Getting Started with WireGuard • Hacker News Board

Re: Getting Started with WireGuard

#51

Post by eximius » Wed, Apr 08, 2020, 1:21 AM UTC

greatjack613 wrote: post #10

outworlder wrote: post #7

Earlier quoted context omitted.

This goes both ways. Userland systems are susceptible to a myriad of attacks that a kernel, being privileged code, is not. We rely on the kernel (plus CPU rings) for most of the security enforcement in a machine, after all. However, IF that code is compromised, the consequences are much more catastrophic.

That sounds interesting. Can you elaborate on which attacks userland system are susceptible to that a kernel is not?

A userland process can view/edit the memory of another userland process. Not so with kernel processes.

Re: Getting Started with WireGuard

#52

Post by usr1106 » Wed, Apr 08, 2020, 5:02 AM UTC

eximius wrote: post #51

greatjack613 wrote: post #10

Earlier quoted context omitted.

That sounds interesting. Can you elaborate on which attacks userland system are susceptible to that a kernel is not?

A userland process can view/edit the memory of another userland process. Not so with kernel processes.

Viewing/editing of another userland process is usually done using ptrace(2). Yama Linux security module prevents that unless you are root to disable it. It is active by default on Ubuntu.

Also reading /proc/nnnn/mem does not work even for your own processes and even though file node protections seem to allow it, not sure where that security enhancement comes from.

Re: Getting Started with WireGuard

#53

Post by ur-whale » Wed, Apr 08, 2020, 8:43 AM UTC

One thing that is imo downplayed about WireGuard as opposed to other VPNs is ease of use, specifically: - setup is easy - automated config of large setups is easy - it is extremely resilient under network temporary failure

Re: Getting Started with WireGuard

#54

Post by mqus » Wed, Apr 08, 2020, 8:53 AM UTC

parshimers wrote: post #31

If you're using NetworkManager and wireguard, try out the integration between the two as well. It lets you treat the tunnel as any other VPN in nm, and also easily avoids some issues with routing loops if you roam back on to your home network. Before, I always had to manually use wg-quick when I came back home or left. http://blogs.gnome.org/thaller/2019/03/15/wireguard-in-netwo...

In my experience, this does work somewhat, but doesn't set up the routes properly[1] and doesn't provide an interface to the networkmanager applet, so you are still left with configuring the profiles in the terminal. There is much left to be desired. Sadly the third-party plugin isn't much better and seems to be discontinued[2].

[1] https://forum.manjaro.org/t/wireguard-with-networkmanager-1-... [2] https://github.com/max-moser/network-manager-wireguard/

Re: Getting Started with WireGuard

#55

Post by afiori » Wed, Apr 08, 2020, 9:32 AM UTC

nightfly wrote: post #21

squarefoot wrote: post #19

Does wireguard have a noticeable overhead wrt data size compared to a unencrypted connection? I was thinking of setting up it on a small RPi-Like board at home, then on the laptop I carry around (when the lockdown is over). The purpose would be connecting to the Internet through the home broadband public IP which could be handy. However the laptop connects through a metered 4G connection which, although the data cap…

I just sent 200MiB of zeros over my wireguard connection to my VPS and my transmit counter on my wifi card went up by 238MB. Vs sending 1024MiB over just wifi to my Pi where the transmit counter went up by 1.04GiB.

Is this one of those cases where is Wireguard implemented traffic compression as a "feature" it would become a huge security flaw?

I remember hearing that this is the case for naive HTTPS compression, but I never properly had insight in the how.

Re: Getting Started with WireGuard

#56

Post by borplk » Wed, Apr 08, 2020, 9:41 AM UTC

Does anyone have a guide for setting up server-to-server wireshark connection?

Everything I have found so far is about consumer VPN stuff.

I'm interested in possibly using wireshark for server-to-server as a less painful alternative to TLS.

Re: Getting Started with WireGuard

#57

Post by brentis » Wed, Apr 08, 2020, 9:55 AM UTC

api wrote: post #40

fairramone wrote: post #35

Earlier quoted context omitted.

Crusty stalwart here. I'd love to get off crusty VPN concentrators. I'd personally love to see something in the open source space that supports 2FA and a rich, user-based policy language. Tailscale is trying to deliver an enterprise product that builds this on top of Wireguard. I'm not aware of any open source approaches tackling this problem like Tailscale, but I'm keenly interested.

Curious if you can provide any links to exactly what you need. 2FA is obvious but what kinds of policy languages are you thinking of? There are numerous variations out there.

Look up Appgate sdp

Re: Getting Started with WireGuard

#58

Post by franga2000 » Wed, Apr 08, 2020, 10:39 AM UTC

borplk wrote: post #56

Does anyone have a guide for setting up server-to-server wireshark connection? Everything I have found so far is about consumer VPN stuff. I'm interested in possibly using wireshark for server-to-server as a less painful alternative to TLS.

Assuming you meant Wireguard both times, I have a small guide I wrote for my team that I can throw up on my site. If I don't post a link here in a couple hours, reply here so I get a notification.

Re: Getting Started with WireGuard

#59

Post by jtvjan » Wed, Apr 08, 2020, 10:47 AM UTC

borplk wrote: post #56

Does anyone have a guide for setting up server-to-server wireshark connection? Everything I have found so far is about consumer VPN stuff. I'm interested in possibly using wireshark for server-to-server as a less painful alternative to TLS.

It's not really different from what's shown here, only you set AllowedIPs to a single address instead of all addresses (0.0.0.0/0). Here's a short guide I just wrote: https://jtvjan.nl/documents/s2s-wireguard.md

Re: Getting Started with WireGuard

#60

Post by franga2000 » Wed, Apr 08, 2020, 11:40 AM UTC

mqus wrote: post #54

parshimers wrote: post #31

If you're using NetworkManager and wireguard, try out the integration between the two as well. It lets you treat the tunnel as any other VPN in nm, and also easily avoids some issues with routing loops if you roam back on to your home network. Before, I always had to manually use wg-quick when I came back home or left. http://blogs.gnome.org/thaller/2019/03/15/wireguard-in-netwo...

In my experience, this does work somewhat, but doesn't set up the routes properly[1] and doesn't provide an interface to the networkmanager applet, so you are still left with configuring the profiles in the terminal. There is much left to be desired. Sadly the third-party plugin isn't much better and seems to be discontinued[2]. [1] https://forum.manjaro.org/t/wireguard-with-networkmanager-1-... [2] https://github.co…

I seem to recall configuring it entirely (sans key generation) in KDE Plasma network settings. I'm guessing you're referring to another applet?