WireGuard Gives Linux a Faster, More Secure VPN • Hacker News Board

Re: WireGuard Gives Linux a Faster, More Secure VPN

#301

Post by Multicomp » Wed, Mar 04, 2020, 11:48 PM UTC

smush wrote: post #282

bubersson wrote: post #268

Earlier quoted context omitted.

Make sure that the port is correct and it is UDP (not TCP). (I just did the same setup with PiVPN. Somehow I got a wrong port number first, but then it worked)

OK it defaulted to UDP, got nothing, changed to TCP, got nothing. Will change it back and try again. I will also double check the port number.

While you're at it, check and double check your port forwarding settings. I got bit by this recently.

My owned router had the right ports opened, but the AT&T bridged router did not. Be sure you open ports on both sets of routers, otherwise your owned router will never have a chance to allow the traffic in the first place.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#302

Post by tinus_hn » Thu, Mar 05, 2020, 11:38 AM UTC

ffk wrote: post #289

tinus_hn wrote: post #288

Earlier quoted context omitted.

Privacy from what? MAC addresses are not used on the internet, only on the local network

Not all networks are private. Also, many IPv6 addresses contain the MAC address which would effectively deanonymize you over the internet.

So instead of not using the MAC address in the IPv6 (which any reasonably modern OS does because this problem is old, well known and trivially solved) you get rid of MAC addresses altogether? Just so you can have some illusion of privacy while sending your traffic through a supposedly compromised network?

This is paranoia about all the wrong things, focusing on irrelevant details and ignoring what’s important.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#303

Post by prutschman » Thu, Mar 05, 2020, 10:12 PM UTC

crest wrote: post #299

prutschman wrote: post #239

Earlier quoted context omitted.

I've had a similar experience. In particular links will just "drop out" for periods of time. The public forwarding nodes were overburdened for quite a while. I set up my own "moon", but one of the sites has a cranky NAT, which will let a connection through for a while, then fail. It seems to take at least 30 seconds for zerotier to "notice" this and switch back to forwarding via the moon. Maybe the new multipath will…

How is the VPN responsible for your crappy underlay network?

Rather obviously it isn't. I'm not sure why you'd even ask.

I'm not the only one with external NAT that I can't do anything about; the question is what to do to mitigate this.

Switching to an explicit hub-and-spoke model would work around this, but at the expense of what I consider one of ZeroTier's biggest strengths: transparent meshing. If two machines in the network are on the same LAN, I'd like them to use that rather than the network.

Faster detection of the failure of the NAT-piercing peer-to-peer link, with fallback to the "moon" while the peer-to-peer link is being re-established, would substantially increase the usability for people, like me, who are stuck with the NAT they've got. As I alluded to, the new multi-path features that ZeroTier is getting might help with that.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#304

Post by ffk » Sun, Mar 08, 2020, 3:06 AM UTC

tinus_hn wrote: post #302

ffk wrote: post #289

Earlier quoted context omitted.

Not all networks are private. Also, many IPv6 addresses contain the MAC address which would effectively deanonymize you over the internet.

So instead of not using the MAC address in the IPv6 (which any reasonably modern OS does because this problem is old, well known and trivially solved) you get rid of MAC addresses altogether? Just so you can have some illusion of privacy while sending your traffic through a supposedly compromised network? This is paranoia about all the wrong things, focusing on irrelevant details and ignoring what’s important.

I don't believe I suggested getting rid of the MAC address altogether. Ethernet isn't going away anytime soon.

The suggestion is simply this: Don't embed your MAC address into your IPv6 address because it's a unique identifier that can deanonymize you even if you shift networks.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#305

Post by kortilla » Tue, Mar 10, 2020, 2:35 AM UTC

grumblez wrote: post #185

pathseeker wrote: post #178

Earlier quoted context omitted.

ZeroTier uses UDP. That's hardly "lesser known" than IPSec.

"lesser known" as in protocols such as IPSec, ZeroTier, WireGuard, etc. Of which IPSec has been around forever and many NATs/Firewalls have special handling rules built in, just as @api mentioned in another comment. Yes, ZeroTier uses UDP underneath, but that doesn't mean symmetric NATs don't/won't cause havoc to peer to peer protocols using UDP.

Wrong layers of the network. IPSec is comparable to TCP/UDP, not wireguard/zerotier. It’s L4 and NAT can’t have enough intelligence to setup IPSec meshes without explicit configuration.

Finally, how can ZeroTier’s support be so incompetent to not recognize connectivity issues between endpoints? That’s one of the few things that goes wrong with tunnel meshes.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#306

Post by nikisweeting » Mon, Mar 16, 2020, 8:13 PM UTC

danielneri wrote: post #284

nikisweeting wrote: post #192

Earlier quoted context omitted.

+1 for Algo, it's better than Streissand imo.

What makes it better? I've been using Streisand quite successfully, and the setup appears easier from the little I've read about Algo (haven't implemented myself yet)

Personally I like Algo because it also handles provisioning a dedicated VPS with some sane system defaults. It also sets up IKEv2 and Wireguard together, which makes it easier to have a multi-platform VPN out of the box without having to set up Wireguard & IPsec separately. It may not be what everyone wants though, Streissand is great in its own ways too.