Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Full WireGuard Support in ProtonVPN for Android

github.com

Post reply on HN
Print view View original

11–20 of 51 posts

Re: Full WireGuard Support in ProtonVPN for Android

#11

Post by zibzab »

oliverjudge wrote: post #2

It’s nice to see one of these providers upgrading their protocols away from openvpn and the like, but it still doesn’t solve the problem of these commercial VPN’s are still just someone else’s computer.

I'm pretty sure that 50% of VPN companies are run by spy agencies

Some of the rest are probably run by criminals.

Oh yeah, let us not forget Facebook whose vpn app was created mainly to snoop on you other network activities

Edit: remember that you can roll your own temporary vpn: https://www.digitalocean.com/community/tutorials?q=vpn

Re: Full WireGuard Support in ProtonVPN for Android

#12

Post by codetrotter »

_8j50 wrote: post #6

I've mostly only used OpenVPN for personal VPN needs. Is WG stable/reliable? My OpenVPN tunnels bounce too much.

I've been running a WireGuard setup for a couple of years now, and have been and continue to be very satisfied with it.

- WireGuard server running on my FreeBSD VPS. Always on.

- WireGuard client running on my MacBook Pro M1 laptop (and prior to that, on the MacBook Air that I had before this computer). I activate this one when I need to connect to my server or to some other device on the VPN.

- WireGuard client running on my iPhone X. Like with my laptop, I activate it when I need to connect to the server or to another device on the VPN.

- WireGuard client running on my grandfather's Mac Pro desktop computer. Always on. This allows me to remote into his computer via the macOS-builtin VNC server on his computer, to help him out when he is stuck at something. I use the macOS-builtin VNC client on my MBP or a third-party VNC client on my iPhone. In either case the connection is tunneled over the WireGuard VPN. I also have the builtin SSH server running on his computer that I connect to over WG VPN to transfer files or run commands through.

- WireGuard client running on my desktop computer which runs KDE Neon Linux. Always on.

WireGuard has been almost trivially simple to set up across all of these systems; FreeBSD, macOS, iOS, Linux. And I am sure it is equally simple to set up on many other systems as well.

WireGuard has been very stable and reliable too for all of the time that I have been using it.

Some months ago I changed the WireGuard configuration on my server to run on port 443 UDP instead of the UDP port that WireGuard server would run on by default. This has allowed me to connect to my VPN even when using some public hotspots that were very restrictive on what traffic they allowed through and where previously I could not connect to my WireGuard VPN. Deep packet inspection would still block the traffic I assume, but in all cases with regular public hotspots in my country I have been able to connect to my VPN after I made this change of what port I am using. I live in Norway.

I highly recommend anyone that wants to run their own VPN to use WireGuard.

I personally use my WireGuard VPN for connectivity between these hosts only, not for tunneling traffic that is routed out onto the wider Internet. (That is, my tunnel runs over the Internet but I only use it for traffic that is destined to the machines that are member of the VPN). So I cannot really comment on the use-case of tunneling Internet traffic, but from the experience with connecting the hosts in my VPN I can only assume that tunneling Internet traffic would work out equally well.

Re: Full WireGuard Support in ProtonVPN for Android

#13

Post by georgyo »

_8j50 wrote: post #6

I've mostly only used OpenVPN for personal VPN needs. Is WG stable/reliable? My OpenVPN tunnels bounce too much.

All the replies to your comment seem like sales pitches that don't actually explain anything.

The difference between wireguard and OpenVPN is that there is no real negotiation between the client and server.

Connecting to OpenVPN can take several seconds as it authenticates you, figured out encryption algorithms, IP and route management. If the network or OpenVPN server hiccup, it drops you and you need to reconnect and renegotiate again.

Wireguard does not do this, the interface comes up regardless if the remote server is up. The client and server key have already been exchanged, the routing and ip are statically configured, so the server can just receive packets without any negotiation.

Clients are identified by their public key, so roaming and ip switches are seamless as well.

There actually is a very tiny amount of negotiation in that protocol has perfect forward secrecy, so the connection re keys every two minutes (hard codes time value).

Re: Full WireGuard Support in ProtonVPN for Android

#14

Post by atatatat »

codetrotter wrote: post #12
_8j50 wrote: post #6

I've mostly only used OpenVPN for personal VPN needs. Is WG stable/reliable? My OpenVPN tunnels bounce too much.

I've been running a WireGuard setup for a couple of years now, and have been and continue to be very satisfied with it. - WireGuard server running on my FreeBSD VPS. Always on. - WireGuard client running on my MacBook Pro M1 laptop (and prior to that, on the MacBook Air that I had before this computer). I activate this one when I need to connect to my server or to some other device on the VPN. - WireGuard client runn…

Is your grandfather on a VPN you share with him?

Is he on static IP?

Re: Full WireGuard Support in ProtonVPN for Android

#15

Post by codetrotter »

atatatat wrote: post #14
codetrotter wrote: post #12

Earlier quoted context omitted.

I've been running a WireGuard setup for a couple of years now, and have been and continue to be very satisfied with it. - WireGuard server running on my FreeBSD VPS. Always on. - WireGuard client running on my MacBook Pro M1 laptop (and prior to that, on the MacBook Air that I had before this computer). I activate this one when I need to connect to my server or to some other device on the VPN. - WireGuard client runn…

Is your grandfather on a VPN you share with him? Is he on static IP?

