Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

lists.zx2c4.com

Post reply on HN
Print view View original

51–60 of 187 posts

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#51

Post by eptcyka »

brian_herman wrote: post #49
Panino wrote: post #4

Very impressive performance: > While performance is quite good right now (~7.5Gbps TX on my small test box), not a lot of effort has yet been spent on optimizing it > Jonathan Tooker reported to me that, on his system with an Intel AC9560 WiFi card, he gets ~600Mbps without WireGuard, ~600Mbps with wireguard-go/Wintun over Ethernet, ~95Mbps with wireguard-go/Wintun over WiFi, and ~600Mbps with WireGuardNT over WiFi.…

Yes, I am gonna reinstall wireguard on my raspberry pi again. This is amazing news. And I will try and getting my windows server ryzen pc to be a router so I can benchmark all four configs.

If you're running a recent enough kernel, it's technically already there, maybe without the userspace tools.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#52

Post by londons_explore »

yobert wrote: post #5
nixcraft wrote: post #2

I would like to see 2FA (app or security key) support built into WireGuard. Otherwise, it is perfect as compared to the OpenVPN mess.

Think of wireguard as the plumbing. There will be a plethora of things available on top of wireguard that will enable all sorts of easy authentication options. (For example, TailScale.)

And will, themselves, lead to a new kind of incompatibility mess...

"Oh, I'm afraid the EasySecureAuth wireguard server doesn't support the AndroidWireClient client when using a Yubikey version 1. Either use version 2 or switch to iOS."

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#53

Post by stjohnswarts »

nixcraft wrote: post #2

I would like to see 2FA (app or security key) support built into WireGuard. Otherwise, it is perfect as compared to the OpenVPN mess.

I think you'll have to use other options for that. I don't see them ever implementing 2FA as that is outside the goals of the project. They want to keep it has slim, performant, and on target as possible.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#54

Post by IshKebab »

dsr_ wrote: post #20
kzrdude wrote: post #18

What is WireGuard, is it a new protocol? Or a new algorithm for implementing an existing thing? (Or something else)

wireguard is a VPN technology that is now integrated into the Linux kernel, and is available on all major platforms. It distinguishes itself from other VPNs by not having knobs to twiddle. Should a security issue arise, it will be necessary to replace it with a wireguard2 or such. This also means that it's very hard to get it wrong in config; either it works or it doesn't, and if it doesn't, you haven't got it workin…

Except FreeBSD which is used for pfSense - a popular firewall. They're working on it though. There was a bit of drama about it a few months ago when a shoddy implementation was merged.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#55

Post by tptacek »

kzrdude wrote: post #18

What is WireGuard, is it a new protocol? Or a new algorithm for implementing an existing thing? (Or something else)

I think you could reasonably look at WireGuard as a repudiation of previous VPN protocols, almost from root to branch.

For instance, WireGuard reconsiders what the role of a VPN "protocol" actually is, and in WireGuard the protocol itself delivers a point-to-point secure tunnel and nothing else, so that the system is composable with multiple different upper-level designs (for instance, how you mesh up with multiple endpoints, or how you authenticate).

Another reasonable way to look at WireGuard is that it's the Signal Protocol-era VPN protocol (WireGuard is derived from Trevor Perrin's Noise protocol framework).

Notably: WireGuard doesn't attempt to negotiate cryptographic parameters. Instead, they've selected a good set of base primitives (Curve25519, Blake2, ChaPoly) and that's that; if those primitives ever change, they'll version the whole protocol.

If you haven't played with it, WireGuard is approximately as hard to set up as an SSH connection. It is really a breath of fresh air.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#56

Post by xvector »

wmf wrote: post #29
corty wrote: post #23

Earlier quoted context omitted.

Yes, you are exactly right. Wireguard is a typical example of a thing I'd call myopic-cryptographer-protocol. Solve one problem in the minimal fashion that can be called proof-of-concept, do it in a maybe-more-secure way and call it done. Everything else, like proper key distribution and user management, which you need for a real-world deployment that isn't just a personal toy, is left as an exercise to the reader. A…

If people want Wireguard to be a complete multiplatform audited free enterprise VPN solution they need to donate more. A lot more.

