Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is now in Linus' tree

lists.zx2c4.com

Post reply on HN
Print view View original

171–180 of 293 posts

Re: WireGuard is now in Linus' tree

#171

Post by canofbars »

core-questions wrote: post #106
Polylactic_acid wrote: post #78

Earlier quoted context omitted.

I have a rpi set up with a minutely cron job to update my domain name to point to home. Works pretty well. At the worst you lose connection for a minute but usually the IP address only changes when the home connection fails which can take more than a minute to reset anyway.

Isn't this what the DynDNS protocol and various daemons are for? Why write your own? :P

Its not exactly "write your own" I have a single line in my crontab that just uses curl to post to a url and the remote server takes the IP address it got the request from and sets the dns to that.

Re: WireGuard is now in Linus' tree

#172

Post by Sabinus »

sansnomme wrote: post #107
johnebgd wrote: post #83

Earlier quoted context omitted.

If you value WireGuard and can spare a few bucks the inventor/maintainer is getting about 1/10th what they publicly ask for to maintain: https://www.patreon.com/zx2c4

If you work for a company that uses Wireguard, please ask your employer to contribute.

What's the rate of companies doing this?

Re: WireGuard is now in Linus' tree

#173

Post by yardstick »

Panino wrote: post #117

I use WireGuard on OpenBSD and Linux and it is just simply beautiful. THANK YOU Jason for writing it and to everyone else who has contributed code, testing, money, whatever. I believe WireGuard will become the most widely used VPN above IPsec and OpenVPN. There will still be use cases for them (especially IPsec) but both will lose marketshare dramatically.

WireGuard is nice but needs 2FA support. Until then it can’t be used in various corporate road warrior scenarios.

Also until Cisco, Juniper, etc add WireGuard support and enough devices are deployed with it, IPsec will remain the corporate tool of choice when connecting between different organisations. Within the same org, where you have greater control of the equipment used, WireGuard is a bit more feasible.

Re: WireGuard is now in Linus' tree

#174

Post by lima »

deanclatworthy wrote: post #115
nathancahill wrote: post #108

Earlier quoted context omitted.

Do you have any issues with sites blocking the DO IP addresses? I ran this for a while and a number of sites block connections for coming from a data center.

Yep. DO is industry-blacklisted by the consortium of online content providers who collude on VPN ip-ranges. BBC, Netflix, Sky all are blocking it.

DO is also commonly blacklisted for being slow to deal with network abuse.

I used to build a DDoS mitigation product and we would regularly see 50+ Gbps of inbound attacks originating from DO.

Re: WireGuard is now in Linus' tree

#175

Post by viraptor »

tpetry wrote: post #169
bauerd wrote: post #159

Earlier quoted context omitted.

I used to do the same thing, but adding one node meant I had to reprovision all other nodes so each had an updated config file written and reloaded. I decided I want something akin to DHCP, which seems to be worked on here: https://github.com/WireGuard/wg-dynamic It's still WIP though.

This problem has be prevented me all the time from rolling out wireguard. But how dows wg-dynamic help which seems just to be a DHCP on wireguard implementation? You still have to sent every existing node and updated configuration because you provisoned a new one. An overlay network on top of wireguard would be really nice. For example you are running a wireguard network on 169.254.0.0/16. So every peer which is assi…

While WG is pretty cool, you're starting to describe a simple version of ZeroTier. You can achieve exactly what you say with it, along with multiple networks, chosen/assigned ips, p2p routing, shared keys for authentication to the network, etc. You can put extra filtering or routing rules on top of each of the networks.

Re: WireGuard is now in Linus' tree

#176

Post by adevx »

ghthor wrote: post #154
adevx wrote: post #150

Fantastic news. I deploy WireGuard to provide a private network (mesh) between VPS servers. Each VPS instance has each other vps as peer. So no single source of failure. I run PostgreSQL with Patroni and GlusterFS over this mesh with no issues. When I add or destroy a VPS with Ansible all VPS nodes get an updated config and reload. This way I don't rely on a single cloud provider because I do not use their private ne…

That's really interesting. So you essentially implemented a Virtual Private Cloud(VPC) on top of the "PHY" network of your hosts? Does that mean that all your nodes have to be accessible to the public internet?

