Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH and User-Mode IP WireGuard

fly.io

Post reply on HN
Print view View original

21–30 of 104 posts

Re: SSH and User-Mode IP WireGuard

#21

Post by 177tcca »

devwastaken wrote: post #10
resoluteteeth wrote: post #3

Maybe you should put this up on github so everyone can use it rather than just talking about how easy it is?

I believe all informational blogs/guides should backup to a markdown file on GitHub or other. Over time playing with technologies I've found a lot of dead links to personal websites. This is of course because maintaining your own hosting can be cumbersome, domain name expirey, etc. Some valuable information gets lost with only waybackmachine to save the day. Someday wayback may no longer exist though.

Same with GitHub.

Any Git opening will do, for private cloning.

Re: SSH and User-Mode IP WireGuard

#22

Post by Panino »

tptacek wrote: post #6
bluesign wrote: post #4

Is this super complex infrastructure for fairly simple thing or am I missing something?

No, it is extra-super complex infrastructure for a fairly simple thing. Normal SSH still works, and is usually going to be what people end up using. You just have to have WireGuard installed and running. The product feature here is less interesting than how we did it.

Please keep writing about WireGuard. If it wasn't already magical enough for its stated purpose (VPN), maybe the "truly" interesting thing is how it can enable tech that wasn't previously envisioned. After using WireGuard for a couple years I'm still excited about it because I feel like I've only glimpsed a small piece of the things that can be done with it.

Re: SSH and User-Mode IP WireGuard

#23

Post by azalemeth »

I know it's not really an HN thing to say, but this is just cool. Reverse ssh tunnels on Wireguard through my VPN are cool enough; the amount of magic here (albeit I think perhaps not totally strictly required magic…) is definitely interesting++.

Re: SSH and User-Mode IP WireGuard

#24

Post by rileymichael »

Pretty cool write up. It mentions that every host is running a DNS server that instances have access to, which is being utilized to store the public key (neat!)... is there any way for customers to consume this for other purposes, say out of the box service (instance) discovery?

Re: SSH and User-Mode IP WireGuard

#25

Post by tptacek »

rileymichael wrote: post #24

Pretty cool write up. It mentions that every host is running a DNS server that instances have access to, which is being utilized to store the public key (neat!)... is there any way for customers to consume this for other purposes, say out of the box service (instance) discovery?

Yes; the original purpose of private DNS at Fly was for service discovery. `your-app.internal` is the AAAA's of every instance for your-app; `nrt.your-app.internal` every instance in Japan, `aws-rds-1._peer.internal` is AAAA for the other side of a WireGuard gateway you created to bridge your apps to an RDS database, etc.

Re: SSH and User-Mode IP WireGuard

#26

Post by tptacek »

majke wrote: post #15

This sounds very similar to my slirpnetstack, which is using gvisor netstack to do, which I call translating L3 (packets) into L7 (userspace syscalls like connect()): https://github.com/majek/slirpnetstack/ (btw, gvisor netstack, while not without problems, is likely to be faster than libslirp, see benchmarks https://github.com/rootless-containers/rootlesskit/pull/101#... )

It is extremely similar, and thanks for posting this, I had no idea.

Re: SSH and User-Mode IP WireGuard

#28

Post by tptacek »

im3w1l wrote: post #27

I read this but I didn't get it at all. I can't see the forest for all the excited talk about particular trees. In simple words, what problem are they trying to solve?

You need WireGuard to SSH to machines at Fly (that's a good thing). You don't have WireGuard installed on a particular machine. That's OK, because there's a portable, userland, Golang implementation of not only WireGuard but all of TCP/IP that can be imported into any Go program. Go programs can BYO network stacks. That's crazy. The end.

Re: SSH and User-Mode IP WireGuard

#29

Post by vlmutolo »

> Normally, this big balloon thingy would be an elaborate scheme to get you to check out our product, but here it's just pointing out some new source code we haven't talked about elsewhere.

I really enjoy this style of writing from a company.

Regarding the article, it seems like Fly has pulled off some insane networking nonsense, but I don’t know enough about networking yet to understand it. Saving this page for later and gonna get back to the TCP/IP Guide.

Re: SSH and User-Mode IP WireGuard

#30

Post by mrkurt »

im3w1l wrote: post #27

I read this but I didn't get it at all. I can't see the forest for all the excited talk about particular trees. In simple words, what problem are they trying to solve?

We are a hosting company. Customer apps run in isolated private networks. We let them connect to these private networks with WireGuard. Customers _also_ want to do things like "launch a console", so we give them a mechanism for SSHing into their running containers over their private network (6PN).

WireGuard is dead simple, but setting it up is extra cognitive friction if you've never dealt with it before (or if you're in an environment where you can't create a network interface). Jason Donenfield did some magic with a Google user space networking stack that lets us "hide" the wireguard component. People using our CLI will soon be able to connect to their private network + SSH into a container with one command.

Basically, WireGuard is cool and being able to connect into a wireguard network from a userland program is really helpful for building a straightforward UX.

Post reply on HN