Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard 1.0 for Linux 5.6

lists.zx2c4.com

Post reply on HN
Print view View original

21–30 of 214 posts

Re: WireGuard 1.0 for Linux 5.6

#21

Post by tw04 »

rubenbe wrote: post #19
newscracker wrote: post #14

For anyone wanting to try it, WireGuard with Algo VPN [1] to set it up on a server is a great combination. I found it quite easy to setup and use. Algo has built-in support for various cloud providers, where, when you run it from, day, your desktop, it can setup the VPN server for you based on answers to some questions (with sensible defaults) and some information on connecting to the provider (like an API key, for e…

Does the VPS have unencrypted access to the VPN? It's something I would want to avoid. (A VPS is a prime candidate to be compromised)

If you're subject to state level actors attacking you, a VPS is probably the least of your worries. If you're just trying to make sure some kiddiot in a coffee shop isn't doing mass collections, a VPS is perfectly secure.

Re: WireGuard 1.0 for Linux 5.6

#23

Post by exabrial »

One thing I wish for wireguard: the ability to look up keys/ips in an external system like LDAP. I moved an entire call center [50+ people] fully remote last week. We're using wireguard. Key management stinks, and that is my only complaint! It is an incredible piece of software and I'm very thankful for it.

Re: WireGuard 1.0 for Linux 5.6

#24

Post by igetspam »

xal wrote: post #5

Given the occasion, could someone write a paragraph about what downstream effects are expected by wireguard existing? So far I’ve seen mostly technical arguments for it. VPNs have become a more important piece of infrastructure now. The most significant approachability increase really came from mobile based solutions and auto pilot systems like Google’s Outline. Will WG make a marked difference in stability, speed, a…

Anecdotally: I have run ipsec based VPNs, openvpn, SSH tunnel based VPNs, etc. Almost all have been a bit of a PITA. I walked someone through setting up a WG based VPN two weeks ago, at a wework in Jakarta. Took 10m via slack. The machine is behind a NAT and I haven't had a single problem connecting. I've done tests where I rolled a new server and as soon as it was up, the tunnels were back. It's a thing up beauty.

Re: WireGuard 1.0 for Linux 5.6

#25

Post by lifty »

I really hope WireGuard becomes a standard and get's included in the macOS/iOS and Windows kernels as well. Key management and and other fancy features could be left to userspace applications but having the basic wg capability in the kernel would be great.

Re: WireGuard 1.0 for Linux 5.6

#26

Post by eadmund »

exabrial wrote: post #23

One thing I wish for wireguard: the ability to look up keys/ips in an external system like LDAP. I moved an entire call center [50+ people] fully remote last week. We're using wireguard. Key management stinks, and that is my only complaint! It is an incredible piece of software and I'm very thankful for it.

I think the idea is that you're supposed to build a system to manage WireGuard using that sort of information. I.e. WireGuard provides the basic primitives and second- or third-party tooling uses them.

I like that idea, because it means that the actual WireGuard core is small and it's usable right now. It is annoying that someone hasn't yet developed neat integrations for WireGuard and stuff I might want to use, but — I'm someone! I (or you, or whoever) can build something, and as surely as day follows the night someone else will build some neat things in the future.

It's early days yet!

Re: WireGuard 1.0 for Linux 5.6

#27

Post by katnegermis »

exabrial wrote: post #23

One thing I wish for wireguard: the ability to look up keys/ips in an external system like LDAP. I moved an entire call center [50+ people] fully remote last week. We're using wireguard. Key management stinks, and that is my only complaint! It is an incredible piece of software and I'm very thankful for it.

I think this is what https://tailscale.com/ is trying to solve :)

(I'm in no way affiliated, but stumbled upon it on twitter a few weeks ago)

Re: WireGuard 1.0 for Linux 5.6

#28

Post by [deleted] »

exabrial wrote: post #23

One thing I wish for wireguard: the ability to look up keys/ips in an external system like LDAP. I moved an entire call center [50+ people] fully remote last week. We're using wireguard. Key management stinks, and that is my only complaint! It is an incredible piece of software and I'm very thankful for it.

[deleted]

Re: WireGuard 1.0 for Linux 5.6

#29

Post by middleclick »

myu701 wrote: post #11
xal wrote: post #5

Given the occasion, could someone write a paragraph about what downstream effects are expected by wireguard existing? So far I’ve seen mostly technical arguments for it. VPNs have become a more important piece of infrastructure now. The most significant approachability increase really came from mobile based solutions and auto pilot systems like Google’s Outline. Will WG make a marked difference in stability, speed, a…

Someone else can give a much better comparison than me, this is just to get you started. Compared to the 80% use case of OpenVPN, Wireguard is: 1. Much less code. A few thousand lines of code vs lots more for OpenVPN 2. Speedier. WG does UDP traffic so there is less overhead on the protocol level for syncs acks etc. 3. Easier on mobile battery life due to decreased complexity For one example use case comparing them s…

On that note, I wish and hope Wireguard did TCP as well. Some countries block UDP traffic or at least throttle it.

Re: WireGuard 1.0 for Linux 5.6

#30

Post by packetlost »

vbezhenar wrote: post #15
myu701 wrote: post #11

Earlier quoted context omitted.

Someone else can give a much better comparison than me, this is just to get you started. Compared to the 80% use case of OpenVPN, Wireguard is: 1. Much less code. A few thousand lines of code vs lots more for OpenVPN 2. Speedier. WG does UDP traffic so there is less overhead on the protocol level for syncs acks etc. 3. Easier on mobile battery life due to decreased complexity For one example use case comparing them s…

I wonder how WireGuard compares to IPsec with regards to the mobile battery. AFAIK IPsec implemented in kernel while WireGuard uses user-space implementation on mobile devices, at least for now.

The code has been merged into the kernel as of 5.4(?) I believe, but we won't see that on mobile for quite awhile. I'm guessing IPSec will still have a lead on mobile for awhile for that reason, not that it has sort of majority on there anyway.
Post reply on HN