Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard Gives Linux a Faster, More Secure VPN

wired.com

Post reply on HN
Print view View original

291–300 of 306 posts

Re: WireGuard Gives Linux a Faster, More Secure VPN

#291

Post by rstuart4133 »

api wrote: post #165
lapinot wrote: post #142

I really like wireguard, but one thing that bugs me is the fact that it's layer 3 (an ip tunnel) and has no code to support layer 2 (ethernet MAC tunnel). The downside for me is that you have to manage static ips in the configurations (specifically it's not compatible with ipv6 slaac and NDP). There is https://git.zx2c4.com/wg-dynamic but it's very experimental at the moment. The level 3-only tunnel is motivated as "…

Substituting MAC for IP address is exactly what ZeroTier does. MACs can't be spoofed, though nodes can be designated as bridges and that allows them to impersonate MACs. There's still the issue of authenticating IPv4 IPs though, which are too small to embed anything useful into. ZeroTier has a certificate system for that but it requires the use of the rules engine to enable it.

You've made me look at ZeroTier. It's a bit of a shame you are being down voted because ZeroTier looks to be original, clever, and open source.

Your down voting is caused by you used the word MAC without defining what it is, so naturally people think it's a "Media Access Control Address", or a "Message Authentication Code", but it's far more complex than either. It is an address so it does perform the same function as a "Media Access Control Address", but [0] says it is "computed from the public portion of a public/private key pair. A node’s address, public key, and private key together form its identity.", and uses proof of work to prevent forgeries. Thus your statement that "MACs can't be spoofed" is correct, or at least is unless someone breaks it. The "proof of work" bit did cause an eyebrow to rise, as it is vulnerable to exponentiation drops in the price of computing.

For those still reading, my (very brief) look at ZeroTier is it does far more than IPSec / Wireguard - it solves the internet scale routing problem in it's own way, address spoofing and a number of things as well. It's undoubtedly far simpler to use than Wireguard or OpenVPN, as routing with those protocols in large networks is a complete PITA. It treats IP rather like IP treats Ethernet - as a fabric it runs on top of that unlike Ethernet connects most nodes on the planet. For nodes that aren't fully connected (like those behind a NAT, it creates paths (ie, does routing), and if multiple paths are available uses several concurrently to get the best throughput.

[0] is well worth a look if you are curious about such things. I am going to take a much closer look when I get time.

[0] https://www.zerotier.com/manual/

Re: WireGuard Gives Linux a Faster, More Secure VPN

#292

Post by rstuart4133 »

trey-jones wrote: post #29
fivesixzero wrote: post #13

Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…

I think Opinionated can be good. I think configurable can be good too. I think the best case is nearly always "Configurable, with smart defaults" meaning defaults that work out of the box for most uses. Definitely programming languages are on the periphery of this conversation, but I think provide some good examples of why I like opinionated tools in general. My language of choice right now is Go, and has been for a…

> I think Opinionated can be good.

It can be. In fact it's almost essential if you are handing out knives to children; you want someone doing who is very opinionated about the dangers posed by sharp knives.

There was a recent HN post making the same point about JWT's. JWT's allow the null cipher, and in the hands of people who might not appreciate the disaster caused production code accepting JWT's using the null cipher you want a _very_ opinionated implementation that prevents it.

But for me, such an implementation would be a total pain in the arse. The null cipher is there to make debugging easier - getting things working for the first time can be very difficult without it. You can stick your opinions on whether I should be using it where the sun don't shine.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#293

Post by namibj »

q3k wrote: post #286
megous wrote: post #278

Earlier quoted context omitted.

Server has to know what clients to accept in any VPN solution. I still don't see the point.

> Server has to know what clients to accept in any VPN solution. I still don't see the point. In OpenVPN and others, the server can just check the certificate presented by a client against a shared CA. The certificate can be signed/emitted by a totally different system.

Wireguard doesn't respond at all (not SYN/ACK stuff) if not provided with a correctly signed packet. This means you can't scan for wireguard ports without already being configured for them.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#294

Post by Rapzid »

linsomniac wrote: post #201
cpach wrote: post #152

Earlier quoted context omitted.

Out of curiosity, what is the use case for doing VPN at layer 2?

Pretty much every time I do a migration from one data center or office migration I set up an OpenVPN that bridges the network segments at the two locations. It makes the move so much easier. Once set up, I can shut down a machine at one location, move it, bring it back up, and it's back in business. There are situations where we might want to migrate to new machines during the move, which this makes no harder. But fo…

It's been a while since I've worked with linux networking. I would have thought it would give you a VIF in some form or fashion that you could attach to a bridge. Is that not the case?

EDIT: *and proxy arp requests through

Re: WireGuard Gives Linux a Faster, More Secure VPN

#295

Post by linsomniac »

Rapzid wrote: post #294
linsomniac wrote: post #201

Earlier quoted context omitted.

