WireGuard Gives Linux a Faster, More Secure VPN • Hacker News Board

Re: WireGuard Gives Linux a Faster, More Secure VPN

#81

Post by upofadown » Mon, Mar 02, 2020, 5:09 PM UTC

fivesixzero wrote: post #13

Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…

Opinionated is great as long as it allows for future backwards compatibility. This sort of thing is critical for things like this that depend on cryptography. There has to be a way to support the old thing at the same time as the new thing when it looks like the old thing might eventually have to be swapped out. There has to be a way to do the transition.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#82

Post by blattimwind » Mon, Mar 02, 2020, 5:11 PM UTC

Znafon wrote: post #67

blattimwind wrote: post #37

Earlier quoted context omitted.

What they want to do, cannot be done by Wireguard, because Wireguard does not have the concept of "VPN sessions / connections". What they probably need to do is to assign each customer a fixed private IP for use within their VPN, e.g. from 10.0.0.0/8. When those are not enough any more, they need to segment their VPN, so they can re-use the private IP space in each segment. w.r.t. to "NeuroRouting and TrackStop not p…

This is a common critic of WireGuard, but it looks like those service are looking for excuses to explain why they don't propose WireGuard yet. As far as I understang it: > What they probably need to do is to assign each customer a fixed private IP for use within their VPN, e.g. from 10.0.0.0/8. Actually, they can set a different IP for each session and rotate them by given it to the client out of band, for example wh…

> Actually, they can set a different IP for each session and rotate them by given it to the client out of band, for example when it authenticates to the service.

Like I said, Wireguard does not have the concept of sessions. You could add your own proprietary "stuff" around Wireguard to add that concept, but then you don't need anything extra from Wireguard. You add the keys of the users as part of the session setup and remove them when the session is destroyed. Of course, this means that clients have to use a client tool provided by you.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#83

Post by danielneri » Mon, Mar 02, 2020, 5:12 PM UTC

Been using this thru Streisand [https://github.com/StreisandEffect/streisand] and can honestly say it is an excellent experience. Would highly recommend deploying through Streisand / Ubuntu 16 if you'd like to experiment (and run a production setup!)

Re: WireGuard Gives Linux a Faster, More Secure VPN

#84

Post by jerf » Mon, Mar 02, 2020, 5:13 PM UTC

trey-jones wrote: post #29

fivesixzero wrote: post #13

Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…

I think Opinionated can be good. I think configurable can be good too. I think the best case is nearly always "Configurable, with smart defaults" meaning defaults that work out of the box for most uses. Definitely programming languages are on the periphery of this conversation, but I think provide some good examples of why I like opinionated tools in general. My language of choice right now is Go, and has been for a…

"My language of choice right now is Go, and has been for a while. One of the things I like about it is that it's a bit opinionated."

I've frequently described Go as a very, very good 1990s language. Going through the process of maturity takes time. You can't have a "very, very good" 2020s language right now, because at the frontier we're still feeling our way through the issues.

(Remember, whatever you're about to hit reply with and try to contradict me about it being a totally smooth and polished 2020s language that's already here is also an assertion that your example basically has no room for improvement and will not improve in the next 10-20 years. Consider your options carefully before you go too "language partisan" here.)

I believe probably >75% of the hatred Go engenders is from people afraid that Go's success will erase or invalidate the 2010s/2020s languages they prefer, because otherwise, the solution to most of these people's hate/anxiety would be to just ignore Go. To which I can say to those people, you can stop worrying. It won't. And if you stay in the industry long enough, maybe someday you'll get to use the really good and polished 2010s or 2020s language. No idea what it'll be called. And you can similarly assuage the fears of the day that this new language will erase all the benefits of the 2040s languages in development at the time.

But for "opinionated" to really work, I think you intrinsically need to have years of experience to make the right calls. There's no realistic chance that we could have gone straight to the "correct" VPN choice in one shot. Too many variables, too many dimensions, too much to learn and know about the security. It's just not possible. We collectively need the decades.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#85

Post by tptacek » Mon, Mar 02, 2020, 5:18 PM UTC

Sesse__ wrote: post #52

deepersprout wrote: post #8

Earlier quoted context omitted.

> While I don't believe WireGuard is a drop in replacement for IPsec tunnels or OpenVPN Why?

There's no predefined way of setting up and sharing keypairs, for one. As a company end user logging into a VPN, what you want is a place to input your username and password (and potentially 2FA credentials), not “create a keypair and give the public key to an admin”.

