Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard 1.0 for Linux 5.6

lists.zx2c4.com

Post reply on HN
Print view View original

131–140 of 214 posts

Re: WireGuard 1.0 for Linux 5.6

#131

Post by kryogen1c »

zeveb wrote: post #101
bawolff wrote: post #73

Earlier quoted context omitted.

That's kind of a tautology. If you assume the system is insecure, then yes its going to be insecure with that assumption. This is going to be true of any VPN system, so i think its an unfair criticism to level against this particular VPN setup. If you want to be secure against local adversaries, use TOR.

> That's kind of a tautology. More specifically, it's begging the question. The actual definition of begging the question, not the mistaken usage. To beg the question is to assume the thing which is to be proven.

this is my favorite extremely annoying but massively useful "acktually..."

begging the question as a logical fallacy is prevalent in politics and media representations, and is a differentiatior between reasoned debate and talking head nonsense.

Polictician 1: UBI! P2: free market competition! P1: why do you want poor people to suffer, P2?!

P2: 2nd amendment! P1: Ban firearms! P2: why do you want americans to be put in danger, P1?!

both of these are begging the question

Re: WireGuard 1.0 for Linux 5.6

#132

Post by outworlder »

Glosster wrote: post #107

Do I understand correctly? You use WireGuard to set up your own VPN servers? Doing this is a lot more expensive than buying a VPN subscription, but it can be more secure if you know what you're doing, right?

'Buying a VPN subscription' is just one use-case. Usually, those VPN services are intended to be used to circumvent geo restrictions.

WireGuard is not only about that. Sure you could do it. But it is applicable for any use-case where you have two or more machines that need to talk over a secure tunnel, over an otherwise not proven to be secure network(which is usually, but not always, the Internet). This ranges from connecting to a machine you have at home, to exchanging data between two office branches, and so on.

Re: WireGuard 1.0 for Linux 5.6

#133

Post by L_Rahman »

mcdevilkiller wrote: post #123
newscracker wrote: post #14

For anyone wanting to try it, WireGuard with Algo VPN [1] to set it up on a server is a great combination. I found it quite easy to setup and use. Algo has built-in support for various cloud providers, where, when you run it from, day, your desktop, it can setup the VPN server for you based on answers to some questions (with sensible defaults) and some information on connecting to the provider (like an API key, for e…

I id have some problems with algo behind a NAT. Though my usecase is a bit different, more of a road warrior, as I wanted to be able to access a server in one property (behind NAT) from my home PC (also NAT). I suppose I just need port forwarding.

I was in a similar situation. Port forwarding worked perfectly. In my case the server I was trying to access was behind an ISP (Comcast) managed NAT so I had to go through them to open the port. Much to my surprise they were extremely helpful and understanding of the request.

Re: WireGuard 1.0 for Linux 5.6

#134

Post by L_Rahman »

eadmund wrote: post #26
exabrial wrote: post #23

One thing I wish for wireguard: the ability to look up keys/ips in an external system like LDAP. I moved an entire call center [50+ people] fully remote last week. We're using wireguard. Key management stinks, and that is my only complaint! It is an incredible piece of software and I'm very thankful for it.

I think the idea is that you're supposed to build a system to manage WireGuard using that sort of information. I.e. WireGuard provides the basic primitives and second- or third-party tooling uses them. I like that idea, because it means that the actual WireGuard core is small and it's usable right now. It is annoying that someone hasn't yet developed neat integrations for WireGuard and stuff I might want to use, but…

I'm looking forward to the days when we have good user management for Wireguard. It's so hard to scale it across just my family right now.

Re: WireGuard 1.0 for Linux 5.6

#135

Post by rubenbe »

fraidy-cat wrote: post #61
rubenbe wrote: post #19

Earlier quoted context omitted.

Does the VPS have unencrypted access to the VPN? It's something I would want to avoid. (A VPS is a prime candidate to be compromised)

> Does the VPS have unencrypted access to the VPN? Not quite sure what you are asking about in this first part of your comment, but I'll get back to that. Firstly though, I think I might see what you are getting at, but correct me if I am misunderstanding what you are saying. > It's something I would want to avoid. (A VPS is a prime candidate to be compromised) So, I think that what you are saying here is that by pas…

Thanks for the elaborate answer on my, in hindsight, not very clear question.

The use case I was referring too is where the VPN is between e.g. your corporate network and your pc when working from home. In this case the VPS doesn't need to see the unencrypted traffic.

A sibling comment made clear that the ansible recipe mentioned is to setup a VPN between e.g. a laptop in the VPS.

Re: WireGuard 1.0 for Linux 5.6

#136

Post by BrandoElFollito »

tjoff wrote: post #127

Does anyone know of a decent bash-script (or even self-hosted page) that one could use to administer wireguard? Could go very far with trivial functionality, such as listing, adding, removing users and download a config file/qr-code.

Please have a look at https://github.com/vx3r/wg-gen-web. It is great and the dev is very responsive.

It was featured on Show HN but did not get enough traction.

Re: WireGuard 1.0 for Linux 5.6

#137

Post by dang »

MrStonedOne wrote: post #129

This is not an appropriate announcement post for a product, as it does not explain what the fuck a wireguard is, and given that it has been in beta up until now, the number of people who read hacker news and won't know what the fuck a wireguard is, is high enough to warrant only a proper announcement post for the product.

We assume HN readers are smart enough to figure things out.

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

https://arstechnica.com/gadgets/2020/03/wireguard-vpn-makes-... is a related article, if that helps!

Re: WireGuard 1.0 for Linux 5.6

#139

Post by baseballdork »

gen220 wrote: post #117
willis936 wrote: post #75

Earlier quoted context omitted.

I am actually not sure. I know raspbian has modifications in it that take care of board specific issues in it, such as high power consumption/heat from some issue related to USB PD and/or power states. I am not too familiar with the inner workings of distros and how hardware-specific fixes are propagated, but I like the idea of sticking with officially supported OS/hardware combos for "set and forget" boxes. Wireguar…

YMMV, but I was able to get https://archlinuxarm.org/ running on my pis without too much head-scratching. arch is on 5.5.6 as of 3/1/2020 ( https://www.archlinux.org/download/ ), and it seems like the ARM porters are pretty good about keeping their project in sync (two day delay): http://de3.mirror.archlinuxarm.org/os/rpi/ . My best guess is that by April or May, Arch will do the minor version bump, and then a couple…

Arch is on 5.5.13 and has already been marked out of date: https://www.archlinux.org/packages/core/x86_64/linux/

I would guess that we'll get 5.6 in the coming days.

Re: WireGuard 1.0 for Linux 5.6

#140

Post by kitotik »

stock_toaster wrote: post #128
felipelemos wrote: post #94

Earlier quoted context omitted.

I don't think there license would be a problem, as it's GPLv2, not v3. But the 'not invented here' syndrome is very real.

Boringtun is bsd licensed. clean room implementations and all that... https://github.com/cloudflare/boringtun

Good point, but that’s still a userspace implementation.

Apple would need to do the XNU work since their open source model is so broken, and they seemed to have deprioritized Unix nerds awhile back so…

Post reply on HN