I think Tailscale [1] can be to WireGuard what Github and Gitlab are to git. If you haven’t checked them out yet: worth taking a look! [1] https://tailscale.com
What is the difference between this and ZeroTier? https://www.zerotier.com/
WireGuard Gives Linux a Faster, More Secure VPN
131–140 of 306 posts
Re: WireGuard Gives Linux a Faster, More Secure VPN
#132Earlier quoted context omitted.
Last time I talked to him about it, Jason Donenfeld was not upset about Tailscale. You'll have to find someone else to be vicariously outraged for.
Of course I am sure he is extremely happy spending 5 years developing the next big thing then others rebrand it for enterprise and become rich.
You realise most VPN providers offer OpenVPN (for years) and now Wireguard support right? Some bundle the software & drivers on their own GUI. I'm happily using a paid OpenVPN client for mac (won't name it here to avoid upsetting you further) for years.
What I'm trying to say is that tailscale is doing nothing new or sinister.
Re: WireGuard Gives Linux a Faster, More Secure VPN
#133I think Tailscale [1] can be to WireGuard what Github and Gitlab are to git. If you haven’t checked them out yet: worth taking a look! [1] https://tailscale.com
What do you gain by shilling for alpha-tier for-profit software for free? Are they your friends? do they pay you for that?
Re: WireGuard Gives Linux a Faster, More Secure VPN
#134Earlier quoted context omitted.
If that is the case, it looks like Ubuntu 19.10 and later have support. https://packages.ubuntu.com/search?keywords=network-manager&...
if it does, I don't see "how"
I don't know try to type "Wireguard NetworkManager Ubuntu" in your favorite search engine?
https://blogs.gnome.org/thaller/2019/03/15/wireguard-in-netw...
Re: WireGuard Gives Linux a Faster, More Secure VPN
#135Check out Algo [0] if you're interested in setting up a personal WireGuard VPN server. It's simple and hassle-free, especially if you are not familiar with server administration and don't want to be bogged down by details.
I have one deployed on Digital Ocean ($5/mo droplet). All you need to do is run the setup script, answer a few yes/no questions (optional features), paste in your API key, and update the firewall setting on Digital Ocean's dashboard.
If anything goes wrong, deploying a new one only takes minutes.
Re: WireGuard Gives Linux a Faster, More Secure VPN
#136Are there any official plans for 2FA in Wireguard?
I think at this time, the only option you'd have is a captive portal for the 2FA, and then unfirewall the in-VPN IP. WG has no provision for "connection state", only "handshake happened X seconds ago". If there's no traffic, there's no handshake.
Re: WireGuard Gives Linux a Faster, More Secure VPN
#137What I don't like about WireGuard: - Basically no real user or admin-oriented docs. There's some example configs and some getting started guides, and then some crypto-nerd look-how-secure-our-algorithms-are docs, but no real guidance on how to set up a reasonably simple network of hosts. - Authentication/authorization is just IP addresses and public keys? What about users and service accounts that you want to rotate…
WireGuard is a networking primitive. It creates a secure tunnel between two points and only contains the things necessary to make that happen.
The rest of what you're asking for can be implementing on top of WireGuard in external tools and I fully expect will be over the next few years seeing the adoption so far.
And given you mentioned SSH... That's basically what it is, yes, layer 3 forwarding over SSH except done in a way that's actually usable. (For issues, see e.g., http://sites.inka.de/bigred/devel/tcp-tcp.html)
This is a step back towards the unix philosophy of providing simple pieces that can be stacked together to build more complicated things, not a drop-in replacement for OpenVPN et al. Most of us are excited because (1) not everyone is an enterprise, and that "we need everything and the kitchen sink" philosophy makes OpenVPN annoying to work with for everyone else and (2) we'll probably see a lot more options cropping up in this space soon built around WireGuard now that developers have been given a secure primitive to build upon.
Re: WireGuard Gives Linux a Faster, More Secure VPN
#138What I don't like about WireGuard: - Basically no real user or admin-oriented docs. There's some example configs and some getting started guides, and then some crypto-nerd look-how-secure-our-algorithms-are docs, but no real guidance on how to set up a reasonably simple network of hosts. - Authentication/authorization is just IP addresses and public keys? What about users and service accounts that you want to rotate…
If you want SSO, or fine grained access control, the idea is you would do that at a level above wireguard. For example, I'm prototyping a small CLI that talks to hashicorp vault via OIDC/OAuth2, and then creates a wireguard key pair + configuration locally, submits the public key to vault, and then the wireguard "server" is configured with a simple daemon that pulls all the public keys from vault and generates a wire…
Are you going to open source it?
Re: WireGuard Gives Linux a Faster, More Secure VPN
#139I think Tailscale [1] can be to WireGuard what Github and Gitlab are to git. If you haven’t checked them out yet: worth taking a look! [1] https://tailscale.com
What do you gain by shilling for alpha-tier for-profit software for free? Are they your friends? do they pay you for that?
Accusing someone of shilling is contrary to HN comment guidelines.
"Please don't post insinuations about astroturfing, shilling, brigading, foreign agents and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email us and we'll look at the data."
Re: WireGuard Gives Linux a Faster, More Secure VPN
#140Earlier quoted context omitted.
This is the opposite of what cryptography engineers believe today.
Which ones? How do they suggest that cryptographic upgrades occur?
In the cryptography world backwards compatibility is basically "let the adversary switch me back to the old and busted protocol so I can be owned even after I upgraded to the latest version."