Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Full WireGuard Support in ProtonVPN for Android

github.com

Post reply on HN
Print view View original

21–30 of 51 posts

Re: Full WireGuard Support in ProtonVPN for Android

#21

Post by icelancer »

j3th9n wrote: post #20
icelancer wrote: post #18

Earlier quoted context omitted.

I tried setting it up on a VPS on Ubuntu the other day, got it installed after doing some config files, connected to the tunnel, could access the server but not the wider Internet. Made about 4-5 config changes per a bunch of Stackoverflow posts then gave up since nothing worked. Installed OpenVPN instead, took me 2 minutes and worked immediately with far fewer config files changes. I've had this experience before wi…

This was possibly all you needed to do: echo 1 > /proc/sys/net/ipv4/ip_forward

cat /proc/sys/net/ipv4/ip_forward shows '1', I set it via sysctl -w net.ipv4.ip_forward=1 in the past I think based on instructions.

Re: Full WireGuard Support in ProtonVPN for Android

#22

Post by ciupicri »

icelancer wrote: post #21
j3th9n wrote: post #20

Earlier quoted context omitted.

This was possibly all you needed to do: echo 1 > /proc/sys/net/ipv4/ip_forward

cat /proc/sys/net/ipv4/ip_forward shows '1', I set it via sysctl -w net.ipv4.ip_forward=1 in the past I think based on instructions.

There is also a per interface setting, e.g. net.ipv4.conf.virbr0.forwarding

Re: Full WireGuard Support in ProtonVPN for Android

#23

Post by icelancer »

ciupicri wrote: post #22
icelancer wrote: post #21

Earlier quoted context omitted.

cat /proc/sys/net/ipv4/ip_forward shows '1', I set it via sysctl -w net.ipv4.ip_forward=1 in the past I think based on instructions.

There is also a per interface setting, e.g. net.ipv4.conf.virbr0.forwarding

apt purge'd it, reinstalled and updated my Windows client, now getting this entry in the Wireguard log:

2021-10-11 15:18:30.313: [MGR] Failed to connect to adapter interface \\?\SWD#WireGuard[REDACTED]: The system cannot find the file specified. (Code 0x00000002)

So, again, I'd like to use it but... dead simple it ain't. Googling that error shows 5 month old reddit posts and not much else.

https://www.reddit.com/r/WireGuard/comments/n6yocf/unable_to...

Re: Full WireGuard Support in ProtonVPN for Android

#24

Post by j3th9n »

icelancer wrote: post #21
j3th9n wrote: post #20

Earlier quoted context omitted.

This was possibly all you needed to do: echo 1 > /proc/sys/net/ipv4/ip_forward

cat /proc/sys/net/ipv4/ip_forward shows '1', I set it via sysctl -w net.ipv4.ip_forward=1 in the past I think based on instructions.

Then maybe you need to add the following to the [Interface] section of your wg0.conf on your server or else I don't know ;-) :

PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Re: Full WireGuard Support in ProtonVPN for Android

#25

Post by icelancer »

j3th9n wrote: post #24
icelancer wrote: post #21

Earlier quoted context omitted.

cat /proc/sys/net/ipv4/ip_forward shows '1', I set it via sysctl -w net.ipv4.ip_forward=1 in the past I think based on instructions.

Then maybe you need to add the following to the [Interface] section of your wg0.conf on your server or else I don't know ;-) : PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Already reads as such, though I've tried that code snippet too:

PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; iptables -A FORWARD -o %i -j ACCEPT

PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; iptables -D FORWARD -o %i -j ACCEPT

Like I said, everyone keeps saying Wireguard is dead simple to set up, but the comments are full of editing configuration files, priv/pub key pairs, etc. I've helped administer OpenVPN servers for a decade now (and take no pride in it), and yet all these errors that keep coming up in Wireguard configuration for me on a main Linux distro + Windows 10 client seem pretty odd for something that's supposedly so easy to use.

Someone just come out with a wizard/package installer that actually works reasonably well (like OpenVPN has already) and then it might be "easy" to install. For OpenVPN I run an apt install command, run a wizard, SFTP into the box, transfer out the .ovpn file, import it into whatever client devices I need, and it works. Wireguard is at least 10 times tougher than that, even if it worked, which it currently does not.

Re: Full WireGuard Support in ProtonVPN for Android

#26

Post by jrop »

codetrotter wrote: post #15
atatatat wrote: post #14

Earlier quoted context omitted.

Is your grandfather on a VPN you share with him? Is he on static IP?

