Getting Started with WireGuard

#1

Post by miguelmota » Sun, Apr 05, 2020, 8:47 PM UTC

Getting Started with WireGuard
miguelmota.com

Re: Getting Started with WireGuard

#2

Post by greatjack613 » Tue, Apr 07, 2020, 5:27 PM UTC

> It’s kernel-based which reduces attack surface and can be ran in virtually any device.

Excuse my ignorance, but can someone explain why a kernel based networking stack has less of an attack surface then a user-space based stack?

I mean logically user-space should be more secure no?

Re: Getting Started with WireGuard

#3

Post by platz » Tue, Apr 07, 2020, 5:29 PM UTC

Do you have to use the wireguard client or could say the VPN stack in Windows be used to connect to a wireguard server?

Re: Getting Started with WireGuard

#4

Post by tjohns » Tue, Apr 07, 2020, 5:32 PM UTC

platz wrote: post #3

Do you have to use the wireguard client or could say the VPN stack in Windows be used to connect to a wireguard server?

You have to use the Wireguard client. In that regard it's similar to OpenVPN.

Wireguard uses a custom protocol that isn't supported by Windows' built-in VPN client. Most OSes only natively support IPsec/L2TP or PPTP.

Re: Getting Started with WireGuard

#5

Post by kasey_junk » Tue, Apr 07, 2020, 5:35 PM UTC

platz wrote: post #3

Do you have to use the wireguard client or could say the VPN stack in Windows be used to connect to a wireguard server?

Wiregaurd uses its own protocol.

There is a wire guard client for Windows.

Re: Getting Started with WireGuard

#6

Post by traceroute66 » Tue, Apr 07, 2020, 5:36 PM UTC

greatjack613 wrote: post #2

> It’s kernel-based which reduces attack surface and can be ran in virtually any device. Excuse my ignorance, but can someone explain why a kernel based networking stack has less of an attack surface then a user-space based stack? I mean logically user-space should be more secure no?

I have been a bit weary of the WireGuard hype for much the same reason. Surely kernel mode is (a) the equivalent of running as root (b) opens up greater attack surface by virtue of running at kernel level

Re: Getting Started with WireGuard

#7

Post by outworlder » Tue, Apr 07, 2020, 5:42 PM UTC

greatjack613 wrote: post #2

> It’s kernel-based which reduces attack surface and can be ran in virtually any device. Excuse my ignorance, but can someone explain why a kernel based networking stack has less of an attack surface then a user-space based stack? I mean logically user-space should be more secure no?

This goes both ways. Userland systems are susceptible to a myriad of attacks that a kernel, being privileged code, is not. We rely on the kernel (plus CPU rings) for most of the security enforcement in a machine, after all.

However, IF that code is compromised, the consequences are much more catastrophic.

Re: Getting Started with WireGuard

#8

Post by enrichpu » Tue, Apr 07, 2020, 5:42 PM UTC

dedea

Re: Getting Started with WireGuard

#9

Post by pkulak » Tue, Apr 07, 2020, 5:44 PM UTC

Just FYI, WireGuard is baked right into the Linux 6.x kernel. Unless you're on a rolling distro you won't see it yet, but very cool indeed.

Re: Getting Started with WireGuard

#10

Post by greatjack613 » Tue, Apr 07, 2020, 5:52 PM UTC

outworlder wrote: post #7

greatjack613 wrote: post #2

> It’s kernel-based which reduces attack surface and can be ran in virtually any device. Excuse my ignorance, but can someone explain why a kernel based networking stack has less of an attack surface then a user-space based stack? I mean logically user-space should be more secure no?

This goes both ways. Userland systems are susceptible to a myriad of attacks that a kernel, being privileged code, is not. We rely on the kernel (plus CPU rings) for most of the security enforcement in a machine, after all. However, IF that code is compromised, the consequences are much more catastrophic.

That sounds interesting.

Can you elaborate on which attacks userland system are susceptible to that a kernel is not?