Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is now in Linus' tree

lists.zx2c4.com

Post reply on HN
Print view View original

241–250 of 293 posts

Re: WireGuard is now in Linus' tree

#241

Post by stjohnswarts »

treesknees wrote: post #228
Diederich wrote: post #58

Earlier quoted context omitted.

I've been using WireGuard on my Android phone for a good while now using a free digital ocean droplet via https://github.com/trailofbits/algo It's fast. It's easy. You never have to think about it. It just works.

I also do this, but with Linode. The only hangup I hit every once in a while is that some services will block access to VPS IP blocks due to spam/malicious traffic. E.g. occasionally I can't get Google search results while on VPN, or Pokemon Go won't connect as they block VPS providers to prevent spoofing.

I see a lot more capchas which is annoying. Also paypal doesn't seem to work most of the time either, which is lame, as I use 2FA for any paypal transaction

Re: WireGuard is now in Linus' tree

#242

Post by hwh »

0ld wrote: post #126

Since a couple of years I've been running iked [0] on my VPSed OpenBSD. It took me around 5 minutes to setup and it "just works" since then with my iPhone and MacOS clients out of the box, not requiring any additional software. But since WG is getting so high praise here, I'm now interested what are WG advantages and what does WG have to justify the effort to move away from iked and install/setup the client software…

For me it's just easier to get my head around having a new network interface presented rather than this pile of security associations and transform configurations. I can just re-use my firewalling and routing knowledge and do not have to put my mind into IPsec mode to manage this. That aside, I think it's still quite a lot easier to use IPsec tooling when you want something that plays along with certificate based multi-level trust models.

Re: WireGuard is now in Linus' tree

#243

Post by zantana »

TimTheTinker wrote: post #67
Diederich wrote: post #58

Earlier quoted context omitted.

I've been using WireGuard on my Android phone for a good while now using a free digital ocean droplet via https://github.com/trailofbits/algo It's fast. It's easy. You never have to think about it. It just works.

> using a free digital ocean droplet I can't seem to find any "free" option on their pricing page. Could you elucidate?

I saw this from IBM which doesn't appear to even need a credit card. :0 https://www.ibm.com/cloud/free/ But I haven't checked it out yet.

I think that Azure and GCE have better free tiers than AWS, but I'm guessing the bandwidth metering may work against a vpn use.

Re: WireGuard is now in Linus' tree

#244

Post by stjohnswarts »

braindeath wrote: post #25
3xblah wrote: post #19

Earlier quoted context omitted.

Your home has publicly accessible^1 IP address Or you are using a third party-controlled server with direct internet access to make home IP accessible 1. No ISP firewall blocking unsolicited incoming traffic Do you configure WG to use persistent keepalives

In the US for home connections (cable, fiber, DSL) everybody gets an accessible IP address pretty much -- the worst is that some ports are blocked like port 80 or 25. Phones don't get a dedicated IPv4.

You can usually get companies to drop the blocked ports though if you call customer service.

Re: WireGuard is now in Linus' tree

#245

Post by stjohnswarts »

bitexploder wrote: post #88

WireGuard is cool and we really like it at our company (a bunch of infosec consultants). The management of it for an even small number (20) of users is a no-go. OpenVPN is ultra reliable and provides legit 2FA options when set up well. I look forward to legit management tools and improvements. For personal use it has been great. Much simpler than OpenVPN for a few (3) users.

Those will be widespread eventually, it's still relatively new, just hitting Linux mainstream kernel dev, so probably 2 or 3 years before tried and proven management tools come out.

Re: WireGuard is now in Linus' tree

#247

Post by adevx »

matthewaveryusa wrote: post #214
adevx wrote: post #150

Fantastic news. I deploy WireGuard to provide a private network (mesh) between VPS servers. Each VPS instance has each other vps as peer. So no single source of failure. I run PostgreSQL with Patroni and GlusterFS over this mesh with no issues. When I add or destroy a VPS with Ansible all VPS nodes get an updated config and reload. This way I don't rely on a single cloud provider because I do not use their private ne…

Can you talk a bit more about your setup with patroni, postgresql and glusterFS. Are you running postgres on a glusterfs? How well does that work? From my experience file locking on a distributed filesystem is either not implemented correctly or has piss-poor performance -- and databases use them

I run a distributed Node.js Express app that has a media folder mounted (fuse) across all node instances. GlusterFS runs with replicated volumes. As GlusterFS is not super fast, I use an Nginx cache in front of all media files. (I should probably use a CDN) PostgreSQL does not run over GlusterFS for the reasons you mentioned. For ease of configuration each node has an HAProxy instance that knows where the master PostgreSQL instance lives. Patroni as well as the Node.js (typescript) app uses Consul for leader election.

Re: WireGuard is now in Linus' tree

#248

Post by fulafel »

hwh wrote: post #239
fulafel wrote: post #210

Earlier quoted context omitted.

IPsec also supports this - give certs signed by a mutually tusted CA to all nodes and they can all communicate host-to-host in a full mesh without needing to reconfigure when adding a host etc.

Can you please elaborate? As far as I see it, IPsec is encrypting traffic. IKE is for setup of security associations. What part of IPsec would do routing, and in this case: potentially multi-hop mesh routing?

IKE obviously does the key management part, it's part of IPsec in this picture.

There is no separate mesh routing in this scenario, everyone just uses normal internet routing and addressing.

Re: WireGuard is now in Linus' tree

#249

Post by LinuxBender »

fulafel wrote: post #210
ZoomZoomZoom wrote: post #168

Earlier quoted context omitted.

As far as I understand, the killer feature of Tinc is automatic mesh routing. You can add a node to one instance and the information spreads through the network, wireguard doesn't do that. Also, I heard maintainers were contemplating replacing the protocol with Wireguard. https://www.tinc-vpn.org/pipermail/tinc/2017-February/004755...

IPsec also supports this - give certs signed by a mutually tusted CA to all nodes and they can all communicate host-to-host in a full mesh without needing to reconfigure when adding a host etc.

What they mean is that with tinc, you can connect from node A to node Z without A and Z being directly connected. Tinc discovers who is connected to whom and will route through nodes to reach one another dynamically in user space.

IPSec by itself can not do this without adding very complex route statements on each node and enabling packet forwarding. Tinc operates in user space and does not require kernel packet forwarding or any destination node specific route statements.

Re: WireGuard is now in Linus' tree

#250

Post by adevx »

PhilippGille wrote: post #223
adevx wrote: post #150

Fantastic news. I deploy WireGuard to provide a private network (mesh) between VPS servers. Each VPS instance has each other vps as peer. So no single source of failure. I run PostgreSQL with Patroni and GlusterFS over this mesh with no issues. When I add or destroy a VPS with Ansible all VPS nodes get an updated config and reload. This way I don't rely on a single cloud provider because I do not use their private ne…

I thought about doing something similar, but with Slack's Nebula or with ZeroTier (v2, which is not released yet). They're specifically designed for this kind of overlay network if I'm not mistaken, taking care of node additions and removals automatically. Nebula with fixed "lighthouses", ZeroTier with a decentralized KV store. Did you look into these as alternatives? https://github.com/slackhq/nebula https://www.zer…

Didn't know about nebula, definitely interesting. I looked into ZeroTier but I believe it has a central control server for connection initiation, and I read some comments about slow connections if I remember correctly.
Post reply on HN