Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard 1.0 for Linux 5.6

lists.zx2c4.com

Post reply on HN
Print view View original

171–180 of 214 posts

Re: WireGuard 1.0 for Linux 5.6

#171

Post by jbverschoor »

kalaracey wrote: post #169
dfcarney wrote: post #54

Earlier quoted context omitted.

(Tailscale co-founder here.) Building on what katnegermis said, this is what we're trying to help with. We integrate with identity management systems and handle the key management (and NAT traversal) on top of WireGuard, making it easier to deploy and manage. If you're interested, a colleague of mine wrote up a blog post on how things work: https://tailscale.com/blog/how-tailscale-works/

Tailscale looks awesome but I would love a tier between “free single user with gmail” and “$10/user/month + GSuite/etc” (GSuite itself is $5/user/month I think?). Something like 1Password’s family plan, with the ability to use gmail accounts. Then I would use it for my family, e.g. I could replace DynDNS + port forwarding I set up so my dad can control his home automation software (Hass.io) from his iPhone app, even…

Zerotier has a free plan

Re: WireGuard 1.0 for Linux 5.6

#172

Post by cyphar »

yjftsjthsd-h wrote: post #162
cyphar wrote: post #89

Earlier quoted context omitted.

WireGuard on Linux has always been implemented as a kernel module (a very small one at that). If you've used it on Linux, you've used the code that has been included in Linux 5.6. This is about the code being merged upstream into the main kernel repository which means that it'll likely be built-in to lots of distribution kernels and will no longer have the second-class status that most out-of-tree kernel modules have…

Well, strictly you could use the userspace implementations on Linux (which I looked at because I wanted to try running it in a Docker container, which does work with openconnect).

You could, and that's how the Android version works (at least, until Android has wireguard.ko built-in -- the WireGuard app supports both versions). But if you're using it on Linux you're almost certainly using the kernel module.

Re: WireGuard 1.0 for Linux 5.6

#173

Post by kikoreis »

cjbprime wrote: post #115
laktak wrote: post #74

I use WireGuard and it works perfectly fine as it is. Can someone explain why we need/want to put it into the Linux kernel?

The version you've been using on Linux was already in the Linux kernel. It's a Linux kernel module. Now it's just part of the official Linux source release, so groups like Linux distributions such as Ubuntu will start turning it on by default.

Indeed, and it's worth calling out that we've worked to ensure that 20.04 LTS, which will ship with 5.4, does have Wireguard support featured in it.

Re: WireGuard 1.0 for Linux 5.6

#174

Post by place1 »

I'm a big fan of Wireguard. I wrote wg-access-server [1] as an all-in-one wireguard VPN solution. I recently added some docs [2] and support for deploying with Helm. I'd love some feedback on here or on github. Give it a try.

[1] https://github.com/place1/wg-access-server [2] https://place1.github.io/wg-access-server/

Re: WireGuard 1.0 for Linux 5.6

#175

Post by place1 »

djsumdog wrote: post #90
kertis wrote: post #42

Earlier quoted context omitted.

I suppose because of DNS servers. Shops give you own "correct" dns for showing you adds on any first request.

You can use iodine for those wi-fi hotspots that charge for access. It tunnels TCP-over-DNS

I never even thought about using a DNS based tunnel for this problem. Amazing.

Re: WireGuard 1.0 for Linux 5.6

#176

Post by nielsole »

DaniloDias wrote: post #161
kaylynb wrote: post #150

WireGuard is great, but I think it's really undersold when it's described as being just a vpn. It's really an encrypted tunnel that is configured like a network adapter in the Linux network stack. This lets you configure it with stuff like systemd-networkd and unit files, or easily spin up a tunnel with a few `ip` commands, and setup some simple nftables rules to do all sorts of stuff. I do use it as a vpn as well, b…

Is there an application for containers? E.g. a way to set up an encrypted tunneling interface between containers that would allow you to avoid using TLS between the containers?

There is a wireguard network plugin for kubernetes

Re: WireGuard 1.0 for Linux 5.6

#177

Post by nikisweeting »

tjoff wrote: post #127

Does anyone know of a decent bash-script (or even self-hosted page) that one could use to administer wireguard? Could go very far with trivial functionality, such as listing, adding, removing users and download a config file/qr-code.

There are a bunch listed here:

https://github.com/pirate/wireguard-docs#wireguard-setup-too...

Re: WireGuard 1.0 for Linux 5.6

#178

Post by terrywang »

Very exciting news, indeed! Finally WireGuard is in the Linux kernel 5.6 onwoards (will arrive soon in the next few days for those who are on rolling releases).

I've been using WireGuard to replace IPsec (strongSwan - the whole stack is way too complex, plus client configuration issues, outweighs the benefits) and OpenVPN (latency, bandwidth / performance is the biggest complaint) for remote access and mainly encrypting traffic from/to terminal devices when accessing the Internet via unknown hops/routes/path.

On the other hand, WireGuard is simple (cryptokey routing), modern, elegant, easy to configure & use, fast, and most importantly, reliable over the past 2.5 years, now even better without DKMS headaches ;-)

WireGuard clients for iOS (works as good as strongSwan for Android - which I missed a while ago) in terms of 1. on-demand 2. roaming between networks 3. power consumption / overhead. macOS and Windows ones also work very well.

Problems: WireGuard does not scale well when used for global overlay network use cases (nebula does a much better job for this purpose). Another issue for VPN providers: each client has a static IP configuration, which contradicts with privacy and surveillance, curious to see how Cloudflare's 1.1.1.1 solves the problem.

Last but not least: WireGuard protocol is easy to block. Therefore, I look forward to seeing obfuscation plugins / extensions for WireGuard, it will serve a much bigger purpose for people who live under censorship/surveillance (e.g. inside GFW) so as to protect privacy and get back their rights to access the `real` Internet.

Many thanks to Jason and the WireGuard team behind the scene!

Re: WireGuard 1.0 for Linux 5.6

#179

Post by zx2c4 »

terrywang wrote: post #178

Very exciting news, indeed! Finally WireGuard is in the Linux kernel 5.6 onwoards (will arrive soon in the next few days for those who are on rolling releases). I've been using WireGuard to replace IPsec (strongSwan - the whole stack is way too complex, plus client configuration issues, outweighs the benefits) and OpenVPN (latency, bandwidth / performance is the biggest complaint) for remote access and mainly encrypt…

Your first point: There's no part of WireGuard that inherently demands the use of a static IP address. You can run whatever dynamic IP protocol you want inside of it or outside of it. The entire interface configuration is dynamically configurable at runtime. We're working on one called wg-dynamic, but others have done others.

Your second point: Obfuscation protocols can encapsulate WireGuard just fine.

Re: WireGuard 1.0 for Linux 5.6

#180

Post by terrywang »

nielsole wrote: post #176
DaniloDias wrote: post #161

Earlier quoted context omitted.

Is there an application for containers? E.g. a way to set up an encrypted tunneling interface between containers that would allow you to avoid using TLS between the containers?

There is a wireguard network plugin for kubernetes

Gravitational has built something called wormhole (clashes with magic wormhole, bad naming, isn't? Some other hold can be better) https://github.com/gravitational/wormhole

It can be used to replace flannel if encryption in transit is required.

Post reply on HN