In my case yes and yes, but mostly because I spread out over two cloud providers.

Re: WireGuard is now in Linus' tree

#177

Post by pedrocr »

bauerd wrote: post #159
adevx wrote: post #150

Fantastic news. I deploy WireGuard to provide a private network (mesh) between VPS servers. Each VPS instance has each other vps as peer. So no single source of failure. I run PostgreSQL with Patroni and GlusterFS over this mesh with no issues. When I add or destroy a VPS with Ansible all VPS nodes get an updated config and reload. This way I don't rely on a single cloud provider because I do not use their private ne…

I used to do the same thing, but adding one node meant I had to reprovision all other nodes so each had an updated config file written and reloaded. I decided I want something akin to DHCP, which seems to be worked on here: https://github.com/WireGuard/wg-dynamic It's still WIP though.

I use tinc for this. It does the mesh dynamically so I have a few nodes that are fixed and the others will connect directly or indirectly automatically. I deploy it using puppet and there's no need to update all nodes to add a new one. The cryptography and performance is probably not as good as wireguard but more than good enough for my uses. I think there's been consideration to using wireguard as the transport instead of doing everything in userspace.

Re: WireGuard is now in Linus' tree

#178

Post by 3xblah »

3xblah wrote: post #79
CrazyStat wrote: post #71

Earlier quoted context omitted.

Dynamic in theory, but for many people the IP is unchanged for a long time. I remember reading an article that said the average length of time between dynamic IP changes tracked by some company was something like seven months, though I can't find it now. I have cable with a theoretically dynamic DNS but it's changed once in >4 years.

Can you be sure that during 4yrs it never changed >1 even for a short time, maybe hours or days, then reverted back

Maybe running dynamic DNS client that keeps logs of IP address changes. Do DDNS clients keep logs. Maybe passive DNS would detect changes.

The point of the comment was that cannot just assume it never changed unless monitoring it contiuously.

Re: WireGuard is now in Linus' tree

#179

Post by tomberek »

ZoomZoomZoom wrote: post #168
imiric wrote: post #138

This is great news, and I'm looking forward to giving it a try once it's released as part of the kernel. I've been using tinc[1] for several years now, and it's been very simple to configure and use. Similarly to WG, it can tunnel over UDP, but also over TCP, supports router or switch modes, NAT traversal, etc. It's a great project, but not very popular and I'm concerned about its maintenance and security issues movi…

As far as I understand, the killer feature of Tinc is automatic mesh routing. You can add a node to one instance and the information spreads through the network, wireguard doesn't do that. Also, I heard maintainers were contemplating replacing the protocol with Wireguard. https://www.tinc-vpn.org/pipermail/tinc/2017-February/004755...

Tinc as a manger of a mesh of Wireguard connections would be incredible.

Re: WireGuard is now in Linus' tree

#180

Post by wolfhumble »

sdan wrote: post #93
sdan wrote: post #74

Earlier quoted context omitted.

Traefik. Recently they started supporting TCP so now I do both HTTP for websites and TCP for databases

If you need any help, let me know at hn@sdan.cc. I'm going to write a couple blog posts documenting how to do this (because it took me a full brain-wrecking week to figure out how to do this properly). WireGuard for networking and Traefik for loadbalancing is so easy to do (if you do it correctly).

While waiting for your interesting blog post, I have a few questions if you don't mind :-) :

So your setup is: * GCP Instance (i.e. VM on the Google infrastructure). - Traefik running on this instance.

* GCP conntected to Wireguard => Is Wireguard run on a router/firewall, or directly on the DB, HTTP servers? If router, would be interesting to know which type of router?

* Behind Wireguard: Two servers (DB and HTTP) + Laptop

* You SSH to the two Servers (directly or via the GCP?)

Thanks! :-)

Post reply on HN