Earlier quoted context omitted.
I just sent 200MiB of zeros over my wireguard connection to my VPS and my transmit counter on my wifi card went up by 238MB. Vs sending 1024MiB over just wifi to my Pi where the transmit counter went up by 1.04GiB.
Is this one of those cases where is Wireguard implemented traffic compression as a "feature" it would become a huge security flaw? I remember hearing that this is the case for naive HTTPS compression, but I never properly had insight in the how.
Getting Started with WireGuard
71–72 of 72 posts
Re: Getting Started with WireGuard
#72Earlier quoted context omitted.
The community kind of skipped right over nftables to BPF. Simple use cases use iptables, complicated ones use BPF, nftables isn't flexible enough for the complicated use cases so everyone keeps using iptables.
What is BPF (in the context of iptables/nftables replacement) exactly? I tried searching for it, but only found some articles about early stage kernel support. Nothing about userspace or how to use it at all. It looks like there's still no BPF firewall at this time.
We're using BPF for packet filtering in production on my team today, but it's not directly an iptables/nftables replacement- it's an entire kernel subsystem used in several parts of the kernel and also useful for diverse use cases such as performance profiling, syscall tracing and packet filtering. It's also seen rapid development in recent kernels and most internet articles about it are out of date.
Something I wrote for the ArchWiki [1]:
> BPF is a system used to load and execute bytecode within the kernel dynamically during runtime. It is used in a number of Linux kernel subsystems such as networking (e.g. XDP, tc), tracing (e.g. kprobes, uprobes, tracepoints) and security (e.g. seccomp). It is also useful for advanced network security, performance profiling and dynamic tracing.
> BPF was originally an acronym of "Berkeley Packet Filter" since the original classic BPF was used for packet capture tools for BSD. This eventually evolved into Extended BPF (eBPF), which was shortly afterwards renamed to just BPF (not an acronym). BPF should not be confused with packet filtering tools like iptables or netfilter, although BPF can be used to implement packet filtering tools.
lwn.net has a decent (although 3 years old) intro article [2]. Cilium has a good document on how they use BPF to implement a packet filter [3].
[1] https://wiki.archlinux.org/index.php/Security#BPF_hardening