Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard Gives Linux a Faster, More Secure VPN

wired.com

Post reply on HN
Print view View original

111–120 of 306 posts

Re: WireGuard Gives Linux a Faster, More Secure VPN

#111

Post by e12e »

Vysero wrote: post #96
e12e wrote: post #47

Earlier quoted context omitted.

> Does that mean I will be able to open a terminal an type: WireGuard and from then on my connection to the internet will be secure It's more like how iptables/nftables is part of the kernel. You need a recent kernel along with user space tooling. But it will become part of virtually every Linux distribution. As for "my connection to the internet will be secure" - that's possible, but the main use case right now is "…

This may sound like a newb question but.. is my connection to my vpn/server not already secure on Linux?

Wireguard is one way to secure your connection to another machine. That machine could be a "VPN server" - which typically mean one of two things:

1) By connecting to that server, you get access to private resources as if you were on the same network. Say, access to a printer, a web camera or a file server that aren't exposed to the Internet.

2) You gain access to the Internet through that server, so that your publically visible IP changes. This prevents anyone between you and the server to see the content of your traffic (eg: your isp, the hotel it staff that runs your free wifi). It can also grant you access to resources that are exposed to the internet - but filter access based on IP. Such as a CRM system, or webmail system.

If you are connecting to a VPN server, then, by definition (virtual private network) - your connection should be secure. Wireguard is one way in which that access can be secured - and it's new/modern, simple and widely regarded as following best practices. Alternatives are ipsec via eg strongswan, OpenVPN and a bunch of nasty proprietary solutions constructed out of mixes of libssl and obscure hedge magic.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#113

Post by julesallen »

josteink wrote: post #107

WireGuard is nice and fast indeed, but unusable for me at work, because pretty much all outbound UDP-traffic is filtered. Having a TCP-based option sure would be nice.

Yes, this is a concern as as I'm testing it as a daily driver there are quite a few public networks it won't work with. For non technical end users it's a show stopper.

Without TCP/IP you're back to running dual wg and ovpn services and pretty much where we are with ip4 vs. 6. One is 'better' but the other works everywhere.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#114

Post by xxpor »

josteink wrote: post #107

WireGuard is nice and fast indeed, but unusable for me at work, because pretty much all outbound UDP-traffic is filtered. Having a TCP-based option sure would be nice.

I'd be fairly confident your work doesn't want people making random VPN tunnels from their work laptops.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#115

Post by kelnos »

fivesixzero wrote: post #13

Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…

Ideally, things should be opinionated but configurable. I think of that as having good, sane defaults, with a straightforward initial setup that doesn't revolve around tweaking those defaults.

With a security product, however, I can understand the allure of offering few to no options. Laypeople get security wrong at an alarming rate, even with good defaults, so I often don't mind a security product just offering one configuration that the (presumable) security experts who built it have decided is the right way to use it.

Of course, if they turn out to be wrong about something, and a mitigation would be "disable feature X", then this requires a patch and new release, when it might have otherwise just required a configuration change.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#116

Post by hectorm »

In the case that someone has any trouble configuring WireGuard, I would like to share my automatic deployment of WireGuard and Unbound with full IPv4 and IPv6 support with Packer and Terraform in Hetzner Cloud (although it can be easily adapted to other providers) [1].

In the case that no automatic deployment is necessary, it may also be useful to look directly at the WireGuard configuration [2]. Since WireGuard supports scripts in "PostUp" and "PostDown", I have automated the configuration of iptables, including some useful rules to redirect 53/UDP port traffic from the public interface to WireGuard, which helps in some cases to bypass some firewalls.

[1]: https://github.com/hectorm/wireguard-setup

[2]: https://github.com/hectorm/wireguard-setup/blob/master/packe...

Re: WireGuard Gives Linux a Faster, More Secure VPN

#117

Post by Hikikomori »

tptacek wrote: post #87
sbradford26 wrote: post #53

Earlier quoted context omitted.

CVEs mean that a company can take action to mitigate a vulnerability. Wireguard is not mature enough to have something like that. A known vulnerability is bad, but not nearly as bad as an unknown vulnerability. This is not a knock on Wireguard, I use wireguard and love it. It just has several hoops to jump through before it is ready for widespread adoption. Like NIST approving it to be used instead of IPsec or OpenVP…

I don't know what this means but can't think of an interpretation that isn't false. WireGuard will certainly do a better job mitigating vulnerabilities than Cisco will, and WireGuard's code will for obvious reasons get more attention than Cisco's horrible VPN code. It's true that Fortune 500 companies aren't going to deploy WireGuard. They're constitutionally incapable of deploying security gear that isn't awful, whi…

Will take another look at wg once keys can be stored in non-exportable way on devices, or temporary keys generated per session after passing some auth mechanism. Sounds like a fun personal project.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#118

Post by mindslight »

blattimwind wrote: post #90
Diederich wrote: post #36

Earlier quoted context omitted.

> 70+ node full-mesh vpn ~2^70 VPN connections?

Wireguard is not connection based, so a full-mesh VPN with n nodes essentially just means each node has n-1 peer keys and maintains a routing table with n-1 entries for the VPN.

There are still 70x69/2 connections going on under the hood. You can't completely ignore that complexity - if there are underlying connectivity issues, specific host-host traffic will fail (eg due to NAT).

My wireguard setup actually has n x (n-1) config files/instances (current n=8), as that's the only way to shuffle default-gateways over it. It's a little unwieldy, but still manageable. Whereas I can't imagine doing the same with OpenVPN.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#119

Post by PhilippGille »

dragonsh wrote: post #4

I hope WireGuard can come to feature parity with TincVPN will be nice. Especially automatic routing and mesh VPN formation, it can really help our multi-cloud container clusters connected using TincVPN to be bit more performant. The difference is WireGuard is part of Linux kernel so speed of processing packets is faster than TincVPN. Still experimenting with WireGuard and manually creating peer to peer mesh.

For WireGuard there's the official https://github.com/WireGuard/wg-dynamic, or also this: https://github.com/costela/wesher.

Or generally for mesh networks as others mentioned: Slack's Nebula, ZeroTier (wait for v2) or Tailscale.

Post reply on HN