Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is now in Linus' tree

lists.zx2c4.com

Post reply on HN
Print view View original

201–210 of 293 posts

Re: WireGuard is now in Linus' tree

#201

Post by lizknope »

plapetomain wrote: post #151
3xblah wrote: post #26

Earlier quoted context omitted.

A previous thread about WG had some discussion about obtaining a publicly reachable^1 IP address. No doubt many readers are interested Can you tell us anything about how you obtained one 1. No ISP firewall blocking unsolicited incoming traffic

Almost every ISP will have a firewall of some kind, but in the US this is usually just blocking 25 incoming, sometimes 80 (fios), maybe a few other ports. I have run services on port 443 on Optimum and FiOS for years. IP addresses don’t change frequently. Usually what happens is there will be some maintenance and you’ll end up with a new IP because you lost the lease in the interim. If you keep your equipment on thou…

Just to confirm what you are saying.

I had a Time Warner cable modem for 15 years and the IP address would only change after a sustained power outage. Usually had the same IP for a year.

My AT&T Fiber IP address has not changed in 2 years and that is even after 2 power outages of about 12 hours.

Re: WireGuard is now in Linus' tree

#202

Post by BuildTheRobots »

tptacek wrote: post #94
bitexploder wrote: post #88

WireGuard is cool and we really like it at our company (a bunch of infosec consultants). The management of it for an even small number (20) of users is a no-go. OpenVPN is ultra reliable and provides legit 2FA options when set up well. I look forward to legit management tools and improvements. For personal use it has been great. Much simpler than OpenVPN for a few (3) users.

The way you're managing WireGuard today is like directly configuring KAME IPSEC. The Linux WireGuard implementation is low-level and, from a systems perspective, unopinionated, which is as it should be. Getting a secure transport integrated safely into the kernel shouldn't be rocket surgery, but it is. That part is done. Getting IdP-managed WireGuard is not rocket surgery, and lots of teams will presumably do it. Tho…

> But WireGuard is leagues beyond OpenVPN in terms of nuts-and-bolts protocol and implementation security.

Could you recommend anything to read that explains this in more detail, please?

Re: WireGuard is now in Linus' tree

#203

Post by throw0101a »

numbsafari wrote: post #59

As someone who regularly deals with IPSec in conservative network environments, Wireguard can’t gain broad adoption soon enough, in my opinion. Now that it’s merged into Linus’s tree, any word on it getting an official release and the “this isn’t production ready, so no CVEs” disclaimer going away? EDIT: Further back in the thread, Donenfeld says “Please note that until Linux 5.6 is released, this snapshot is a snaps…

> As someone who regularly deals with IPSec in conservative network environments, Wireguard can’t gain broad adoption soon enough, in my opinion.

As someone who does not do heavy NetOps, can you speak more about what's wrong with IPsec?

Re: WireGuard is now in Linus' tree

#204

Post by willis936 »

philjohn wrote: post #134
willis936 wrote: post #76

Earlier quoted context omitted.

I’ve been playing with wireguard for the past few days for my personal network. It is likely that I just don’t know what I’m doing yet, but I’ve been having connection issues that I haven’t had with openVPN. One set of issues is from overlapping IP ranges (192.168.1.0/24 is bad news) and another with something I haven’t figured out yet when connecting from work. OpenVPN doesn’t have issues but wireguard does. My thou…

I've run into both issues, for the first I moved my internal network to a subnet in the 10.0.0.0 range and the second was a DPI firewall at a hotel I stayed at - in the end I have a dual mode setup where if I HAVE to I connect to an OpenVPN endpoint in my network, otherwise it's wireguard all the way.

That’s irritating at best. The whole point of using wireguard, to me, was to move away from openVPN. If I can’t do that then why would I bother hosting a second way to punch through to my network?

Re: WireGuard is now in Linus' tree

#205

Post by ldoughty »

johnebgd wrote: post #83
numbsafari wrote: post #59

As someone who regularly deals with IPSec in conservative network environments, Wireguard can’t gain broad adoption soon enough, in my opinion. Now that it’s merged into Linus’s tree, any word on it getting an official release and the “this isn’t production ready, so no CVEs” disclaimer going away? EDIT: Further back in the thread, Donenfeld says “Please note that until Linux 5.6 is released, this snapshot is a snaps…

If you value WireGuard and can spare a few bucks the inventor/maintainer is getting about 1/10th what they publicly ask for to maintain: https://www.patreon.com/zx2c4

it seems there are confusing / multiple sources of income, patreon is only one.

