Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard Gives Linux a Faster, More Secure VPN

wired.com

Post reply on HN
Print view View original

121–130 of 306 posts

Re: WireGuard Gives Linux a Faster, More Secure VPN

#121

Post by smush »

TL;DR: Should I keep fussing with PiVPN or try something like TincVPN?

Semi-OT: So I just installed PiVPN to use with this protocol to try and do a small vpn at home (all I want is to go to my domain, auth, and be on my LAN so I can RDP / VNC) and the wireguard bits worked great, and the install process was buttery smooth, even on a Raspbery Pi Zero W.

But - my network lack of knowledge is probably hamstringing me. I opened the WG port on my router and confirmed the dns hostname I'm using corresponds to the public IP, but I'm not able to get the wireguard clients to connect. The tcpdump doesn't show any incoming traffic on the port at all.

Should I keep fussing with PiVPN or try something like TincVPN or Tailscale? I have not been able to get a VNC or RDP session going over tailscale even though all my machines are able to connect to the Tailscale network.

I want to use wireguard, everyone says it is so good, and OpenVPN does seem a bit boring, but ultimately I'm just hitting a wall when it comes to the use case of 'auth, you are on your home lan, connect as if you are at home connected to wifi'

Re: WireGuard Gives Linux a Faster, More Secure VPN

#122

Post by LinuxBender »

dragonsh wrote: post #4

I hope WireGuard can come to feature parity with TincVPN will be nice. Especially automatic routing and mesh VPN formation, it can really help our multi-cloud container clusters connected using TincVPN to be bit more performant. The difference is WireGuard is part of Linux kernel so speed of processing packets is faster than TincVPN. Still experimenting with WireGuard and manually creating peer to peer mesh.

One suggestion would be to submit a feature request to Tinc to add detection / support of Wireguard. Tinc could still handle the mesh routing and just hand off the encryption bits to WG. There have been some brief discussion in email threads [1] Probably more, have not checked all the archives.

[1] - https://www.tinc-vpn.org/pipermail/tinc/2017-February/004755...

Re: WireGuard Gives Linux a Faster, More Secure VPN

#123

Post by ecnahc515 »

0xbadcafebee wrote: post #60

What I don't like about WireGuard: - Basically no real user or admin-oriented docs. There's some example configs and some getting started guides, and then some crypto-nerd look-how-secure-our-algorithms-are docs, but no real guidance on how to set up a reasonably simple network of hosts. - Authentication/authorization is just IP addresses and public keys? What about users and service accounts that you want to rotate…

If you want SSO, or fine grained access control, the idea is you would do that at a level above wireguard. For example, I'm prototyping a small CLI that talks to hashicorp vault via OIDC/OAuth2, and then creates a wireguard key pair + configuration locally, submits the public key to vault, and then the wireguard "server" is configured with a simple daemon that pulls all the public keys from vault and generates a wireguard configuration allowing access from those public keys.

This is a simple example, but much of what you need to do can be done with layers on top. This is similar to iptables, in that you can use `firewalld`, or `UFW` which all use iptables under the hood.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#125

Post by eeZah7Ux »

jerf wrote: post #84
trey-jones wrote: post #29

Earlier quoted context omitted.

I think Opinionated can be good. I think configurable can be good too. I think the best case is nearly always "Configurable, with smart defaults" meaning defaults that work out of the box for most uses. Definitely programming languages are on the periphery of this conversation, but I think provide some good examples of why I like opinionated tools in general. My language of choice right now is Go, and has been for a…

"My language of choice right now is Go, and has been for a while. One of the things I like about it is that it's a bit opinionated." I've frequently described Go as a very, very good 1990s language. Going through the process of maturity takes time. You can't have a "very, very good" 2020s language right now, because at the frontier we're still feeling our way through the issues. (Remember, whatever you're about to hi…

> I've frequently described Go as a very, very good 1990s language

No, go is quite similar to algol68 and adds little to it.

http://lua-users.org/lists/lua-l/2009-11/msg00576.html

> I believe probably >75% of the hatred Go engenders is from people afraid that Go's success will erase or invalidate the 2010s/2020s languages they prefer

No, it invalidates 30 years of research on programming languages, regardless of implementations.

http://nomad.uk.net/articles/why-gos-design-is-a-disservice-...

EDIT: 5 minutes in and it's already a downvote fest.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#126

Post by lnenad »

lazyier wrote: post #79
fivesixzero wrote: post #13

Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…

> Could this be a positive change? It's normal and expected evolution of protocols and software. Generation 1: New idea, new implementation. As people become comfortable with the new idea it gains in acceptance and hype. Try to keep it simple and fast, but it's a exercise in exploration and it gains technical debt faster then it gains new features. Generation 2: Widespread acceptance and commercialization. Groups ins…

Generation 4: Bloat the software with so many unnecessary features, the users must want to chat with each other no?

Re: WireGuard Gives Linux a Faster, More Secure VPN

#128

Post by upofadown »

tptacek wrote: post #110
upofadown wrote: post #81

Earlier quoted context omitted.

Opinionated is great as long as it allows for future backwards compatibility. This sort of thing is critical for things like this that depend on cryptography. There has to be a way to support the old thing at the same time as the new thing when it looks like the old thing might eventually have to be swapped out. There has to be a way to do the transition.

This is the opposite of what cryptography engineers believe today.

Which ones? How do they suggest that cryptographic upgrades occur?

Re: WireGuard Gives Linux a Faster, More Secure VPN

#130

Post by jlgaddis »

Hello71 wrote: post #99
sbradford26 wrote: post #53

Earlier quoted context omitted.

CVEs mean that a company can take action to mitigate a vulnerability. Wireguard is not mature enough to have something like that. A known vulnerability is bad, but not nearly as bad as an unknown vulnerability. This is not a knock on Wireguard, I use wireguard and love it. It just has several hoops to jump through before it is ready for widespread adoption. Like NIST approving it to be used instead of IPsec or OpenVP…

my point is that it would appear that "Anyconnect Secure Mobility Client" has a shitton of vulnerabilities. sure, wireguard may have some vulnerabilities, but you don't need a formal audit to tell the difference between "this might have some issues" and "holy fuck this is a fucking dumpster fire". you need an audit to tell if "this might have some issues" is "this has some issues" or "this is actually pretty good". i…

I'm sure you know this but, for the benefit of others...

With this exception, WireGuard does not CVEs because it is (for now) still considered pre-release software and not recommended for production use.

Post reply on HN