Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard Gives Linux a Faster, More Secure VPN

wired.com

Post reply on HN
Print view View original

181–190 of 306 posts

Re: WireGuard Gives Linux a Faster, More Secure VPN

#181

Post by [deleted] »

grumblez wrote: post #161
kortilla wrote: post #156

Earlier quoted context omitted.

If it’s replacing an ipsec mesh that’s pretty hard to believe. And if that was the issue and commercial support couldn’t even identify that as the cause, ZeroTier has bigger issues.

If all sites are behind symmetric NATs, there's not much ZeroTier could do to help aside from telling him to assign direct mappings on the NAT/Firewall to each ZT instance. Symmetric NATs are antithetical to peer to peer communication. Many I've run across in the wild have special rules to handle IPSec which won't exist for other lesser known protocols. It's also possible the user wasn't willing or able to make netwo…

[deleted]

Re: WireGuard Gives Linux a Faster, More Secure VPN

#182

Post by lazyier »

lnenad wrote: post #126
lazyier wrote: post #79

Earlier quoted context omitted.

> Could this be a positive change? It's normal and expected evolution of protocols and software. Generation 1: New idea, new implementation. As people become comfortable with the new idea it gains in acceptance and hype. Try to keep it simple and fast, but it's a exercise in exploration and it gains technical debt faster then it gains new features. Generation 2: Widespread acceptance and commercialization. Groups ins…

Generation 4: Bloat the software with so many unnecessary features, the users must want to chat with each other no?

There isn't any generation 4. The functionality of the software is ubiquitous by that point. Nobody cares anymore except when they absolutely have no other choice. By that point even if you generated a brand new implementation you would struggle to give it away unless it was just one small part of a new innovation.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#183

Post by pvg »

upofadown wrote: post #179
jandrese wrote: post #140

Earlier quoted context omitted.

In the cryptography world backwards compatibility is basically "let the adversary switch me back to the old and busted protocol so I can be owned even after I upgraded to the latest version."

Most required upgrades do not involve anything "busted". Weaknesses are often noticed long before any practical attacks are available. If you want to upgrade, say, Wireguard in such a case you would have to switch over the endpoints in pairs. Obviously that is going to be impossible in practice so the system will get backward compatibility grafted on in a fragile and dangerous way. OpenPGP is an example of a case whe…

You can straight up google 'pgp' and 'downgrade attack' so maybe that's not that great an example.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#184

Post by api »

beached_whale wrote: post #180
api wrote: post #167

Earlier quoted context omitted.

Someone else said broadcast/multicast, so I'll also add communication with legacy systems that don't speak IP or have other wacky requirements. These do exist in industrial and embedded settings. It's a niche use case but it's very useful there.

I suspect Novel/IPX is still out there

Yes, and more. Check out what runs on factory floors sometime. There's stuff that speaks naked Ethernet, as in you type the MAC of the machine into the application. There's also stuff that speaks CANbus over Ethernet without IP in the middle.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#185

Post by grumblez »

pathseeker wrote: post #178
grumblez wrote: post #161

Earlier quoted context omitted.

If all sites are behind symmetric NATs, there's not much ZeroTier could do to help aside from telling him to assign direct mappings on the NAT/Firewall to each ZT instance. Symmetric NATs are antithetical to peer to peer communication. Many I've run across in the wild have special rules to handle IPSec which won't exist for other lesser known protocols. It's also possible the user wasn't willing or able to make netwo…

ZeroTier uses UDP. That's hardly "lesser known" than IPSec.

"lesser known" as in protocols such as IPSec, ZeroTier, WireGuard, etc. Of which IPSec has been around forever and many NATs/Firewalls have special handling rules built in, just as @api mentioned in another comment. Yes, ZeroTier uses UDP underneath, but that doesn't mean symmetric NATs don't/won't cause havoc to peer to peer protocols using UDP.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#186

Post by tptacek »

rcxdude wrote: post #146
tptacek wrote: post #85

Earlier quoted context omitted.

It's true that the WireGuard ecosystem needs these features. But it's also true that people believe VPN software needs lots of features because other VPNs are complex; people do not generally believe these things about SSH, and WireGuard makes VPN tunnels as easy to manage as SSH. Another thing people might not realize if they haven't had to deal with lots of different VPN configurations is that most of the "user man…

> Ultimately, organizations should be tying their VPNs, like everything else, into an IdP of some sort, and most of the "user management" and "MFA" stuff belongs to the IdP, not the VPN. People will clearly get WireGuard integrated into Okta. Right, but at the moment this integration does not exist.

I'm not disputing that.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#188

Post by cpach »

api wrote: post #184
beached_whale wrote: post #180

Earlier quoted context omitted.

I suspect Novel/IPX is still out there

Yes, and more. Check out what runs on factory floors sometime. There's stuff that speaks naked Ethernet, as in you type the MAC of the machine into the application. There's also stuff that speaks CANbus over Ethernet without IP in the middle.

Wow. Had no idea. Fascinating!

Re: WireGuard Gives Linux a Faster, More Secure VPN

#189

Post by Avamander »

wahern wrote: post #168
Avamander wrote: post #157

Earlier quoted context omitted.

This is why I abandoned using it, knowing the average quality of an online article I couldn't trust that the configuration was secure and there were no official very secure templates.

This is a problem with the IKE implementation. A secure IPSec configuration on OpenBSD is a single line, and you can copy+paste it from the excellent man page. Part of what makes WireGuard "simple" is that it doesn't support any kind of key management--i.e. PKI. Instead you're expected to copy keys around manually. IKE is the most complex part of the IPSec software stack but in many ways the most important part. Iron…

> on OpenBSD is a single line

Nice, but it would be nice to know if that is the default or not on Linux as well.

I don't agree with the claim that IPSec somehow automates PKI, it's still very disgusting compared to things like (LetsEncrypt's) ACME. I really hated the PKI on Linux, especially when trying to revoke old keys than on Wireguard. The fact that clients also differed heavily in what they supported was also very annoying.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#190

Post by hendersoon »

RcrdBrt wrote: post #158
josteink wrote: post #107

WireGuard is nice and fast indeed, but unusable for me at work, because pretty much all outbound UDP-traffic is filtered. Having a TCP-based option sure would be nice.

I use wireguard on top of udp2raw to power through UDP-blocking firewalls all the time https://github.com/wangyu-/udp2raw-tunnel Added bonus: it's not TCP

What a cool solution! Thanks for linking it.
Post reply on HN