Pretty much every time I do a migration from one data center or office migration I set up an OpenVPN that bridges the network segments at the two locations. It makes the move so much easier. Once set up, I can shut down a machine at one location, move it, bring it back up, and it's back in business. There are situations where we might want to migrate to new machines during the move, which this makes no harder. But fo…

It's been a while since I've worked with linux networking. I would have thought it would give you a VIF in some form or fashion that you could attach to a bridge. Is that not the case? EDIT: *and proxy arp requests through

By "it" do you mean Wireguard? I haven't used it, but you need a special type of virtual interface for bridging, a tap device can do it, a tun cannot. From some searches, Wireguard doesn't support operating on a bridge. OpenVPN, which is what I've used in the past, supports both tun and tap interfaces.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#296

Post by nekeo0 »

thayne wrote: post #261
lapinot wrote: post #142

I really like wireguard, but one thing that bugs me is the fact that it's layer 3 (an ip tunnel) and has no code to support layer 2 (ethernet MAC tunnel). The downside for me is that you have to manage static ips in the configurations (specifically it's not compatible with ipv6 slaac and NDP). There is https://git.zx2c4.com/wg-dynamic but it's very experimental at the moment. The level 3-only tunnel is motivated as "…

I don't have a problem with it being layer 3 rather than layer 2. But the lack of dynamic configuration is a bit of an issue. I don't care too much about needing static ip addresses, but I do want to be able to push down dynamic routes and dns servers to clients.

That it doesn’t act as a DHCP server or anything but what it’s for is my main reason for loving it.

Logical functionality should be decoupled to ease maintenance, reduce risk from complexity.

Config management tools can dump some text in a file for corporate needs.

Apply it over SSH or via git.

It’s just a bit of text to lay down.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#297

Post by ecnahc515 »

peterwwillis wrote: post #276
ecnahc515 wrote: post #123

Earlier quoted context omitted.

If you want SSO, or fine grained access control, the idea is you would do that at a level above wireguard. For example, I'm prototyping a small CLI that talks to hashicorp vault via OIDC/OAuth2, and then creates a wireguard key pair + configuration locally, submits the public key to vault, and then the wireguard "server" is configured with a simple daemon that pulls all the public keys from vault and generates a wire…

It sounds cool, but it also extends the amount of components that have to be made resilient to failure and attack. Your HA vault+consul clusters, HTTPS & OAuth2, key generation, and automation pieces (inc. message passing & load balancing) all need to be working correctly. Compare that to a single stateless server which spits out an OAuth2 login url to a client, receives a token once the client is authed, and opens a…

Agreed, but as OpenVPN has shown us, it's not a guarantee that security will be any better if everything is contained within a single process.

It's also possible to use something other than Vault, you could use LDAP for example, but Vault lets you use multiple authentication mechanisms, and can be used for other purposes, so it's kinda a multi-tool. Additionally, I'm not using consul, just Postgres on the same host as Vault.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#298

Post by wuunderbar »

cpach wrote: post #194
twentyloops wrote: post #135

Check out Algo [0] if you're interested in setting up a personal WireGuard VPN server. It's simple and hassle-free, especially if you are not familiar with server administration and don't want to be bogged down by details. I have one deployed on Digital Ocean ($5/mo droplet). All you need to do is run the setup script, answer a few yes/no questions (optional features), paste in your API key, and update the firewall s…

I honestly had no idea that DigitalOcean has a ”built-in” firewall. That’s awesome. Thank you!

Don't all cloud providers have these for their compute VMs? (e.g,. AWS security groups)

Re: WireGuard Gives Linux a Faster, More Secure VPN

#299

Post by crest »

prutschman wrote: post #239
v0tary wrote: post #149

Earlier quoted context omitted.

I disagree - spent a considerable amount of time with zerotier as a possible replacement of a small sized ipsec mesh (4 sites) and it failed horribly. Had commercial support, different hardware and even virtualized it. Latency was a major issue and quality of the links were erratic to say the least. Don't get me wrong, I think zerotier is great, but it's not prime time.

I've had a similar experience. In particular links will just "drop out" for periods of time. The public forwarding nodes were overburdened for quite a while. I set up my own "moon", but one of the sites has a cranky NAT, which will let a connection through for a while, then fail. It seems to take at least 30 seconds for zerotier to "notice" this and switch back to forwarding via the moon. Maybe the new multipath will…

How is the VPN responsible for your crappy underlay network?

Re: WireGuard Gives Linux a Faster, More Secure VPN

#300

Post by megous »

q3k wrote: post #286
megous wrote: post #278

Earlier quoted context omitted.

Server has to know what clients to accept in any VPN solution. I still don't see the point.

> Server has to know what clients to accept in any VPN solution. I still don't see the point. In OpenVPN and others, the server can just check the certificate presented by a client against a shared CA. The certificate can be signed/emitted by a totally different system.

I see. Though if you ever want to remove access you'll still not avoid distributing information about individual clients to the VPN servers. It will just be a blacklist style list and not a whitelist like in WG.
Post reply on HN