Yes, his computer is on my VPN and has a static IPv4 address inside of the VPN, 10.42.42.4, as well as a static IPv6 address inside of the VPN, fc42:4242:4242:4242::4. I updated my comment above to note that I use my VPN for connectivity between hosts only, but across the Internet. So I can connect to any host in the VPN from anywhere in the world, but all of the hosts still send all of their other traffic via the sa…

Can you point me to some docs on how to accomplish this? I'm currently using Slack Nebula to achieve similar goals but every time I looked up WireGuard tutorials, it was to tunnel traffic through a VPS, which I didn't want to do.

Re: Full WireGuard Support in ProtonVPN for Android

#27

Post by wolverine876 »

georgyo wrote: post #13
_8j50 wrote: post #6

I've mostly only used OpenVPN for personal VPN needs. Is WG stable/reliable? My OpenVPN tunnels bounce too much.

All the replies to your comment seem like sales pitches that don't actually explain anything. The difference between wireguard and OpenVPN is that there is no real negotiation between the client and server. Connecting to OpenVPN can take several seconds as it authenticates you, figured out encryption algorithms, IP and route management. If the network or OpenVPN server hiccup, it drops you and you need to reconnect a…

Regarding stability: WireGuard is widely used, Linus allowed it into the Linux kernel, and I haven't heard anyone mention stability problems.

WireGuard is also orders of magnitude more secure than OpenVPN.

Re: Full WireGuard Support in ProtonVPN for Android

#28

Post by zxcvbn4038 »

_8j50 wrote: post #6

I've mostly only used OpenVPN for personal VPN needs. Is WG stable/reliable? My OpenVPN tunnels bounce too much.

About the only issue I've had with wireguard is that it leaks DNS so I'm constantly getting alerts from AWS GuardDuty about suspicious DNS queries. The only way around that I can see is to run my own DNS and forward the queries that don't look like they are AWS related to a public resolver like 1.1.1.1.

I am really eager to hear details how the VPNs are implementing Wireguard - particularly the address management portion.

Re: Full WireGuard Support in ProtonVPN for Android

#29

Post by rndgermandude »

icelancer wrote: post #18
jvanderbot wrote: post #7

Earlier quoted context omitted.

WG isn't just stable, it's so easy to configure and set up you'll wonder why you didn't do it ages ago. At least that's the way it was for me. I stand by my assertion that eventually nobody will talk about Wireguard because everyone will use it for almost everything. It'll be like HTTPS, TLS, or TCP.

I tried setting it up on a VPS on Ubuntu the other day, got it installed after doing some config files, connected to the tunnel, could access the server but not the wider Internet. Made about 4-5 config changes per a bunch of Stackoverflow posts then gave up since nothing worked. Installed OpenVPN instead, took me 2 minutes and worked immediately with far fewer config files changes. I've had this experience before wi…

To give a counterpoint.

I have both OpenVPN and wireguard set up, running my own server/"server" peer... First OpenVPN because that's what I used before wireguard was around (and now keep as a fallback that I never use). OpenVPN required a lot more fiddling e.g. to get a ca+client certs for auth set up, find a config that works for each OS where I have clients, etc. And then again some more work because client certs expired, and again more work because the distro changed some things and required a different config suddenly (not really OpenVPN's fault)

wireguard just worked for me, except I first forgot to enable port forwarding / the NAT stuff on the interface on the "server" peer so that I could route all traffic through it (other people already remarked about that), not just have a point-to-point to it. The point-to-point stuff worked immediately tho without having to sprinkle any magic pixie dust on top first.

Setting up a "server" is always more intricate be it OpenVPN be it wireguard, tho. But once I had two peers in my wireguard setup up and running (the "server" and the first client) adding more clients was a breeze compared to doing the same in OpenVPN. All in all, it was like 10 mins of fiddling in some testing VMs and a bit of googling, and then a couple of more minutes to apply what iIlearned and set up the real "prod".

Re: Full WireGuard Support in ProtonVPN for Android

#30

Post by TedDoesntTalk »

wolverine876 wrote: post #27
georgyo wrote: post #13

Earlier quoted context omitted.

All the replies to your comment seem like sales pitches that don't actually explain anything. The difference between wireguard and OpenVPN is that there is no real negotiation between the client and server. Connecting to OpenVPN can take several seconds as it authenticates you, figured out encryption algorithms, IP and route management. If the network or OpenVPN server hiccup, it drops you and you need to reconnect a…

Regarding stability: WireGuard is widely used, Linus allowed it into the Linux kernel, and I haven't heard anyone mention stability problems. WireGuard is also orders of magnitude more secure than OpenVPN.

> WireGuard is also orders of magnitude more secure than OpenVPN.

This entirely depends on how you configure OpenVPN, which encryption to allow it to support, HMAC, hashes, etc. If you configure it with maximum security, it is equally secure as WireGuard. If you configure it less so, then you allow older clients to connect.

Post reply on HN