WireGuard 1.0 for Linux 5.6 • Hacker News Board

Re: WireGuard 1.0 for Linux 5.6

#201

Post by Coritenst » Tue, Mar 31, 2020, 3:35 PM UTC

wolrah wrote: post #34

rubenbe wrote: post #19

Earlier quoted context omitted.

Does the VPS have unencrypted access to the VPN? It's something I would want to avoid. (A VPS is a prime candidate to be compromised)

In the scenario proposed the VPS is the VPN endpoint. It's an alternative to commercial VPN services or hosting something on your own systems. Whether that fits your security scenario is up to you. If your primary goal is to get from an untrusted network (say public wifi) to a trusted network then a VPS with a provider you trust is great.

And you can push a new VPN on a new VPS with a different cloud provider. Every month. More or less

Re: WireGuard 1.0 for Linux 5.6

#202

Post by ShamelessC » Tue, Mar 31, 2020, 3:49 PM UTC

place1 wrote: post #174

I'm a big fan of Wireguard. I wrote wg-access-server [1] as an all-in-one wireguard VPN solution. I recently added some docs [2] and support for deploying with Helm. I'd love some feedback on here or on github. Give it a try. [1] https://github.com/place1/wg-access-server [2] https://place1.github.io/wg-access-server/

Looks nice. Is it possible to run this on a raspberry pi?

Re: WireGuard 1.0 for Linux 5.6

#203

Post by AirborneUnicorn » Tue, Mar 31, 2020, 4:10 PM UTC

nielsole wrote: post #176

DaniloDias wrote: post #161

Earlier quoted context omitted.

Is there an application for containers? E.g. a way to set up an encrypted tunneling interface between containers that would allow you to avoid using TLS between the containers?

There is a wireguard network plugin for kubernetes

Could you provide a link?

Re: WireGuard 1.0 for Linux 5.6

#204

Post by kungtotte » Tue, Mar 31, 2020, 4:50 PM UTC

dfc wrote: post #199

kungtotte wrote: post #192

Earlier quoted context omitted.

Three of the top 20 list on distrowatch are Arch or Arch derivatives, including the number 2 spot. Its wiki is widely recommended as well for users of any distro. "Niche" is a bad way to describe Arch. It's probably more likely that a person interested in setting up WireGuard and their own VPN are running Arch or a derivative than any other distro.

I love Arch's wiki and the userbase's enthusiasm. But how in the world do you think Arch is the most probable distro base for a wg user? Using your distrowatch reference, 4 of the top 5 are Debian based.

I was looking at it from a perspective of who would be likely to install WG and set up their own VPN. This is me guessing (that's why I hedged and said probably), but I suspect there is great overlap in the tinkering and DIY attitude of Arch users and WG users.

Mostly I was responding to the statement that Arch was a niche distro.

Re: WireGuard 1.0 for Linux 5.6

#205

Post by yencabulator » Tue, Mar 31, 2020, 4:50 PM UTC

tw04 wrote: post #20

kertis wrote: post #12

Earlier quoted context omitted.

Among other features WireGuard has roaming mode, it's fantastic for mobile devices. Just try it, it's easy and quick!

In my experience the problem with roaming mode is it blocks the login page for wireless networks. IE: in a coffee shop. Maybe that's been fixed recently, but it was a giant PITA in the past.

You could run a portal login helper in a network namespace that doesn't go through the vpn. https://www.chromium.org/chromium-os/chromiumos-design-docs/...

Re: WireGuard 1.0 for Linux 5.6

#206

Post by hitpointdrew » Tue, Mar 31, 2020, 4:52 PM UTC

rubenbe wrote: post #135

fraidy-cat wrote: post #61

Earlier quoted context omitted.

