Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is now in Linus' tree

lists.zx2c4.com

Post reply on HN
Print view View original

221–230 of 293 posts

Re: WireGuard is now in Linus' tree

#221

Post by jzawodn »

pedrocr wrote: post #177
bauerd wrote: post #159

Earlier quoted context omitted.

I used to do the same thing, but adding one node meant I had to reprovision all other nodes so each had an updated config file written and reloaded. I decided I want something akin to DHCP, which seems to be worked on here: https://github.com/WireGuard/wg-dynamic It's still WIP though.

I use tinc for this. It does the mesh dynamically so I have a few nodes that are fixed and the others will connect directly or indirectly automatically. I deploy it using puppet and there's no need to update all nodes to add a new one. The cryptography and performance is probably not as good as wireguard but more than good enough for my uses. I think there's been consideration to using wireguard as the transport inst…

Yeah, tinc is great in that scenario. I use it similarly.

Re: WireGuard is now in Linus' tree

#222

Post by lvh »

sirtoffski wrote: post #75
lvh wrote: post #40

Earlier quoted context omitted.

The tunnel does not have to encapsulate messages at the same layer as the tunnel itself. Consider this thought experiment: if you send Ethernet frames over WebSockets, what layer is the protocol? My understanding is the Wireguard messages are IP (L3) but the protocol messages itself are UDP (L4) and it seems reasonable to describe Wireguard as a session layer over UDP given how much state and connection information i…

I see what you mean. Specifically in the context of VPNs I’ve always interpreted the layer in terms of the payload that’s being encapsulated - which as far as I understand is IP (L3) packets in Wireguard’s case. Maybe due to my own ignorance I misunderstood the meaning of derefr’s comment. Apologies if I sounded rude!

No worries, you're fine, just trying to clear up the confusion. I've heard both terms used interchangeably depending on context. _Usually_ as an administrator you care about what's in the tunnel, but _usually_ as a designer you're worried about how the tunnel itself is communicated, so, yeah, confusing :)

Re: WireGuard is now in Linus' tree

#223

Post by PhilippGille »

adevx wrote: post #150

Fantastic news. I deploy WireGuard to provide a private network (mesh) between VPS servers. Each VPS instance has each other vps as peer. So no single source of failure. I run PostgreSQL with Patroni and GlusterFS over this mesh with no issues. When I add or destroy a VPS with Ansible all VPS nodes get an updated config and reload. This way I don't rely on a single cloud provider because I do not use their private ne…

I thought about doing something similar, but with Slack's Nebula or with ZeroTier (v2, which is not released yet). They're specifically designed for this kind of overlay network if I'm not mistaken, taking care of node additions and removals automatically. Nebula with fixed "lighthouses", ZeroTier with a decentralized KV store.

Did you look into these as alternatives?

https://github.com/slackhq/nebula

https://www.zerotier.com/zerotier-2-0-status/

Re: WireGuard is now in Linus' tree

#224

Post by muldvarp »

pferde wrote: post #148
tptacek wrote: post #94

Earlier quoted context omitted.

The way you're managing WireGuard today is like directly configuring KAME IPSEC. The Linux WireGuard implementation is low-level and, from a systems perspective, unopinionated, which is as it should be. Getting a secure transport integrated safely into the kernel shouldn't be rocket surgery, but it is. That part is done. Getting IdP-managed WireGuard is not rocket surgery, and lots of teams will presumably do it. Tho…

I'm a big fan of Wireguard, and am using it in a few places, but OpenVPN still has its place - namely if you need a VPN tunnel from behind a firewall that only allows outgoing connections to small number of TCP ports, and no UDP ports.

You're not wrong. OpenVPN can be useful in that case, but in general you shouldn't use TCP as the underlying protocol for other TCP traffic, if you can avoid it. The better solution in this case would be to open a UDP port in the firewall.

