Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard Gives Linux a Faster, More Secure VPN

wired.com

Post reply on HN
Print view View original

261–270 of 306 posts

Re: WireGuard Gives Linux a Faster, More Secure VPN

#261

Post by thayne »

lapinot wrote: post #142

I really like wireguard, but one thing that bugs me is the fact that it's layer 3 (an ip tunnel) and has no code to support layer 2 (ethernet MAC tunnel). The downside for me is that you have to manage static ips in the configurations (specifically it's not compatible with ipv6 slaac and NDP). There is https://git.zx2c4.com/wg-dynamic but it's very experimental at the moment. The level 3-only tunnel is motivated as "…

I don't have a problem with it being layer 3 rather than layer 2. But the lack of dynamic configuration is a bit of an issue. I don't care too much about needing static ip addresses, but I do want to be able to push down dynamic routes and dns servers to clients.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#262

Post by thayne »

rattray wrote: post #160
kortilla wrote: post #155

Earlier quoted context omitted.

Broadcast/multicast propagation.

Can you say more to explain the utility of this to those unfamiliar with networking?

One common use case is multicast DNS (https://en.wikipedia.org/wiki/Multicast_DNS) which uses multicast for individual hosts to publish services available on them to other hosts on the network without needing a dedicated DNS server.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#263

Post by kamalhm »

twentyloops wrote: post #135

Check out Algo [0] if you're interested in setting up a personal WireGuard VPN server. It's simple and hassle-free, especially if you are not familiar with server administration and don't want to be bogged down by details. I have one deployed on Digital Ocean ($5/mo droplet). All you need to do is run the setup script, answer a few yes/no questions (optional features), paste in your API key, and update the firewall s…

can vouch for algo, been using it for a while and has no issues at all

Re: WireGuard Gives Linux a Faster, More Secure VPN

#264

Post by hunter2_ »

waste_monk wrote: post #258
beached_whale wrote: post #180

Earlier quoted context omitted.

I suspect Novel/IPX is still out there

I went through training on it back in 2012 - apparently it (at least at the time, not sure about now) was dominant in the australian mining industry, so the larger tertiary education providers were requested to at least familiarise students with it. It was a strange beast but there were a few odd spots it was better than active directory - e.g. an "Organizational Role" could be created and have a user assigned to it,…

I've always wondered why we don't use that as our subject for all sorts of business needs. I'm talking about normal employee-to-employee business in addition to more technical things like security groups and so forth. Don't email Karen, email [whatever her role is], at least for official requests pertaining explicitly to defined job responsibilities.

That way the sender doesn't get delayed by unknown turnover, and the new recipient has full history to look back upon instead of starting cold.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#265

Post by d21d3q »

ecnahc515 wrote: post #123
0xbadcafebee wrote: post #60

What I don't like about WireGuard: - Basically no real user or admin-oriented docs. There's some example configs and some getting started guides, and then some crypto-nerd look-how-secure-our-algorithms-are docs, but no real guidance on how to set up a reasonably simple network of hosts. - Authentication/authorization is just IP addresses and public keys? What about users and service accounts that you want to rotate…

If you want SSO, or fine grained access control, the idea is you would do that at a level above wireguard. For example, I'm prototyping a small CLI that talks to hashicorp vault via OIDC/OAuth2, and then creates a wireguard key pair + configuration locally, submits the public key to vault, and then the wireguard "server" is configured with a simple daemon that pulls all the public keys from vault and generates a wire…

Have a look on how Cloudflare's WARP vpn handles this: https://github.com/aghorler/cloudflare-warp-wg-client

Re: WireGuard Gives Linux a Faster, More Secure VPN

#266

Post by afiori »

upofadown wrote: post #220
dsr_ wrote: post #159

Earlier quoted context omitted.

