WireGuard Gives Linux a Faster, More Secure VPN • Hacker News Board

Re: WireGuard Gives Linux a Faster, More Secure VPN

#281

Post by namelosw » Tue, Mar 03, 2020, 1:44 PM UTC

twentyloops wrote: post #135

Check out Algo [0] if you're interested in setting up a personal WireGuard VPN server. It's simple and hassle-free, especially if you are not familiar with server administration and don't want to be bogged down by details. I have one deployed on Digital Ocean ($5/mo droplet). All you need to do is run the setup script, answer a few yes/no questions (optional features), paste in your API key, and update the firewall s…

Been using Algo for years. 11/10 would use again. (I'm Chinese living in China)

Re: WireGuard Gives Linux a Faster, More Secure VPN

#282

Post by smush » Tue, Mar 03, 2020, 1:56 PM UTC

bubersson wrote: post #268

smush wrote: post #121

TL;DR: Should I keep fussing with PiVPN or try something like TincVPN? Semi-OT: So I just installed PiVPN to use with this protocol to try and do a small vpn at home (all I want is to go to my domain, auth, and be on my LAN so I can RDP / VNC) and the wireguard bits worked great, and the install process was buttery smooth, even on a Raspbery Pi Zero W. But - my network lack of knowledge is probably hamstringing me. I…

Make sure that the port is correct and it is UDP (not TCP). (I just did the same setup with PiVPN. Somehow I got a wrong port number first, but then it worked)

OK it defaulted to UDP, got nothing, changed to TCP, got nothing. Will change it back and try again.

I will also double check the port number.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#283

Post by smush » Tue, Mar 03, 2020, 1:57 PM UTC

andreareina wrote: post #267

smush wrote: post #121

TL;DR: Should I keep fussing with PiVPN or try something like TincVPN? Semi-OT: So I just installed PiVPN to use with this protocol to try and do a small vpn at home (all I want is to go to my domain, auth, and be on my LAN so I can RDP / VNC) and the wireguard bits worked great, and the install process was buttery smooth, even on a Raspbery Pi Zero W. But - my network lack of knowledge is probably hamstringing me. I…

Have you tried using the tailscale interface IPs (100.x.x.x)? I've been able to use VNC over those addresses.

I have, but I've not been able to VNC over them. I've made sure the FW rules let tailscale do anything and have even tried turning both firewalls off entirely but at least for TightVNC it doesn't like it, nor RDP (RDP enabled in System settings).

But this does give me hope that it can be done in the first place, I just have some setting goofed up somewhere. I will restart my tailscale stuff now that I know someone out there has done it.

Thanks!

Re: WireGuard Gives Linux a Faster, More Secure VPN

#284

Post by danielneri » Tue, Mar 03, 2020, 2:08 PM UTC

nikisweeting wrote: post #192

twentyloops wrote: post #135

Check out Algo [0] if you're interested in setting up a personal WireGuard VPN server. It's simple and hassle-free, especially if you are not familiar with server administration and don't want to be bogged down by details. I have one deployed on Digital Ocean ($5/mo droplet). All you need to do is run the setup script, answer a few yes/no questions (optional features), paste in your API key, and update the firewall s…

+1 for Algo, it's better than Streissand imo.

What makes it better? I've been using Streisand quite successfully, and the setup appears easier from the little I've read about Algo (haven't implemented myself yet)

Re: WireGuard Gives Linux a Faster, More Secure VPN

#285

Post by holmberd » Tue, Mar 03, 2020, 2:40 PM UTC

I've used IVPN for years and it works flawlessly.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#286

Post by q3k » Tue, Mar 03, 2020, 4:48 PM UTC

megous wrote: post #278

q3k wrote: post #206

Earlier quoted context omitted.

That all clients have to be configured on each server.

Server has to know what clients to accept in any VPN solution. I still don't see the point.

> Server has to know what clients to accept in any VPN solution. I still don't see the point.

In OpenVPN and others, the server can just check the certificate presented by a client against a shared CA. The certificate can be signed/emitted by a totally different system.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#287

Post by jazzdev » Tue, Mar 03, 2020, 5:39 PM UTC

lazyier wrote: post #79

fivesixzero wrote: post #13

Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…

> Could this be a positive change? It's normal and expected evolution of protocols and software. Generation 1: New idea, new implementation. As people become comfortable with the new idea it gains in acceptance and hype. Try to keep it simple and fast, but it's a exercise in exploration and it gains technical debt faster then it gains new features. Generation 2: Widespread acceptance and commercialization. Groups ins…

This sounds like Jared Spool's Market Maturity model.[0] He breaks up your gen 3 into two separate stages:

Stage 1: Raw Iron Stage 2: Checklist Battles Stage 3: Productivity Wars Stage 4: Transparency

[0] https://articles.uie.com/market_maturity/

Re: WireGuard Gives Linux a Faster, More Secure VPN

#288

Post by tinus_hn » Tue, Mar 03, 2020, 5:57 PM UTC

ffk wrote: post #253

BlueTemplar wrote: post #240

Earlier quoted context omitted.

Hmm, but MACs (and Ethernet?) are on their way out with IPv6, replaced by specifically software-set GUIDs ?

Most IPv6 packets are encapsulated in Ethernet frames which use MAC addresses. What may change is the vendor specific MAC address could be replaced with a MAC address generated by a cryptographic hash to preserve privacy.

Privacy from what? MAC addresses are not used on the internet, only on the local network

Re: WireGuard Gives Linux a Faster, More Secure VPN

#289

Post by ffk » Tue, Mar 03, 2020, 6:08 PM UTC

tinus_hn wrote: post #288

ffk wrote: post #253

Earlier quoted context omitted.

Most IPv6 packets are encapsulated in Ethernet frames which use MAC addresses. What may change is the vendor specific MAC address could be replaced with a MAC address generated by a cryptographic hash to preserve privacy.

Privacy from what? MAC addresses are not used on the internet, only on the local network

Not all networks are private. Also, many IPv6 addresses contain the MAC address which would effectively deanonymize you over the internet.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#290

Post by saber6 » Tue, Mar 03, 2020, 7:42 PM UTC

hectorm wrote: post #116

In the case that someone has any trouble configuring WireGuard, I would like to share my automatic deployment of WireGuard and Unbound with full IPv4 and IPv6 support with Packer and Terraform in Hetzner Cloud (although it can be easily adapted to other providers) [1]. In the case that no automatic deployment is necessary, it may also be useful to look directly at the WireGuard configuration [2]. Since WireGuard supp…

Very nice!

I just finished a very similar home project consisting of WireGuard in CentOS VM, built via Packer, deployed via Terraform to an on-prem vCenter cluster (vSphere/ESXi Host). All of the software/tools are inside a Docker container (for versioning).

Next, I plan on doing AWS, Azure, Google, and Packet. I'll send you a note when I put my stuff on GitHub as you may be interested in some of the tooling (specifically, Makefiles to help speed up workflows).