Even if they donate more that won't happen. It's antithetical to the premise of the whole project. WireGuard is fine where it is, it's amazing.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#57

Post by londons_explore »

unethical_ban wrote: post #45
corty wrote: post #31

Earlier quoted context omitted.

Nobody really needs enterprise VPN crap, that stuff does far too much weird stuff that is totally unrelated to what a VPN should do, like patch management, malware scanning, firewalling, and other useless box-ticking. What we do need is a proper replacement for roughly the things OpenVPN plus PAM can do. A VPN plus some user and key management.

It is a completely reasonable requirement of a large organization to ensure an endpoint meets certain criteria before being allowed access to an internal network. I'm not arguing that Wireguard has an obligation to tackle that problem themselves. I'm arguing against your assertion that VPN access should be completely decoupled from ensuring endpoint security.

Lets be honest, any malicious endpoint can easily bypass those 'endpoint security' checks.

All they're good for is checking that unpatched (but not yet exploited/evil) endpoints can't connect to the network, which is of marginal benefit compared to allowing them to connect but requiring they patch before accessing risky resources (like the internet or email).

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#58

Post by midasuni »

bob1029 wrote: post #41

This is exciting to me. I have tripped over every VPN technology listed on Wikipedia at one point or another during my career. Always open to something better. I think IPSec or OpenVPN are probably the opposite of what WG is offering here... Microsoft's SSTP offering is actually not causing me any major frustration at the moment. I almost like using it. But, seeing these other comments telling tales of 600 megabit VP…

I had an sstp tunnel refuse to establish a few weeks ago. WireGuard was fine. Turns out the provider was MITMing tcp/443 traffic

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#59

Post by nemosaltat »

Sesse__ wrote: post #35
dsr_ wrote: post #20

Earlier quoted context omitted.

wireguard is a VPN technology that is now integrated into the Linux kernel, and is available on all major platforms. It distinguishes itself from other VPNs by not having knobs to twiddle. Should a security issue arise, it will be necessary to replace it with a wireguard2 or such. This also means that it's very hard to get it wrong in config; either it works or it doesn't, and if it doesn't, you haven't got it workin…

Wireguard is pretty much half of what you'd expect from a VPN. It does the low-level part (encryption, packetization, session setup, NAT traversal, etc. -- the “actual VPN”) brilliantly, but everything around key distribution is left to external systems. (Tailscale is a popular choice, but by no means the only one.) E.g., you can't connect to vpn.example.com with user foo and password bar and that's it; there needs t…

I’ve been begrudgingly using Tailscale because it’s so damn simple, but hate that I have to authenticate through Google. I recently noticed they’ve added a “sign in with GitHub option,” but I don’t see any easy way to migrate my account (and nodes). Many of the clients are PiHoles I’ve sent off to my family as gifts, so physical access is a PITA. The only way I’ve found to reliably clear the Tailscale settings is to `apt purge Tailscale`, which would cause me to lose Tailscale SSH access. Looking at the hassle of the remote reinstall- I’m thinking to SSH in with Tailscale, then establish a reverse SSH tunnel to maintain remote access - I think I may finally give Innernet [0] a go.

[0] https://github.com/tonarino/innernet

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#60

Post by ptomato »

corty wrote: post #24
the8472 wrote: post #16

Earlier quoted context omitted.

Wireguard uses perfect forward secrecy, so wouldn't signing the ephemeral session once with the hardware key do the job? Or do they need some more advanced operations that the devices don't expose?

No, you just need a signature. But an Ed25519 signature, which current commercially available smartcards just cannot do. You could be hacking something together with a Nitrokey or maybe Yubikey, those can do Ed25519 signatures. But generally, you would need to fiddle a lot with the implementation, because currently signatures are done in the kernel module, and you'd need to get that into the USB-device for signing an…

You'll have to write some glue code, but if all you need is standard Ed25519 signatures, current-gen Yubikeys can do this. Somebody's implemented a python library that does that here https://github.com/tschudin/sc25519
Post reply on HN