service.
Post reply on HN