Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is now in Linus' tree

lists.zx2c4.com

Post reply on HN
Print view View original

151–160 of 293 posts

Re: WireGuard is now in Linus' tree

#151

Post by plapetomain »

3xblah wrote: post #26
ronnier wrote: post #21

Earlier quoted context omitted.

I have a public IP.

A previous thread about WG had some discussion about obtaining a publicly reachable^1 IP address. No doubt many readers are interested Can you tell us anything about how you obtained one 1. No ISP firewall blocking unsolicited incoming traffic

Almost every ISP will have a firewall of some kind, but in the US this is usually just blocking 25 incoming, sometimes 80 (fios), maybe a few other ports.

I have run services on port 443 on Optimum and FiOS for years.

IP addresses don’t change frequently. Usually what happens is there will be some maintenance and you’ll end up with a new IP because you lost the lease in the interim. If you keep your equipment on though you can have the same reachable IP address for years.

I use a dynamic DNS service so this is rarely a big deal.

Not sure why this is so hard for you to grasp. You keep arguing, for what reason?

Re: WireGuard is now in Linus' tree

#152

Post by danmur »

sdan wrote: post #31

WireGuard is absolutely fabulous. I route all my traffic from a couple servers at home to a small GCP instance (don’t want IP to be public) and I added my laptop to this WireGuard network (although technically a peer) and I can ssh into it remotely. I’m serving a 1,000,000+ page views a month through WireGuard and can’t say anything less about it it.

I do this too! Works super well, I use haproxy on the cloud side.

Re: WireGuard is now in Linus' tree

#153

Post by Hikikomori »

numbsafari wrote: post #59

As someone who regularly deals with IPSec in conservative network environments, Wireguard can’t gain broad adoption soon enough, in my opinion. Now that it’s merged into Linus’s tree, any word on it getting an official release and the “this isn’t production ready, so no CVEs” disclaimer going away? EDIT: Further back in the thread, Donenfeld says “Please note that until Linux 5.6 is released, this snapshot is a snaps…

Woud like to use for anything but personal use but cannot use it at work for anything but maybe site to site tunnels.

Re: WireGuard is now in Linus' tree

#154

Post by ghthor »

adevx wrote: post #150

Fantastic news. I deploy WireGuard to provide a private network (mesh) between VPS servers. Each VPS instance has each other vps as peer. So no single source of failure. I run PostgreSQL with Patroni and GlusterFS over this mesh with no issues. When I add or destroy a VPS with Ansible all VPS nodes get an updated config and reload. This way I don't rely on a single cloud provider because I do not use their private ne…

That's really interesting. So you essentially implemented a Virtual Private Cloud(VPC) on top of the "PHY" network of your hosts?

Does that mean that all your nodes have to be accessible to the public internet?

Re: WireGuard is now in Linus' tree

#155

Post by ryanlol »

mekster wrote: post #121
oarsinsync wrote: post #61

Earlier quoted context omitted.

Right now, it is not part of the Linux kernel. It is just some random external software that you have you download and compile yourself against the source headers of the kernel you're currently running. It got merged into the net-next tree, which meant it has been approved by the maintainer of the Linux kernel net branch to be included into the kernel. Linus has now pulled it from net-next into his own tree, which me…

> As far as that means as an end user, it means that you no longer need to recompile your wireguard module every time there's a kernel update, as now it will be handled by your distro. That's not the important point. The point being, when merged as part of the kernel officially, you know it will get more support and eyes for stability and development power as the kernel wouldn't want to ship anything that's at some u…

>you know it will get more support and eyes for stability and development power as the kernel wouldn't want to ship anything that's at some unstable state.

This is a rather idealistic view on kernel development.

But it is true that when wireguard is “ready” this could very well result in a bit more support as larger orgs will be more willing to start using wireguard.

Re: WireGuard is now in Linus' tree

#156

Post by acqq »

zx2c4 wrote: post #141
johnebgd wrote: post #83

Earlier quoted context omitted.