Yes, his computer is on my VPN and has a static IPv4 address inside of the VPN, 10.42.42.4, as well as a static IPv6 address inside of the VPN, fc42:4242:4242:4242::4.

I updated my comment above to note that I use my VPN for connectivity between hosts only, but across the Internet. So I can connect to any host in the VPN from anywhere in the world, but all of the hosts still send all of their other traffic via the same interface that they would if they were not part of the VPN.

So when he browses the Internet, his traffic is routed by his ISP directly and the VPN is not involved, and the same goes for my own computers and other devices.

Re: Full WireGuard Support in ProtonVPN for Android

#16

Post by SahAssar »

georgyo wrote: post #13
_8j50 wrote: post #6

I've mostly only used OpenVPN for personal VPN needs. Is WG stable/reliable? My OpenVPN tunnels bounce too much.

All the replies to your comment seem like sales pitches that don't actually explain anything. The difference between wireguard and OpenVPN is that there is no real negotiation between the client and server. Connecting to OpenVPN can take several seconds as it authenticates you, figured out encryption algorithms, IP and route management. If the network or OpenVPN server hiccup, it drops you and you need to reconnect a…

> All the replies to your comment seem like sales pitches that don't actually explain anything.

It's sort of hard to provide any other than "yes/no" to a question like "Is WG stable/reliable", right?

For most uses the answer is probably "yes" but there are use cases (I'm guessing around auth and middleboxes that do not like UDP) where the answer would be "no".

Re: Full WireGuard Support in ProtonVPN for Android

#17

Post by mbreese »

atatatat wrote: post #14
codetrotter wrote: post #12

Earlier quoted context omitted.

I've been running a WireGuard setup for a couple of years now, and have been and continue to be very satisfied with it. - WireGuard server running on my FreeBSD VPS. Always on. - WireGuard client running on my MacBook Pro M1 laptop (and prior to that, on the MacBook Air that I had before this computer). I activate this one when I need to connect to my server or to some other device on the VPN. - WireGuard client runn…

Is your grandfather on a VPN you share with him? Is he on static IP?

It doesn’t need to be. If his grandfathers computer is connecting to a “hub” server and is always connected, it will work.

Alternatively, if @codetrotter need to do the connecting, you can also setup wire guard to use a dns name, which could be dynamic.

On the VPN side, it would be a static IP though…

Re: Full WireGuard Support in ProtonVPN for Android

#18

Post by icelancer »

jvanderbot wrote: post #7
_8j50 wrote: post #6

I've mostly only used OpenVPN for personal VPN needs. Is WG stable/reliable? My OpenVPN tunnels bounce too much.

WG isn't just stable, it's so easy to configure and set up you'll wonder why you didn't do it ages ago. At least that's the way it was for me. I stand by my assertion that eventually nobody will talk about Wireguard because everyone will use it for almost everything. It'll be like HTTPS, TLS, or TCP.

I tried setting it up on a VPS on Ubuntu the other day, got it installed after doing some config files, connected to the tunnel, could access the server but not the wider Internet. Made about 4-5 config changes per a bunch of Stackoverflow posts then gave up since nothing worked.

Installed OpenVPN instead, took me 2 minutes and worked immediately with far fewer config files changes.

I've had this experience before with Wireguard as well. People keep saying how easy it is and in my experience... it simply isn't.

OpenVPN has a lot of BS overhead and I'd be more than pleased to move off of it. But WG hasn't been simple for a common use case - install on Ubuntu VPS, client on Windows.

Re: Full WireGuard Support in ProtonVPN for Android

#19

Post by Skunkleton »

stingraycharles wrote: post #5
oliverjudge wrote: post #2

It’s nice to see one of these providers upgrading their protocols away from openvpn and the like, but it still doesn’t solve the problem of these commercial VPN’s are still just someone else’s computer.

But if you would want a more secure alternative, there are options like Tor and I2P right? Or do you have something else in mind?

I think the point is that public VPNs don't provide much additional security. Basically they just let you act from a different location on the internet. Is your traffic safer egressing on to the public network from your current location, or from the VPN's location? In some cases the VPN may be better. In others, your local network makes more sense.

Re: Full WireGuard Support in ProtonVPN for Android

#20

Post by j3th9n »

icelancer wrote: post #18
jvanderbot wrote: post #7

Earlier quoted context omitted.

WG isn't just stable, it's so easy to configure and set up you'll wonder why you didn't do it ages ago. At least that's the way it was for me. I stand by my assertion that eventually nobody will talk about Wireguard because everyone will use it for almost everything. It'll be like HTTPS, TLS, or TCP.

I tried setting it up on a VPS on Ubuntu the other day, got it installed after doing some config files, connected to the tunnel, could access the server but not the wider Internet. Made about 4-5 config changes per a bunch of Stackoverflow posts then gave up since nothing worked. Installed OpenVPN instead, took me 2 minutes and worked immediately with far fewer config files changes. I've had this experience before wi…

This was possibly all you needed to do:

echo 1 > /proc/sys/net/ipv4/ip_forward

Post reply on HN