Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard 1.0 for Linux 5.6

lists.zx2c4.com

Post reply on HN
Print view View original

31–40 of 214 posts

Re: WireGuard 1.0 for Linux 5.6

#31

Post by jeltz »

middleclick wrote: post #29
myu701 wrote: post #11

Earlier quoted context omitted.

Someone else can give a much better comparison than me, this is just to get you started. Compared to the 80% use case of OpenVPN, Wireguard is: 1. Much less code. A few thousand lines of code vs lots more for OpenVPN 2. Speedier. WG does UDP traffic so there is less overhead on the protocol level for syncs acks etc. 3. Easier on mobile battery life due to decreased complexity For one example use case comparing them s…

On that note, I wish and hope Wireguard did TCP as well. Some countries block UDP traffic or at least throttle it.

Maybe the best solution is to use a tool like https://github.com/wangyu-/udp2raw-tunnel.

Re: WireGuard 1.0 for Linux 5.6

#32

Post by middleclick »

jeltz wrote: post #31
middleclick wrote: post #29

Earlier quoted context omitted.

On that note, I wish and hope Wireguard did TCP as well. Some countries block UDP traffic or at least throttle it.

Maybe the best solution is to use a tool like https://github.com/wangyu-/udp2raw-tunnel .

I know, but the performance takes a massive hit. Have you tried it? Maybe it was something I did wrong.

Re: WireGuard 1.0 for Linux 5.6

#33

Post by K0SM0S »

kertis wrote: post #13
myu701 wrote: post #11

Earlier quoted context omitted.

Someone else can give a much better comparison than me, this is just to get you started. Compared to the 80% use case of OpenVPN, Wireguard is: 1. Much less code. A few thousand lines of code vs lots more for OpenVPN 2. Speedier. WG does UDP traffic so there is less overhead on the protocol level for syncs acks etc. 3. Easier on mobile battery life due to decreased complexity For one example use case comparing them s…

> little more setup A lot more! PKI infrastructure, chiphersuites and so on and so forth... By the way OpenVPN also can work with UDP, even it's default mode.

It's a lot more if you do it all manually, however for most "common" use cases, one should probably go with automatically generated config files.

For instance pfSense provides you with single-click configs for any target platform, with certs, credentials etc. properly tied to some ACL or ID management system, etc. It's neat and pain-free and just works.

You could learn all the theory underneath (I mean systems, IT, not the crypto!) and do it manually (and you probably should for a big-enough infra, or specific-enough use-case), but that will be premature optimization I think.

Basic VPN is easy (take a weekend to learn / implement and you'll have all the great benefits of VPNs). Wireguard is "just" more efficient by an order of magnitude as I see it, it'll become the de facto low-profile implementation me thinks.

Re: WireGuard 1.0 for Linux 5.6

#34

Post by wolrah »

rubenbe wrote: post #19
newscracker wrote: post #14

For anyone wanting to try it, WireGuard with Algo VPN [1] to set it up on a server is a great combination. I found it quite easy to setup and use. Algo has built-in support for various cloud providers, where, when you run it from, day, your desktop, it can setup the VPN server for you based on answers to some questions (with sensible defaults) and some information on connecting to the provider (like an API key, for e…

Does the VPS have unencrypted access to the VPN? It's something I would want to avoid. (A VPS is a prime candidate to be compromised)

In the scenario proposed the VPS is the VPN endpoint. It's an alternative to commercial VPN services or hosting something on your own systems.

Whether that fits your security scenario is up to you.

If your primary goal is to get from an untrusted network (say public wifi) to a trusted network then a VPS with a provider you trust is great.

Re: WireGuard 1.0 for Linux 5.6

#35

Post by yjftsjthsd-h »

vbezhenar wrote: post #15
myu701 wrote: post #11

Earlier quoted context omitted.

