61–70 of 79 posts
The ball's in your court, Ubiquiti
Yeah well don't hold your breath :(. Ubiquiti has been a cluster fuck for a while now and are busy redoing and downgrading the UI again for like the 3rd or 4th time in the last few years rather then add desperately needed basic features. They've released new gateway devices with their own new distro based around containerization, then not actually put that to work at all. DNS still a joke. Zero story for key&certific…
Earlier quoted context omitted.
I understand that amateurs love the Pi and other underpowered, junk hardware, but not everybody wants yet another science project in their life.
"It's free!" they say, if you can get it to run The Geeks say, "Hey, that's half the fun!" Yeah, but I got a girlfriend, and things to get done The Linux OS SUCKS (I'm sorry to say it, but it does.) https://genius.com/Three-dead-trolls-in-a-baggie-every-os-su...
Earlier quoted context omitted.
One of the main selling points of Wireguard is that it runs much leaner than OpenVPN or IPSec tunnels, especially on embedded hardware, so there isn’t much of a workload in the first place.
Crypto used by IPSec (aes, sha) is often accelerated by hardware - and the above mentioned Ubiquiti has hardware for that. Chacha/Poly used by Wireguard are not.
https://an.undulating.space/post/181227-er_alternate_firmwar...
Of course, benchmarks from random strangers are not gospel, and the results aren’t particularly damning. But even then, you’re assuming that you have the luxury of running on a chip that comes with a hardware crypto engine. Good luck trying to get AES encryption/decryption speeds at anywhere near line rate with a Raspberry Pi or a run-of-the-mill router.
Earlier quoted context omitted.
It's not. Why would one want that workload on their router when they can offload it to a $35 Pi?
I understand that amateurs love the Pi and other underpowered, junk hardware, but not everybody wants yet another science project in their life.
That was actually really fast considering how long wireguard has(n't) been around. We don't even have it in stable Linux distributions yet. I guess there is some significant demand for it from Mikrotik's customers. I'll probably use it.
Earlier quoted context omitted.
And it's somewhat silly to freeze the kernel. The Linux kernel is meticulous about backwards compatibility. Spin up any distribution user space in docker, and watch it work.
Freezing the RH kernel is mostly to keep closed source kernel modules working. Some proprietary software has those, unfortunately.
This goes the other way around a well, they often cherry-pick new code and pull it back into their curated kernels to support the latest hardware offerings of their partners (Dell, HP, Broadcom, etc.) without pulling in possible unstable newer kernel code around it; they have contractors from those hardware companies assisting in the work to backport hardware module features.
Earlier quoted context omitted.
Anyone have any experience here with getting wireguard running on pfsense?
I don't think *BSD supports wg yet. would love to see this