Re: WireGuard is now in Linus' tree

#225

Post by muldvarp »

ss3000 wrote: post #184

Anyone aware of a VPN provider that offers WireGuard and supports more than 5 simultaneous connections? I've been using Mullvad but the 5 connections limit is starting to feel really restrictive.

Does mullvad allow five connections at the same time or five different keys overall?

Re: WireGuard is now in Linus' tree

#226

Post by lillecarl »

mosselman wrote: post #192
Sabinus wrote: post #172

Earlier quoted context omitted.

What's the rate of companies doing this?

I have no real idea, but I wouldn't be surprised if it is less than 1%.

I finally emailed my bosses asking our company to give about 100$ a month spread over various projects. I thought not to ask too much as 100$ infinitely much more than 0.

We're not a very big company, could easily afford 1k a month though, but then it becomes an actual sum that's harder to motivate as we're mainly working with MS products.

Re: WireGuard is now in Linus' tree

#227

Post by tptacek »

BuildTheRobots wrote: post #202
tptacek wrote: post #94

Earlier quoted context omitted.

The way you're managing WireGuard today is like directly configuring KAME IPSEC. The Linux WireGuard implementation is low-level and, from a systems perspective, unopinionated, which is as it should be. Getting a secure transport integrated safely into the kernel shouldn't be rocket surgery, but it is. That part is done. Getting IdP-managed WireGuard is not rocket surgery, and lots of teams will presumably do it. Tho…

> But WireGuard is leagues beyond OpenVPN in terms of nuts-and-bolts protocol and implementation security. Could you recommend anything to read that explains this in more detail, please?

The WireGuard paper is a good start.

Re: WireGuard is now in Linus' tree

#228

Post by treesknees »

Diederich wrote: post #58
jchw wrote: post #49

I’m using WireGuard daily on Linux and iPhone. It’s hard to describe how much better of an experience this is than OpenVPN. Connections are reliable and durable, latency is pretty low, and you can actually understand the software.

I've been using WireGuard on my Android phone for a good while now using a free digital ocean droplet via https://github.com/trailofbits/algo It's fast. It's easy. You never have to think about it. It just works.

I also do this, but with Linode. The only hangup I hit every once in a while is that some services will block access to VPS IP blocks due to spam/malicious traffic. E.g. occasionally I can't get Google search results while on VPN, or Pokemon Go won't connect as they block VPS providers to prevent spoofing.

Re: WireGuard is now in Linus' tree

#229

Post by BuildTheRobots »

tptacek wrote: post #227
BuildTheRobots wrote: post #202

Earlier quoted context omitted.

> But WireGuard is leagues beyond OpenVPN in terms of nuts-and-bolts protocol and implementation security. Could you recommend anything to read that explains this in more detail, please?

The WireGuard paper is a good start.

https://www.wireguard.com/papers/wireguard.pdf - thank you.

Re: WireGuard is now in Linus' tree

#230

Post by treesknees »

yardstick wrote: post #173
Panino wrote: post #117

I use WireGuard on OpenBSD and Linux and it is just simply beautiful. THANK YOU Jason for writing it and to everyone else who has contributed code, testing, money, whatever. I believe WireGuard will become the most widely used VPN above IPsec and OpenVPN. There will still be use cases for them (especially IPsec) but both will lose marketshare dramatically.

WireGuard is nice but needs 2FA support. Until then it can’t be used in various corporate road warrior scenarios. Also until Cisco, Juniper, etc add WireGuard support and enough devices are deployed with it, IPsec will remain the corporate tool of choice when connecting between different organisations. Within the same org, where you have greater control of the equipment used, WireGuard is a bit more feasible.

What you're describing (authentication/2FA) should be handled by a client application. VPN client software should handle authentication/authorization with the corporate VPN server. Once it's authenticated, it can exchange/generate the public-private keys used for the WireGuard tunnel. The VPN client then installs those keys and starts the tunnel. After that, it's up to the client and server VPN software to handle session timeouts, reconnections, host machine security policies, etc etc. None of that is the job of WireGuard itself.
Post reply on HN