Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard 1.0 for Linux 5.6

lists.zx2c4.com

Post reply on HN
Print view View original

51–60 of 214 posts

Re: WireGuard 1.0 for Linux 5.6

#51

Post by api »

tw04 wrote: post #36
katnegermis wrote: post #27

Earlier quoted context omitted.

I think this is what https://tailscale.com/ is trying to solve :) (I'm in no way affiliated, but stumbled upon it on twitter a few weeks ago)

Tailscale looks like it's creating a mesh network - he's not asking for end-users to have VPN connections between each other (what Tailscale is doing). He's asking for a central server where he can retrieve/update/manage end-user keys, likely: because helpdesk. You could in theory do this with any number of the existing team password managers, but I think he'd like integration directly to wireguard. Edit: care to rep…

We get this question about ZeroTier from time to time and the answer is the same: set rules (or ACLs in Tailscale) so as to allow only traffic to/from what you want users to communicate with.

Re: WireGuard 1.0 for Linux 5.6

#52

Post by api »

AnIdiotOnTheNet wrote: post #50
myu701 wrote: post #11

Earlier quoted context omitted.

Someone else can give a much better comparison than me, this is just to get you started. Compared to the 80% use case of OpenVPN, Wireguard is: 1. Much less code. A few thousand lines of code vs lots more for OpenVPN 2. Speedier. WG does UDP traffic so there is less overhead on the protocol level for syncs acks etc. 3. Easier on mobile battery life due to decreased complexity For one example use case comparing them s…

Wiregard may be speedier (I've never used it so I can't say for certain), but OpenVPN can also use UDP.

WG is much faster in our tests than OpenVPN, and a bit faster than IPSec depending on the system. OpenVPN uses UDP too but OpenVPN is kind of slow.

Re: WireGuard 1.0 for Linux 5.6

#53

Post by exabrial »

MartijnBraam wrote: post #44
exabrial wrote: post #39

Earlier quoted context omitted.

Yep, that's what I'm asking for... right now wireguard can only look at configuration text files AFAIK. If it had a way to invoke a command/script to lookup a key/ip, any number of external management systems could be created!

actually wireguard doesn't look at text files at all, it only has a netlink interface so you can configure it using the `ip` command. The current tools read the text files and set up the network interface.

Interesting... I'll have to take a look at what the utilities are actually done then and how they're loading the keys into the interface

Re: WireGuard 1.0 for Linux 5.6

#54

Post by dfcarney »

exabrial wrote: post #23

One thing I wish for wireguard: the ability to look up keys/ips in an external system like LDAP. I moved an entire call center [50+ people] fully remote last week. We're using wireguard. Key management stinks, and that is my only complaint! It is an incredible piece of software and I'm very thankful for it.

(Tailscale co-founder here.)

Building on what katnegermis said, this is what we're trying to help with. We integrate with identity management systems and handle the key management (and NAT traversal) on top of WireGuard, making it easier to deploy and manage.

If you're interested, a colleague of mine wrote up a blog post on how things work: https://tailscale.com/blog/how-tailscale-works/

Re: WireGuard 1.0 for Linux 5.6

#55

Post by apawloski »

wisam wrote: post #37
newscracker wrote: post #14

For anyone wanting to try it, WireGuard with Algo VPN [1] to set it up on a server is a great combination. I found it quite easy to setup and use. Algo has built-in support for various cloud providers, where, when you run it from, day, your desktop, it can setup the VPN server for you based on answers to some questions (with sensible defaults) and some information on connecting to the provider (like an API key, for e…

Just be careful when setting up Algo VPN. Its secure defaults will probably block all other services you're running on your server and render them inaccessible. You might even end up not being able to ssh to your server if you choose not to let Algo set up ssh configurations (because you have your own). I would say install Algo on a dedicated droplet or backup your VPS before setting it up.

This is the intended behavior/deployment model of Algo (as a dedicated VPN server on a dedicated VM).

