Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is now in Linus' tree

lists.zx2c4.com

Post reply on HN
Print view View original

191–200 of 293 posts

Re: WireGuard is now in Linus' tree

#191

Post by kemonocode »

nathancahill wrote: post #108
Diederich wrote: post #58

Earlier quoted context omitted.

I've been using WireGuard on my Android phone for a good while now using a free digital ocean droplet via https://github.com/trailofbits/algo It's fast. It's easy. You never have to think about it. It just works.

Do you have any issues with sites blocking the DO IP addresses? I ran this for a while and a number of sites block connections for coming from a data center.

If you want to set up a VPN from a VPS, consider something like LunaHost, it's what I use and I find less issues with it due to being far less known I'd guess.

Re: WireGuard is now in Linus' tree

#192

Post by mosselman »

Sabinus wrote: post #172
sansnomme wrote: post #107

Earlier quoted context omitted.

If you work for a company that uses Wireguard, please ask your employer to contribute.

What's the rate of companies doing this?

I have no real idea, but I wouldn't be surprised if it is less than 1%.

Re: WireGuard is now in Linus' tree

#193

Post by rid »

sdan wrote: post #74
tcas wrote: post #38

Earlier quoted context omitted.

Do you set up nginx or haproxy as a reverse proxy to the wireguard network, or something else? Been wondering if there's an easy way to expose an internal service like that. TCP seems easy, but UDP seems much more problematic.

Traefik. Recently they started supporting TCP so now I do both HTTP for websites and TCP for databases

Are you using TLS over TCP to route to the DBs?

Re: WireGuard is now in Linus' tree

#195

Post by terrywang »

Good news (rare) in Jan 2020 ;-)

Using WireGuard to establish a mesh network seems good to start with but it does not scale well (even with the help of subspace web UI). Nebula (from Slack) seems to be a better option which is simple, secure and scales well so far, docs are not that well at this stage but usable.

My main use case of WireGuard is to secure network traffic on Laptop/Workstations, replacing old-school complicated IPsec (strongSwan) and OpenVPN, can't be happier with its simplicity, user experience (seamless switching networks like strongSwan client for Android, per network on-demand, etc) and performance, battery life on mobile devices, etc. Anyway, non of the traditional VPN solutions (including WireGuard) work inside the Chinese GFW when travelling to China Mainland (won't go there until the 2019-nCoV is under control or a vaccine is available). So I am exploring V2ray (TLS + WebSocket + Web) and Trojan at this stage (working ones to my knowledge).

Gravitational folks even implemented a WireGuard based overlay network plugin for k8s, super excited to replace flannel with wormhole (I have to admit it is a bad name) in use cases where encryption is required for overlay networking, which flannel does not offer.

Many thanks to the WireGuard development team for the good work! Jason and many others, wow, I see the name of a long-time-no-see frined Herbert Xu (crypto subsystem maintainer).

Re: WireGuard is now in Linus' tree

#196

Post by [deleted] »

DictumMortuum wrote: post #131

Just yesterday I was looking at tinc [1] and wireguard was mentioned briefly. I'd like a way to access my home computers via ssh to keep them updated via ansible, even if they are on different networks (parents' laptops, my laptop, my raspberry servers, etc). Does anyone with more knowledge care to comment on security issues with tinc vs wireguard? Too bad that you need to use an external droplet for discovering the…

[deleted]

Re: WireGuard is now in Linus' tree

#197

Post by QasimK »

DictumMortuum wrote: post #131

Just yesterday I was looking at tinc [1] and wireguard was mentioned briefly. I'd like a way to access my home computers via ssh to keep them updated via ansible, even if they are on different networks (parents' laptops, my laptop, my raspberry servers, etc). Does anyone with more knowledge care to comment on security issues with tinc vs wireguard? Too bad that you need to use an external droplet for discovering the…

I cannot comment on tinc, but I use WireGuard to do the same thing as you, and it works brilliantly. It was “easy” to set up and use.

I wrote up what I did for my Raspberry PI server that I have at home [0].

The only other component that may be necessary is Dynamic DNS if you have a dynamic home IP address, or at the very least a way to find out your home IP at any time.

[0]: https://qasimk.gitbooks.io/piserver-book/content/personal-vp...

Re: WireGuard is now in Linus' tree

#198

Post by jagger27 »

apearson wrote: post #65
jagger27 wrote: post #24

I just started looking into WireGuard and was disappointed to find out that pfSense has no support for it. I don’t like messing around with packages outside of the pfSense repo, even if it’s kinda supported in FreeBSD.

I run Wireguard on a freebsd server behind pfsense. Works well once you have a nat setup. What is stopping you from going that route?

That's the direction I was headed, yeah. I do like the convenience of managing it all from the firewall web interface, however.

Re: WireGuard is now in Linus' tree

#199

Post by bscphil »

sdan wrote: post #93
sdan wrote: post #74

Earlier quoted context omitted.

Traefik. Recently they started supporting TCP so now I do both HTTP for websites and TCP for databases

If you need any help, let me know at hn@sdan.cc. I'm going to write a couple blog posts documenting how to do this (because it took me a full brain-wrecking week to figure out how to do this properly). WireGuard for networking and Traefik for loadbalancing is so easy to do (if you do it correctly).

> because it took me a full brain-wrecking week to figure out how to do this properly

I would appreciate a guide as well, really for anything Wireguard adjacent. I tried to get a simple client / server configuration with forwarding set up about 2 months ago and gave up after 5 hours of blood, sweat, and tears. Disclaimer: the server was an OPNsense based router. I probably could have done it between two Linux servers from the terminal. I was using a guide I found online, but it didn't help, which may have been due to using OPNsense, I'm not sure.

OpenVPN may be more complicated in theory, but one really nice thing about it is that there are tools that make setting up a configuration trivial on just about any device that supports it. Not true for Wireguard (yet). I'm sure it will get there eventually.

Re: WireGuard is now in Linus' tree

#200

Post by paranoidrobot »

ignoramous wrote: post #98
tcas wrote: post #38

Earlier quoted context omitted.

Do you set up nginx or haproxy as a reverse proxy to the wireguard network, or something else? Been wondering if there's an easy way to expose an internal service like that. TCP seems easy, but UDP seems much more problematic.

Check out https://tailscale.com/ a mesh VPN built on top of wireguard.

Another example of a product that looks interesting, but the folks responsible for marketing it make it a pain in the arse.

This looks like it solves a problem I have. Looks like it might be a commercial product (mentions of Okta and "get started for free"), but I can't find out any more information without signing up which I don't want to do if it doesn't support the configuration I want or is more expensive than my budget for such things.

Post reply on HN