> Does the VPS have unencrypted access to the VPN? Not quite sure what you are asking about in this first part of your comment, but I'll get back to that. Firstly though, I think I might see what you are getting at, but correct me if I am misunderstanding what you are saying. > It's something I would want to avoid. (A VPS is a prime candidate to be compromised) So, I think that what you are saying here is that by pas…

Thanks for the elaborate answer on my, in hindsight, not very clear question. The use case I was referring too is where the VPN is between e.g. your corporate network and your pc when working from home. In this case the VPS doesn't need to see the unencrypted traffic. A sibling comment made clear that the ansible recipe mentioned is to setup a VPN between e.g. a laptop in the VPS.

>The use case I was referring too is where the VPN is between e.g. your corporate network and your pc when working from home. In this case the VPS doesn't need to see the unencrypted traffic.

Your corporate IT should be providing you with VPN access directly to your corporate network. You should not be using a private VPN in addition to using your corporate VPN when working.

A VPN on a VPS would be ONLY for personal use (unless of course you are self-employed, the business owner, an independent contractor, etc.).

I would review your IT policy, you are probably breaching your policy if you are using a company owned machine to connect to your private VPN on a VPS.

Re: WireGuard 1.0 for Linux 5.6

#207

Post by yencabulator » Tue, Mar 31, 2020, 4:55 PM UTC

peterwwillis wrote: post #119

I like the idea of WireGuard as a simple tunnel, but I wish people would stop comparing it with VPNs. VPNs have lots of extra functionality that is necessary to support a variety of use cases, both functionally (like pushing routes or scripts to clients) and security-wise (like real key management and SSO). I literally can't replace any VPN I currently use with Wireguard because I would lose needed functionality. I c…

An an ex-OpenVPN user, I consider the ability of the server to push arbitrary scripts to the client an antifeature and a security problem that needs to be carefully mitigated every time.

Re: WireGuard 1.0 for Linux 5.6

#208

Post by d00bianista » Tue, Mar 31, 2020, 4:56 PM UTC

L_Rahman wrote: post #134

eadmund wrote: post #26

Earlier quoted context omitted.

I think the idea is that you're supposed to build a system to manage WireGuard using that sort of information. I.e. WireGuard provides the basic primitives and second- or third-party tooling uses them. I like that idea, because it means that the actual WireGuard core is small and it's usable right now. It is annoying that someone hasn't yet developed neat integrations for WireGuard and stuff I might want to use, but…

I'm looking forward to the days when we have good user management for Wireguard. It's so hard to scale it across just my family right now.

Like a good Unix tool, that's outside of WG's scope. User management is done with the likes of LDAP and such.

Re: WireGuard 1.0 for Linux 5.6

#209

Post by jblwps » Tue, Mar 31, 2020, 8:19 PM UTC

borplk wrote: post #167

Could WireGuard be a good choice for server-to-server encryption instead of TLS? (for example between a TLS terminating load balancer to the application servers)

What net benefits would you see that having? If I'm allowed to assume that you wouldn't use TLS because of PKI management concerns, I have a hard time seeing how using WireGuard in the large wouldn't have the same problems--you still have to build some kind of management platform on top that verifies host authenticity (ultimately including revocations and more). That is to say, WireGuard in the large will surely (right?) need supporting PKI.

Re: WireGuard 1.0 for Linux 5.6

#210

Post by sandGorgon » Tue, Mar 31, 2020, 8:30 PM UTC

dfcarney wrote: post #54

exabrial wrote: post #23

One thing I wish for wireguard: the ability to look up keys/ips in an external system like LDAP. I moved an entire call center [50+ people] fully remote last week. We're using wireguard. Key management stinks, and that is my only complaint! It is an incredible piece of software and I'm very thankful for it.

(Tailscale co-founder here.) Building on what katnegermis said, this is what we're trying to help with. We integrate with identity management systems and handle the key management (and NAT traversal) on top of WireGuard, making it easier to deploy and manage. If you're interested, a colleague of mine wrote up a blog post on how things work: https://tailscale.com/blog/how-tailscale-works/

This looks pretty interesting. Can I setup a sink inside my AWS vpc ? So that everyone can access my RDS database?

It would be great if Tailscale had its independent 2-fa that I fan use through any hardware key (for compliance reasons), rather than go through Google.