If you are running other co-resident services and need more lenient firewall rules / system configuration, you should consider another option.

Re: WireGuard 1.0 for Linux 5.6

#56

Post by K0SM0S »

kertis wrote: post #45
K0SM0S wrote: post #33

Earlier quoted context omitted.

It's a lot more if you do it all manually, however for most "common" use cases, one should probably go with automatically generated config files. For instance pfSense provides you with single-click configs for any target platform, with certs, credentials etc. properly tied to some ACL or ID management system, etc. It's neat and pain-free and just works. You could learn all the theory underneath (I mean systems, IT, n…

First setup always needs to be manual.

... yes, obviously? : )

We might not be using the word "manual" to mean the same here.

I meant not writing the whole xml json yaml or whatever yourself, manually copying certs and credentials etc — you're likely to make mistakes, it's tedious and useless most of the time. You rather use tools like Viscosity. Just efficient / best practice sysadmin.

You obviously need access to the target machine in the first place... it's a VPN setup.

Re: WireGuard 1.0 for Linux 5.6

#57

Post by huijzer »

For anyone wanting to set up WireGuard with the Pi-hole DNS blocker: I would advise https://github.com/racbart/wireguard-pihole. Just a simple shell script. No Docker or Kubernetes required. I installed it on the cheapest DigitalOcean VPS, and it has been running without issues for over a month now. (About 6 phones of me and my friends, and a few desktops are using it.)

Re: WireGuard 1.0 for Linux 5.6

#58

Post by tw04 »

api wrote: post #51
tw04 wrote: post #36

Earlier quoted context omitted.

Tailscale looks like it's creating a mesh network - he's not asking for end-users to have VPN connections between each other (what Tailscale is doing). He's asking for a central server where he can retrieve/update/manage end-user keys, likely: because helpdesk. You could in theory do this with any number of the existing team password managers, but I think he'd like integration directly to wireguard. Edit: care to rep…

We get this question about ZeroTier from time to time and the answer is the same: set rules (or ACLs in Tailscale) so as to allow only traffic to/from what you want users to communicate with.

Sure - you can block access but the fundamental problem you're appearing to target isn't what he's after. Heck to even get the user-auth he's asking for you have to use tailscale + some third party app whether that's okta or azure or google. I'm not saying he can't sort-of accomplish what he's trying to do but it very much feels like you've got a hammer and think his screw looks like a nail.

Re: WireGuard 1.0 for Linux 5.6

#59

Post by fullstop »

packetlost wrote: post #30
vbezhenar wrote: post #15

Earlier quoted context omitted.

I wonder how WireGuard compares to IPsec with regards to the mobile battery. AFAIK IPsec implemented in kernel while WireGuard uses user-space implementation on mobile devices, at least for now.

The code has been merged into the kernel as of 5.4(?) I believe, but we won't see that on mobile for quite awhile. I'm guessing IPSec will still have a lead on mobile for awhile for that reason, not that it has sort of majority on there anyway.

It was merged in 5.6, which was tagged less than 24 hours ago.

Re: WireGuard 1.0 for Linux 5.6

#60

Post by alexellisuk »

middleclick wrote: post #29
myu701 wrote: post #11

Earlier quoted context omitted.

Someone else can give a much better comparison than me, this is just to get you started. Compared to the 80% use case of OpenVPN, Wireguard is: 1. Much less code. A few thousand lines of code vs lots more for OpenVPN 2. Speedier. WG does UDP traffic so there is less overhead on the protocol level for syncs acks etc. 3. Easier on mobile battery life due to decreased complexity For one example use case comparing them s…

On that note, I wish and hope Wireguard did TCP as well. Some countries block UDP traffic or at least throttle it.

Have you taken a look at inlets / inlets PRO? Might be a suitable replacement for your use-case where UDP is not available. https://docs.inlets.dev/
Post reply on HN