Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

lists.zx2c4.com

Post reply on HN
Print view View original

81–90 of 187 posts

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#81

Post by dilyevsky »

l3s2d wrote: post #32
yobert wrote: post #5

Earlier quoted context omitted.

Think of wireguard as the plumbing. There will be a plethora of things available on top of wireguard that will enable all sorts of easy authentication options. (For example, TailScale.)

Related: Does anyone know of a PKI-on-WireGuard implementation? Specifically I'm looking for a system that lets clients join the WireGuard network by presenting a CA-signed certificate.

Sadly I haven’t found anything. All there is are those curv25519 key pairs last i looked which is a real pain to manage at any scale, can’t be setup with a ttl etc. That’s probably main value proposition of products like Tailscale tbh

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#82

Post by starfallg »

tptacek wrote: post #55
kzrdude wrote: post #18

What is WireGuard, is it a new protocol? Or a new algorithm for implementing an existing thing? (Or something else)

I think you could reasonably look at WireGuard as a repudiation of previous VPN protocols, almost from root to branch. For instance, WireGuard reconsiders what the role of a VPN "protocol" actually is, and in WireGuard the protocol itself delivers a point-to-point secure tunnel and nothing else, so that the system is composable with multiple different upper-level designs (for instance, how you mesh up with multiple e…

Wireguard isn't so different from previous protocols establishing encrypted tunnels. Functionally it's IPSEC tunnel mode with all the complexities of IPSEC removed. With a bit of multipoint goodness (ala DMVPN) sprinkled in.

The reason why it's hyped is because it's a non-encumbered, gratis, libre, fast replacement for OpenVPN.

Yes, it doesn't handle algorithm negotiation. So if there's something wrong with the algorithms it's chosen, then we'll need a Wireguard 2. That's a design choice that trades off one thing (protocol independence and resilience) for another (simplicity and ease of implementation).

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#83

Post by aaronmdjones »

corty wrote: post #24
the8472 wrote: post #16

Earlier quoted context omitted.

Wireguard uses perfect forward secrecy, so wouldn't signing the ephemeral session once with the hardware key do the job? Or do they need some more advanced operations that the devices don't expose?

No, you just need a signature. But an Ed25519 signature, which current commercially available smartcards just cannot do. You could be hacking something together with a Nitrokey or maybe Yubikey, those can do Ed25519 signatures. But generally, you would need to fiddle a lot with the implementation, because currently signatures are done in the kernel module, and you'd need to get that into the USB-device for signing an…

WireGuard does not use Ed25519. Indeed, it does not use any public-key signature algorithms at all. The long-lived static key (the peer's public key, their identity) is a Curve25519 ECDH key.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#84

Post by jiggawatts »

For reference, I've never seen the built-in Windows VPN protocols exceed ~70 Mbps in any scenario. Maybe it's possible with a crossover cable between two Mellanox 100 Gbps NICs, using water-cooled and overclocked CPUs, but not over ordinary networks with ordinary servers.

I have gigabit wired Internet to a site with gigabit Internet. Typical performance of SSTP or IKEv2 is 15-30 Mbps. That's 1.5% to 3% max utilisation of the available bandwidth, which is just... sad.

It's not the specific site either, other vendor VPNs can easily achieve > 300 Mbps over the same path.

It's a year and a half into the pandemic, there are record numbers of people working from home, and Microsoft is the world's second biggest company right now.

Meanwhile, volunteers put together a protocol in their spare time that is not only more secure but can also easily do 7.5 Gbps!

That needs to be repeated: At least ONE HUNDRED TIMES faster than the "best" Microsoft can offer to their hundreds of millions of enterprise customers that are working from home.

Someone from Microsoft's networking team needs to read this, and then watch Casey Muratori's rant about Microsoft's poor track record with performance: https://www.youtube.com/watch?v=99dKzubvpKE

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#85

Post by 1vuio0pswjnm7 »

jiggawatts wrote: post #84

For reference, I've never seen the built-in Windows VPN protocols exceed ~70 Mbps in any scenario. Maybe it's possible with a crossover cable between two Mellanox 100 Gbps NICs, using water-cooled and overclocked CPUs, but not over ordinary networks with ordinary servers. I have gigabit wired Internet to a site with gigabit Internet. Typical performance of SSTP or IKEv2 is 15-30 Mbps. That's 1.5% to 3% max utilisatio…

"... with a crossover cable..."

Many years ago, I once brought a crossover cable from home to the office to do some data transfer from a workstation to a company-issued laptop. The IT department issuing the laptop, being lovers of all things Microsoft, claimed crossover cable was "obsolete" due to auto-sensing used by Windows.

I am just another dumb end user, I do not work in IT, but I still get faster data transfer between two computers with crossover cable than by going through a third computer, or God forbid, over Wifi.

Sounds like crossover cable is not "obsolete" after all. Who would have thought.