I don't know if it's fair to say he's not making what he asks for.. or basing a 1/10th claim without knowing how much he gets from other sources. (Bronze/gold partnerships GitHub donations, stripe, crypto donations, and some others).

Re: WireGuard is now in Linus' tree

#206

Post by ldoughty »

ZiiS wrote: post #120
johnebgd wrote: post #83

Earlier quoted context omitted.

If you value WireGuard and can spare a few bucks the inventor/maintainer is getting about 1/10th what they publicly ask for to maintain: https://www.patreon.com/zx2c4

I do rely on Wireguard for some personal projects and I can spare a few bucks. However the reality is I can't get to $15/month the minimum tier. I rely on thousands of opensource projects. Upstreaming should help my arguments for adoption at work; they wouldn't think twice.

If you go to wireguards donation page, you can make a one-time donation too.

Re: WireGuard is now in Linus' tree

#207

Post by labawi »

winged wrote: post #140
willis936 wrote: post #76

Earlier quoted context omitted.

I’ve been playing with wireguard for the past few days for my personal network. It is likely that I just don’t know what I’m doing yet, but I’ve been having connection issues that I haven’t had with openVPN. One set of issues is from overlapping IP ranges (192.168.1.0/24 is bad news) and another with something I haven’t figured out yet when connecting from work. OpenVPN doesn’t have issues but wireguard does. My thou…

My greatest misunderstanding before getting it to work was that Wireguard uses the `AllowedIPs` setting both for defining which source IPs to allow, and also for routing traffic back. Means you can't have multiple peers on your machine with the same set of `AllowedIPs` - you need to configure each separately with their exact IP address. Since WireGuard doesn't do NAT hole punching etc, you'd most likely need to conne…

Yep, AllowedIPs should really be called IPs (or PeerIPs).

Re: WireGuard is now in Linus' tree

#208

Post by lukevp »

sundarurfriend wrote: post #187
ZiiS wrote: post #133

Earlier quoted context omitted.

Thank you, they could make this clearer.

I didn't know this either. I guess that's why many projects have a fake $1 tier with just "the pleasure of knowing you contributed" or something like that as the "reward" for that tier. To let people know that that's still an option.

I agree, I would have signed up for a $1 tier or perhaps $2 but $15 is far too high for the minimum tier. I support the Zig author for $1/mo and hope others would do the same for my open source projects in the future.

Re: WireGuard is now in Linus' tree

#209

Post by appleflaxen »

sdan wrote: post #93
sdan wrote: post #74

Earlier quoted context omitted.

Traefik. Recently they started supporting TCP so now I do both HTTP for websites and TCP for databases

If you need any help, let me know at hn@sdan.cc. I'm going to write a couple blog posts documenting how to do this (because it took me a full brain-wrecking week to figure out how to do this properly). WireGuard for networking and Traefik for loadbalancing is so easy to do (if you do it correctly).

I would love to see a blog post on this.

Re: WireGuard is now in Linus' tree

#210

Post by fulafel »

ZoomZoomZoom wrote: post #168
imiric wrote: post #138

This is great news, and I'm looking forward to giving it a try once it's released as part of the kernel. I've been using tinc[1] for several years now, and it's been very simple to configure and use. Similarly to WG, it can tunnel over UDP, but also over TCP, supports router or switch modes, NAT traversal, etc. It's a great project, but not very popular and I'm concerned about its maintenance and security issues movi…

As far as I understand, the killer feature of Tinc is automatic mesh routing. You can add a node to one instance and the information spreads through the network, wireguard doesn't do that. Also, I heard maintainers were contemplating replacing the protocol with Wireguard. https://www.tinc-vpn.org/pipermail/tinc/2017-February/004755...

IPsec also supports this - give certs signed by a mutually tusted CA to all nodes and they can all communicate host-to-host in a full mesh without needing to reconfigure when adding a host etc.
Post reply on HN