Something like this: We introduce wireguard2, which is not wire-protocol-compatible with original wireguard. The same configuration files can be used, but you must generate new keys as part of your switch over. We strongly advise you to stop using original wireguard if there is any possibility of a wealthy, organized, determined attacker intercepting your communications. (See CVE2021-x. and forthcoming paper "64 qubi…

So at midnight July 23 2026 everyone upgrades to wireguard2 all at once? Perhaps I am not getting what you are proposing here...

not everyone, only a single network at a time. a common use will be corporate VPNs or VPNs on digital ocean-like services, in that case there is little to no reason for interoperability between two distinct network.

or at least you might want different keys anyway

Re: WireGuard Gives Linux a Faster, More Secure VPN

#267

Post by andreareina »

smush wrote: post #121

TL;DR: Should I keep fussing with PiVPN or try something like TincVPN? Semi-OT: So I just installed PiVPN to use with this protocol to try and do a small vpn at home (all I want is to go to my domain, auth, and be on my LAN so I can RDP / VNC) and the wireguard bits worked great, and the install process was buttery smooth, even on a Raspbery Pi Zero W. But - my network lack of knowledge is probably hamstringing me. I…

Have you tried using the tailscale interface IPs (100.x.x.x)? I've been able to use VNC over those addresses.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#268

Post by bubersson »

smush wrote: post #121

TL;DR: Should I keep fussing with PiVPN or try something like TincVPN? Semi-OT: So I just installed PiVPN to use with this protocol to try and do a small vpn at home (all I want is to go to my domain, auth, and be on my LAN so I can RDP / VNC) and the wireguard bits worked great, and the install process was buttery smooth, even on a Raspbery Pi Zero W. But - my network lack of knowledge is probably hamstringing me. I…

Make sure that the port is correct and it is UDP (not TCP).

(I just did the same setup with PiVPN. Somehow I got a wrong port number first, but then it worked)

Re: WireGuard Gives Linux a Faster, More Secure VPN

#269

Post by nif2ee »

dang wrote: post #205
nif2ee wrote: post #20

Earlier quoted context omitted.

I am sick of people shilling to this thing here. Stop exploiting HN for free advertising. Every Wireguard post here has become a free ad for this company. EDIT: Stop supporting parasites repackaging and rebranding open source and selling it while leaving the author who single handedly made this entire thing possible begging for donations on Patreon

You've been breaking the site guidelines repeatedly, both in this thread and unfortunately in others (and we've had to ask you about this before). We ban accounts that do that. Would you mind reviewing https://news.ycombinator.com/newsguidelines.html and sticking to the rules when posting here? The intended spirit is curious conversation.

Again, please do your job and delete astroturfing comments and ban these users. This company has been exploiting HN for so long to promote itself whenever a post about Wireguard go to the frontpage. They don't even have a ready product. This website encourages really sneaky types of marketing if you don't take action.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#270

Post by dang »

nif2ee wrote: post #269
dang wrote: post #205

Earlier quoted context omitted.

You've been breaking the site guidelines repeatedly, both in this thread and unfortunately in others (and we've had to ask you about this before). We ban accounts that do that. Would you mind reviewing https://news.ycombinator.com/newsguidelines.html and sticking to the rules when posting here? The intended spirit is curious conversation.

Again, please do your job and delete astroturfing comments and ban these users. This company has been exploiting HN for so long to promote itself whenever a post about Wireguard go to the frontpage. They don't even have a ready product. This website encourages really sneaky types of marketing if you don't take action.

I appreciate your concern for the integrity of this site, but if you really care about that you should follow its rules, which say clearly what to do with these insinuations, and it isn't posting them here.

I haven't seen any evidence of astroturfing in this case. The user you were accusing above seems entirely legit.

You've posted such accusations to HN several times before. Given how little data we have about each other online, it's easy to connect the dots in a way that jumps to nefarious conclusions about others. If you come here and post those, the odds get pretty high that you're accusing innocent people of bad things. That's not cool, which is one reason the site guidelines ask everyone not to do that. We'd be grateful if you'd stop doing that.

Post reply on HN