Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard Gives Linux a Faster, More Secure VPN

wired.com

Post reply on HN
Print view View original

201–210 of 306 posts

Re: WireGuard Gives Linux a Faster, More Secure VPN

#201

Post by linsomniac »

cpach wrote: post #152
lapinot wrote: post #142

I really like wireguard, but one thing that bugs me is the fact that it's layer 3 (an ip tunnel) and has no code to support layer 2 (ethernet MAC tunnel). The downside for me is that you have to manage static ips in the configurations (specifically it's not compatible with ipv6 slaac and NDP). There is https://git.zx2c4.com/wg-dynamic but it's very experimental at the moment. The level 3-only tunnel is motivated as "…

Out of curiosity, what is the use case for doing VPN at layer 2?

Pretty much every time I do a migration from one data center or office migration I set up an OpenVPN that bridges the network segments at the two locations. It makes the move so much easier.

Once set up, I can shut down a machine at one location, move it, bring it back up, and it's back in business. There are situations where we might want to migrate to new machines during the move, which this makes no harder. But for many things it makes them easier.

For example, the last move went something like this: Set up the VPN+bridge. Move half the application servers. Set up new firewall/load balancer since we were replacing the old ones. Test the new fw/lb. Physically move the primary database server during a maintenance window and switch over to the new fw/lb. If there were problems, just switch back to the old one via DNS record changes (TTL was lowered weeks earlier). Move the remaining app servers. During the bridging setup, the LBs preferred the local app servers.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#202

Post by blattimwind »

api wrote: post #184
beached_whale wrote: post #180

Earlier quoted context omitted.

I suspect Novel/IPX is still out there

Yes, and more. Check out what runs on factory floors sometime. There's stuff that speaks naked Ethernet, as in you type the MAC of the machine into the application. There's also stuff that speaks CANbus over Ethernet without IP in the middle.

Raw ethernet is nice because you can't send ethernet frames from a web browser.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#203

Post by wahern »

Avamander wrote: post #189
wahern wrote: post #168

Earlier quoted context omitted.

This is a problem with the IKE implementation. A secure IPSec configuration on OpenBSD is a single line, and you can copy+paste it from the excellent man page. Part of what makes WireGuard "simple" is that it doesn't support any kind of key management--i.e. PKI. Instead you're expected to copy keys around manually. IKE is the most complex part of the IPSec software stack but in many ways the most important part. Iron…

> on OpenBSD is a single line Nice, but it would be nice to know if that is the default or not on Linux as well. I don't agree with the claim that IPSec somehow automates PKI, it's still very disgusting compared to things like (LetsEncrypt's) ACME. I really hated the PKI on Linux, especially when trying to revoke old keys than on Wireguard. The fact that clients also differed heavily in what they supported was also v…

> Nice, but it would be nice to know if that is the default or not on Linux as well.

It's because OpenBSD uses a much nicer, more declarative configuration file syntax, whereas the options on Linux, like Openswan, use a less expressive key-value syntax. To be fair, AFAIU Openswan supports more IKE extensions, and is an older project with more baggage than OpenIKEd or OpenBSD's ipsecctl configuration compiler front-end for isakmpd. But that only highlights the fact that much of the complexity of IPSec is due to history, not because IPSec is intrinsically too complex to make it useable. The SLoC of IPSec kernel code are comparable to the SLoC for WireGuard kernel code. There are smarter ways to implement IPSec and IKE, especially when you have the benefit of hindsight.

> I don't agree with the claim that IPSec somehow automates PKI, it's still very disgusting compared to things like (LetsEncrypt's) ACME

It doesn't automate CA renewal, but you can't even do any kind of PKI using WireGuard as WireGuard doesn't support key signing or key authorities.

FWIW, OpenBSD provides a utility for generating and manipulating X.509 certificates for use with IKE.[1] I've never used it as I'm unfortunately quite familiar with PKIX infrastructure and have my own tools, but AFAIU it's what most people use.

None of this is to say that, when comparing apples to apples, WireGuard isn't a better protocol than IPSec. But SSH also has warts and it would be trivial to come up with a better replacement protocol. We don't need to because we have OpenSSH, a smart implementation that continually discards as much baggage as it can, while still interoperating with a wider ecosystem of alternative implementations.

The fundamental problem is that 1) key management is hard, 2) key management is critical to overall safety and usability. WireGuard sidesteps all of this. It looks great on paper because it's only solving the easiest problem. And it seems great in practice because the ugliness of the ancillary infrastructure isn't counted against it, even though from a wholistic standpoint it should.