It's true that the WireGuard ecosystem needs these features. But it's also true that people believe VPN software needs lots of features because other VPNs are complex; people do not generally believe these things about SSH, and WireGuard makes VPN tunnels as easy to manage as SSH.

Another thing people might not realize if they haven't had to deal with lots of different VPN configurations is that most of the "user management" and "2FA" features of legacy VPNs are, as the kids say, janky "AF".

Ultimately, organizations should be tying their VPNs, like everything else, into an IdP of some sort, and most of the "user management" and "MFA" stuff belongs to the IdP, not the VPN. People will clearly get WireGuard integrated into Okta.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#86

Post by nif2ee » Mon, Mar 02, 2020, 5:18 PM UTC

tptacek wrote: post #73

nif2ee wrote: post #20

Earlier quoted context omitted.

I am sick of people shilling to this thing here. Stop exploiting HN for free advertising. Every Wireguard post here has become a free ad for this company. EDIT: Stop supporting parasites repackaging and rebranding open source and selling it while leaving the author who single handedly made this entire thing possible begging for donations on Patreon

Last time I talked to him about it, Jason Donenfeld was not upset about Tailscale. You'll have to find someone else to be vicariously outraged for.

Of course I am sure he is extremely happy spending 5 years developing the next big thing then others rebrand it for enterprise and become rich.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#87

Post by tptacek » Mon, Mar 02, 2020, 5:20 PM UTC

sbradford26 wrote: post #53

Hello71 wrote: post #40

Earlier quoted context omitted.

this cisco anyconnect system? https://www.cvedetails.com/vulnerability-list/vendor_id-16/p... doesn't seem very secure to me.

CVEs mean that a company can take action to mitigate a vulnerability. Wireguard is not mature enough to have something like that. A known vulnerability is bad, but not nearly as bad as an unknown vulnerability. This is not a knock on Wireguard, I use wireguard and love it. It just has several hoops to jump through before it is ready for widespread adoption. Like NIST approving it to be used instead of IPsec or OpenVP…

I don't know what this means but can't think of an interpretation that isn't false. WireGuard will certainly do a better job mitigating vulnerabilities than Cisco will, and WireGuard's code will for obvious reasons get more attention than Cisco's horrible VPN code.

It's true that Fortune 500 companies aren't going to deploy WireGuard. They're constitutionally incapable of deploying security gear that isn't awful, which is why a huge fraction of all VPN deployments through the F500 were backdoored in the 2000s.

NIST is never going to approve WireGuard; it's not even a discussion worth having, nor is it NIST's place to certify which VPNs are or aren't safe to use, nor does NIST have the staff to do anything like that.

That's no reason for startup engineers to make the same mistake. Startups definitely do deploy WireGuard.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#88

Post by tptacek » Mon, Mar 02, 2020, 5:22 PM UTC

nif2ee wrote: post #86

tptacek wrote: post #73

Earlier quoted context omitted.

Last time I talked to him about it, Jason Donenfeld was not upset about Tailscale. You'll have to find someone else to be vicariously outraged for.

Of course I am sure he is extremely happy spending 5 years developing the next big thing then others rebrand it for enterprise and become rich.

Jason comments here all the time and is quite easy to talk to, and I think we're all better off hearing from real Jason, not some imaginary angry Jason you've invented. Not least because there are actual abuses in the WireGuard ecosystem, and your imaginary Jason is obscuring them behind fake abuses.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#89

Post by tptacek » Mon, Mar 02, 2020, 5:23 PM UTC

aeyes wrote: post #65

Are there any official plans for 2FA in Wireguard?

My understanding is that the plan for WireGuard is to nail the engine and present a clean interface to system integrators, who will build their own authentication systems on top of it. The most sensible way to do MFA for WireGuard is probably though an IdP.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#90

Post by blattimwind » Mon, Mar 02, 2020, 5:24 PM UTC

Diederich wrote: post #36

sigio wrote: post #34

Earlier quoted context omitted.

If you have the right config-files setup, it's a matter of typing 'wg-quick up ' ... and then you will have a VPN up. Bring it down again with 'wg-quick down '. The configs itself are basically just the IP's used, and the peers and keys used to communicate with those peers. (Running a 70+ node full-mesh vpn)

> 70+ node full-mesh vpn ~2^70 VPN connections?

Wireguard is not connection based, so a full-mesh VPN with n nodes essentially just means each node has n-1 peer keys and maintains a routing table with n-1 entries for the VPN.