Microsoft's customers, e.g., IT departments, are arguably complicit in the sad "state-of-the-art" you describe. The best software I have ever used was written by volunteers. Money can't buy everything. As Microsoft has shown, it can certainly buy customers.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#86

Post by agolliver »

planetafro wrote: post #74
midasuni wrote: post #58

Earlier quoted context omitted.

I had an sstp tunnel refuse to establish a few weeks ago. WireGuard was fine. Turns out the provider was MITMing tcp/443 traffic

Wouldn't they need a cert/custom CA on your box to do that?

They need their custom CA on your box for your machine to accept the traffic by default, otherwise you'll get a big ugly untrusted cert error on every https/ssl connection, but some apps will let you ignore those (eg: curl --insecure)

I worked at a company that did this and it was a massive headache, every time I wanted to set up a new VM things would fail until I remembered I had to install their CA. I was an intern at the time, and they gave me some work that required an app that I couldn't configure to use their CA for the life of me. After a lot of failed troubleshooting I and ended up just running a SSH server on my home PC and creating a SOCKS proxy through that.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#87

Post by compressedgas »

1vuio0pswjnm7 wrote: post #85
jiggawatts wrote: post #84

For reference, I've never seen the built-in Windows VPN protocols exceed ~70 Mbps in any scenario. Maybe it's possible with a crossover cable between two Mellanox 100 Gbps NICs, using water-cooled and overclocked CPUs, but not over ordinary networks with ordinary servers. I have gigabit wired Internet to a site with gigabit Internet. Typical performance of SSTP or IKEv2 is 15-30 Mbps. That's 1.5% to 3% max utilisatio…

"... with a crossover cable..." Many years ago, I once brought a crossover cable from home to the office to do some data transfer from a workstation to a company-issued laptop. The IT department issuing the laptop, being lovers of all things Microsoft, claimed crossover cable was "obsolete" due to auto-sensing used by Windows. I am just another dumb end user, I do not work in IT, but I still get faster data transfer…

Have you tried connecting two computers with just a patch cable? With the auto-sensing Ethernet ports, it works as if the cable were a crossover cable.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#88

Post by bpye »

compressedgas wrote: post #87
1vuio0pswjnm7 wrote: post #85

Earlier quoted context omitted.

"... with a crossover cable..." Many years ago, I once brought a crossover cable from home to the office to do some data transfer from a workstation to a company-issued laptop. The IT department issuing the laptop, being lovers of all things Microsoft, claimed crossover cable was "obsolete" due to auto-sensing used by Windows. I am just another dumb end user, I do not work in IT, but I still get faster data transfer…

Have you tried connecting two computers with just a patch cable? With the auto-sensing Ethernet ports, it works as if the cable were a crossover cable.

I believe this is only true for gigabit - though almost any device today should be?

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#89

Post by [deleted] »

jiggawatts wrote: post #84

For reference, I've never seen the built-in Windows VPN protocols exceed ~70 Mbps in any scenario. Maybe it's possible with a crossover cable between two Mellanox 100 Gbps NICs, using water-cooled and overclocked CPUs, but not over ordinary networks with ordinary servers. I have gigabit wired Internet to a site with gigabit Internet. Typical performance of SSTP or IKEv2 is 15-30 Mbps. That's 1.5% to 3% max utilisatio…

[deleted]

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#90

Post by nemosaltat »

Serow225 wrote: post #71
nemosaltat wrote: post #59

Earlier quoted context omitted.

I’ve been begrudgingly using Tailscale because it’s so damn simple, but hate that I have to authenticate through Google. I recently noticed they’ve added a “sign in with GitHub option,” but I don’t see any easy way to migrate my account (and nodes). Many of the clients are PiHoles I’ve sent off to my family as gifts, so physical access is a PITA. The only way I’ve found to reliably clear the Tailscale settings is to…

You can also use Microsoft now (both "personal" accounts like used for Xbox/Outlook and "Enterprise" accounts like Microsoft365 and other AAD based accounts) I'm sure if you asked them about switching auth methods they would help with that.

That’s a good point. I’ve sent them an email and I’ll see what they say.

EDIT: since I’m still in the edit window, here’s what Tailscale came back with (great response time!).

>We can fairly easily switch between auth providers where the usernames are an email address, like Microsoft or Google or Okta.

>For GitHub the username is different, GitHub uses your Profile name. Any email addresses associated with your GitHub profile are not available.

>Unfortunately there isn't a straightforward way to migrate an existing Tailnet with its devices from Google to GitHub. We generally recommend making a new Tailnet with GitHub and re-authenticate devices using GitHub one at a time. For remote devices, this is more challenging.

>If you want to try it, a suggestion: 1. you can create a Reusable authkey at https://login.tailscale.com/admin/settings/authkeys for the new GitHub Tailnet 2. Over ssh to a node currently on the Google Tailnet, you can: `tailscale up --force-reauth --authkey=tskey-0123456789abcdef` 3. You'll lose the SSH session. The device will make a new Node key and be issued a new IP address on the new GitHub Tailnet. 4. You can look up its new IP address on https://login.tailscale.com/admin/machines of the GitHub Tailnet, and should be able to ssh to the new address.

Post reply on HN