[1] https://man.openbsd.org/ikectl.8#PKI_AND_CERTIFICATE_AUTHORI...

Re: WireGuard Gives Linux a Faster, More Secure VPN

#204

Post by linsomniac »

LinuxBender wrote: post #122
dragonsh wrote: post #4

I hope WireGuard can come to feature parity with TincVPN will be nice. Especially automatic routing and mesh VPN formation, it can really help our multi-cloud container clusters connected using TincVPN to be bit more performant. The difference is WireGuard is part of Linux kernel so speed of processing packets is faster than TincVPN. Still experimenting with WireGuard and manually creating peer to peer mesh.

One suggestion would be to submit a feature request to Tinc to add detection / support of Wireguard. Tinc could still handle the mesh routing and just hand off the encryption bits to WG. There have been some brief discussion in email threads [1] Probably more, have not checked all the archives. [1] - https://www.tinc-vpn.org/pipermail/tinc/2017-February/004755...

Fascinating idea! I've been really interested in Tinc, but it seems to be languishing where WireGuard is really taking off. The meshing in Tinc seems quite interesting. Though, honestly, I'm pretty happy with OpenVPN.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#205

Post by dang »

nif2ee wrote: post #20
ahnick wrote: post #7

Earlier quoted context omitted.

Tailscale looks promising. ( https://tailscale.com/ )

I am sick of people shilling to this thing here. Stop exploiting HN for free advertising. Every Wireguard post here has become a free ad for this company. EDIT: Stop supporting parasites repackaging and rebranding open source and selling it while leaving the author who single handedly made this entire thing possible begging for donations on Patreon

You've been breaking the site guidelines repeatedly, both in this thread and unfortunately in others (and we've had to ask you about this before). We ban accounts that do that. Would you mind reviewing https://news.ycombinator.com/newsguidelines.html and sticking to the rules when posting here? The intended spirit is curious conversation.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#206

Post by q3k »

megous wrote: post #108
q3k wrote: post #69

Earlier quoted context omitted.

Very much agreed. While for simple use cases static keys are more than fine, a proper PKI is basically the only sane way to deploy a VPN in an enterprise or even small company setting.

What do you mean by static keys? All keys are changeable at runtime and wireguard uses public key cryptography.

That all clients have to be configured on each server.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#207

Post by perryh2 »

cprecioso wrote: post #131
tosh wrote: post #124

I think Tailscale [1] can be to WireGuard what Github and Gitlab are to git. If you haven’t checked them out yet: worth taking a look! [1] https://tailscale.com

What is the difference between this and ZeroTier? https://www.zerotier.com/

https://twitter.com/perry_huang/status/1223393351845548032

Re: WireGuard Gives Linux a Faster, More Secure VPN

#209

Post by ryanlol »

wmf wrote: post #175
lapinot wrote: post #142

I really like wireguard, but one thing that bugs me is the fact that it's layer 3 (an ip tunnel) and has no code to support layer 2 (ethernet MAC tunnel). The downside for me is that you have to manage static ips in the configurations (specifically it's not compatible with ipv6 slaac and NDP). There is https://git.zx2c4.com/wg-dynamic but it's very experimental at the moment. The level 3-only tunnel is motivated as "…

It should be possible to run GRE, L2TP, or VXLAN over WireGuard although such tooling probably doesn't exist yet.

What tooling do you need for this? Shell scripts would be the traditional approach.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#210

Post by alanpca »

api wrote: post #165
lapinot wrote: post #142

I really like wireguard, but one thing that bugs me is the fact that it's layer 3 (an ip tunnel) and has no code to support layer 2 (ethernet MAC tunnel). The downside for me is that you have to manage static ips in the configurations (specifically it's not compatible with ipv6 slaac and NDP). There is https://git.zx2c4.com/wg-dynamic but it's very experimental at the moment. The level 3-only tunnel is motivated as "…

Substituting MAC for IP address is exactly what ZeroTier does. MACs can't be spoofed, though nodes can be designated as bridges and that allows them to impersonate MACs. There's still the issue of authenticating IPv4 IPs though, which are too small to embed anything useful into. ZeroTier has a certificate system for that but it requires the use of the rules engine to enable it.

Can you not set your MAC to whatever you want on many platforms?
Post reply on HN