Someone else can give a much better comparison than me, this is just to get you started. Compared to the 80% use case of OpenVPN, Wireguard is: 1. Much less code. A few thousand lines of code vs lots more for OpenVPN 2. Speedier. WG does UDP traffic so there is less overhead on the protocol level for syncs acks etc. 3. Easier on mobile battery life due to decreased complexity For one example use case comparing them s…

I wonder how WireGuard compares to IPsec with regards to the mobile battery. AFAIK IPsec implemented in kernel while WireGuard uses user-space implementation on mobile devices, at least for now.

I'm pretty sure some ROMs already have kernel support, although I don't know details.

Re: WireGuard 1.0 for Linux 5.6

#36

Post by tw04 »

katnegermis wrote: post #27
exabrial wrote: post #23

One thing I wish for wireguard: the ability to look up keys/ips in an external system like LDAP. I moved an entire call center [50+ people] fully remote last week. We're using wireguard. Key management stinks, and that is my only complaint! It is an incredible piece of software and I'm very thankful for it.

I think this is what https://tailscale.com/ is trying to solve :) (I'm in no way affiliated, but stumbled upon it on twitter a few weeks ago)

Tailscale looks like it's creating a mesh network - he's not asking for end-users to have VPN connections between each other (what Tailscale is doing).

He's asking for a central server where he can retrieve/update/manage end-user keys, likely: because helpdesk.

You could in theory do this with any number of the existing team password managers, but I think he'd like integration directly to wireguard.

Edit: care to reply rather than just downvote? All of their documentation and examples state exactly what I'm saying. They're turning all the devices into endpoints and creating a mesh - he doesn't want users bypassing his SINGLE VPN endpoint into the company or talking directly to each other based on his description. He wants Cisco Anyconnect - only wireguard.

Re: WireGuard 1.0 for Linux 5.6

#37

Post by wisam »

newscracker wrote: post #14

For anyone wanting to try it, WireGuard with Algo VPN [1] to set it up on a server is a great combination. I found it quite easy to setup and use. Algo has built-in support for various cloud providers, where, when you run it from, day, your desktop, it can setup the VPN server for you based on answers to some questions (with sensible defaults) and some information on connecting to the provider (like an API key, for e…

Just be careful when setting up Algo VPN.

Its secure defaults will probably block all other services you're running on your server and render them inaccessible.

You might even end up not being able to ssh to your server if you choose not to let Algo set up ssh configurations (because you have your own).

I would say install Algo on a dedicated droplet or backup your VPS before setting it up.

Re: WireGuard 1.0 for Linux 5.6

#39

Post by exabrial »

eadmund wrote: post #26
exabrial wrote: post #23

One thing I wish for wireguard: the ability to look up keys/ips in an external system like LDAP. I moved an entire call center [50+ people] fully remote last week. We're using wireguard. Key management stinks, and that is my only complaint! It is an incredible piece of software and I'm very thankful for it.

I think the idea is that you're supposed to build a system to manage WireGuard using that sort of information. I.e. WireGuard provides the basic primitives and second- or third-party tooling uses them. I like that idea, because it means that the actual WireGuard core is small and it's usable right now. It is annoying that someone hasn't yet developed neat integrations for WireGuard and stuff I might want to use, but…

Yep, that's what I'm asking for... right now wireguard can only look at configuration text files AFAIK. If it had a way to invoke a command/script to lookup a key/ip, any number of external management systems could be created!

Re: WireGuard 1.0 for Linux 5.6

#40

Post by kertis »

yjftsjthsd-h wrote: post #35
vbezhenar wrote: post #15

Earlier quoted context omitted.

I wonder how WireGuard compares to IPsec with regards to the mobile battery. AFAIK IPsec implemented in kernel while WireGuard uses user-space implementation on mobile devices, at least for now.

I'm pretty sure some ROMs already have kernel support, although I don't know details.

For some Android kernels official WireGuard application supports in-kernel module. Fox example for pixel 3.
Post reply on HN