If you value WireGuard and can spare a few bucks the inventor/maintainer is getting about 1/10th what they publicly ask for to maintain: https://www.patreon.com/zx2c4

Thanks for posting this; we appreciate it. More generally, donation options for the project are listed here: https://www.wireguard.com/donations/

That ( https://www.wireguard.com/donations/ -- repeating for completeness and exposure) is surely much better link for donations, as some of us would feel limited with a single "Patreon" option.

There are other possibilities for individuals:

"Monthly: GitHub Sponsors, Paypal, Patreon, Liberapay"

"Once: Stripe, Bitcoin, Paypal"

And also "for non-profit foundations and companies."

Thanks!

Re: WireGuard is now in Linus' tree

#157

Post by zx2c4 »

numbsafari wrote: post #59

As someone who regularly deals with IPSec in conservative network environments, Wireguard can’t gain broad adoption soon enough, in my opinion. Now that it’s merged into Linus’s tree, any word on it getting an official release and the “this isn’t production ready, so no CVEs” disclaimer going away? EDIT: Further back in the thread, Donenfeld says “Please note that until Linux 5.6 is released, this snapshot is a snaps…

Right. We'll stamp a 1.0 on the backports as soon as 5.6 is released and goes through the normal mainline release process. Stamping a 1.0 on the compat backport before mainline would be premature, but doing it the day of is the plan.

Re: WireGuard is now in Linus' tree

#158

Post by dirkt »

braindeath wrote: post #25
3xblah wrote: post #19

Earlier quoted context omitted.

Your home has publicly accessible^1 IP address Or you are using a third party-controlled server with direct internet access to make home IP accessible 1. No ISP firewall blocking unsolicited incoming traffic Do you configure WG to use persistent keepalives

In the US for home connections (cable, fiber, DSL) everybody gets an accessible IP address pretty much -- the worst is that some ports are blocked like port 80 or 25. Phones don't get a dedicated IPv4.

In other parts of the World that didn't get as many IPv4 addresses as the US, the standard for home connections is that you DON'T get a public IP address, you get a private IP address behind carrier grade NAT

And that's really NAT, not a firewall, so nothing is "blocked".

You do get public IPv6 addresses from some ISPs, though.

Re: WireGuard is now in Linus' tree

#159

Post by bauerd »

adevx wrote: post #150

Fantastic news. I deploy WireGuard to provide a private network (mesh) between VPS servers. Each VPS instance has each other vps as peer. So no single source of failure. I run PostgreSQL with Patroni and GlusterFS over this mesh with no issues. When I add or destroy a VPS with Ansible all VPS nodes get an updated config and reload. This way I don't rely on a single cloud provider because I do not use their private ne…

I used to do the same thing, but adding one node meant I had to reprovision all other nodes so each had an updated config file written and reloaded. I decided I want something akin to DHCP, which seems to be worked on here: https://github.com/WireGuard/wg-dynamic It's still WIP though.

Re: WireGuard is now in Linus' tree

#160

Post by 3xblah »

plapetomain wrote: post #151
3xblah wrote: post #26

Earlier quoted context omitted.

A previous thread about WG had some discussion about obtaining a publicly reachable^1 IP address. No doubt many readers are interested Can you tell us anything about how you obtained one 1. No ISP firewall blocking unsolicited incoming traffic

Almost every ISP will have a firewall of some kind, but in the US this is usually just blocking 25 incoming, sometimes 80 (fios), maybe a few other ports. I have run services on port 443 on Optimum and FiOS for years. IP addresses don’t change frequently. Usually what happens is there will be some maintenance and you’ll end up with a new IP because you lost the lease in the interim. If you keep your equipment on thou…

"I have run services on port 443 on Optimum and FIOS for years."

What is Optimum, FIOS.

WG does not work over TCP.

Try running a UDP-only DNS server from home on some random port. If you know the port can you reach it via UDP from the internet.

A TCP service listening on port 443 on an ISP customer's IP address in the US might be reachable from the internet. However, this topic is neither TCP nor port 443 nor is it restricted to just the US.

Post reply on HN