Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

lists.zx2c4.com

Post reply on HN
Print view View original

71–80 of 187 posts

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#71

Post by Serow225 »

nemosaltat wrote: post #59
Sesse__ wrote: post #35

Earlier quoted context omitted.

Wireguard is pretty much half of what you'd expect from a VPN. It does the low-level part (encryption, packetization, session setup, NAT traversal, etc. -- the “actual VPN”) brilliantly, but everything around key distribution is left to external systems. (Tailscale is a popular choice, but by no means the only one.) E.g., you can't connect to vpn.example.com with user foo and password bar and that's it; there needs t…

I’ve been begrudgingly using Tailscale because it’s so damn simple, but hate that I have to authenticate through Google. I recently noticed they’ve added a “sign in with GitHub option,” but I don’t see any easy way to migrate my account (and nodes). Many of the clients are PiHoles I’ve sent off to my family as gifts, so physical access is a PITA. The only way I’ve found to reliably clear the Tailscale settings is to…

You can also use Microsoft now (both "personal" accounts like used for Xbox/Outlook and "Enterprise" accounts like Microsoft365 and other AAD based accounts)

I'm sure if you asked them about switching auth methods they would help with that.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#72

Post by lights0123 »

simcop2387 wrote: post #69
pkaye wrote: post #65

Earlier quoted context omitted.

Does it use key management like SSH or more like certificates with TLS?

It's more like client certs with tls that are signed by the server's key I believe.

Nope. You have a private and public key per connection.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#74

Post by planetafro »

midasuni wrote: post #58
bob1029 wrote: post #41

This is exciting to me. I have tripped over every VPN technology listed on Wikipedia at one point or another during my career. Always open to something better. I think IPSec or OpenVPN are probably the opposite of what WG is offering here... Microsoft's SSTP offering is actually not causing me any major frustration at the moment. I almost like using it. But, seeing these other comments telling tales of 600 megabit VP…

I had an sstp tunnel refuse to establish a few weeks ago. WireGuard was fine. Turns out the provider was MITMing tcp/443 traffic

Wouldn't they need a cert/custom CA on your box to do that?

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#75

Post by clon »

corty wrote: post #23
vbezhenar wrote: post #15

Earlier quoted context omitted.

How this plumbing is expected to be implemented? For example Cloudflare Warp uses Wireguard for its VPN solution, but all key exchanges and other stuff happens via HTTPS REST calls. Is it expected for any non-trivial implementation to build a different "control" protocol? For me it sounds like a dangerous approach. While wireguard protocol will be safe and audited, those additional proprietary protocols will hinder c…

Yes, you are exactly right. Wireguard is a typical example of a thing I'd call myopic-cryptographer-protocol. Solve one problem in the minimal fashion that can be called proof-of-concept, do it in a maybe-more-secure way and call it done. Everything else, like proper key distribution and user management, which you need for a real-world deployment that isn't just a personal toy, is left as an exercise to the reader. A…

Not all parts of a system are going to age equally well.

You are going to want to try to avoid that problem, while making your tool still useful. Wireguard hits the sweet spot particularly well.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#78

Post by Macha »

pkaye wrote: post #65
tptacek wrote: post #55

Earlier quoted context omitted.

I think you could reasonably look at WireGuard as a repudiation of previous VPN protocols, almost from root to branch. For instance, WireGuard reconsiders what the role of a VPN "protocol" actually is, and in WireGuard the protocol itself delivers a point-to-point secure tunnel and nothing else, so that the system is composable with multiple different upper-level designs (for instance, how you mesh up with multiple e…

Does it use key management like SSH or more like certificates with TLS?

It's like SSH, with no Trust-on-First-Use option. Unlike more complicated pre-existing protocols, how you handle key distribution is explicitly out of scope for the protocol.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#79

Post by SahAssar »

planetafro wrote: post #74
midasuni wrote: post #58

Earlier quoted context omitted.

I had an sstp tunnel refuse to establish a few weeks ago. WireGuard was fine. Turns out the provider was MITMing tcp/443 traffic

Wouldn't they need a cert/custom CA on your box to do that?

They could just block all tcp/443 traffic that they couldn't MITM, that's not uncommon in those kinds of setups.
Post reply on HN