Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our User-Mode WireGuard Year

fly.io

Post reply on HN
Print view View original

91–100 of 169 posts

Re: Our User-Mode WireGuard Year

#91

Post by michaeldwan »

ericpauley wrote: post #55
tptacek wrote: post #10

Because 'sho_hn brought this up, here's a stab at a pro/con list of building TCP/IP directly into our API the way `flyctl` does: Pro: + Can just run "native" SSH directly over it (or, in our case, use x/crypto/ssh, without modification). + Lets `flyctl` offers a `flyctl proxy` command to users, so they can plug their own programs into whatever application they need to use, without asking us to change some proxy we ru…

We recently moved our entire app deployment over to Fly and are mostly loving it, but one of the mildly janky features is hallpass. For instance, (1) connections often fail if you have X forwarding enabled (even if you did no specifial config on the machine), and (2) port forwarding doesn't work. While these aren't really a big deal since (1) you can just disable X forwarding in ssh_config and (2) port forwarding is…

As for autoscaling, our hands are tied as long as we're running on Nomad. Right now our autoscaler is nothing more than some ruby that loops over data from prometheus and changes counts in Nomad. It's slow and buggy, but worse we don't have control over where Nomad places VMs or which ones it stops when scaling down.

We're working on a replacement for Nomad (called flyd) that gives us full control over VMs. Once apps are running on that we can do a lot of cool things. Better autoscaling is one, but I'm really excited about suspending idle VMs that our proxy wakes up on demand. That'll cover most use cases without forcing customers to worry about counts or blowing through a budget.

Re: Our User-Mode WireGuard Year

#92

Post by xanaxagoras »

anonymousisme wrote: post #49

Back in the day (nearly 30 years ago) people would run a user-mode stack to obtain Internet connectivity via a (dial-up) Unix shell account. The program was "slirp" which was named after SLIP/CSLIP, but then upgraded to support PPP once that became a thing. https://en.wikipedia.org/wiki/Slirp

What a trip back in time. I used this and TIA [1] as a youth.

[1] https://en.wikipedia.org/wiki/The_Internet_Adapter

Re: Our User-Mode WireGuard Year

#93

Post by mayli »

I always love the style how fly.io's blog is written, and a big fan of their freemium product. I am see a group of enthusiastic hackers behind the product, and keeps improving it in a reasonable way, or a cool way that doesn't sound boring.

Re: Our User-Mode WireGuard Year

#94

Post by tedunangst »

mrkurt wrote: post #79
tedunangst wrote: post #74

Earlier quoted context omitted.

Perhaps atypical, but about 50% of my ssh use is port forwarding to construct impoverished man's VPNs. Like I send mail by forwarding localhost:25 to localhost:25 on the mail server. If I were running PoE (Postgres on Edge) I'd probably want to connect a local client for poking around, but without the bother of meshing my laptop into the cloud.

Most port forwarding you need to connect to Fly apps is baked in. Here's how to get at a remote postgres: $ flyctl proxy 15432:5432 -s -a fizz-db ? Select instance: [Use arrows to move, type to filter] > gru.fizz-db.internal iad.fizz-db.internal lax.fizz-db.internal lhr.fizz-db.internal ord (fdaa:0:446b:a7b:20db:0:77a5:2) ord (fdaa:0:446b:a7b:20dc:0:784c:2) yyz.fizz-db.internal That forwards whichever you select to l…

Ah!

Re: Our User-Mode WireGuard Year

#96

Post by rcoveson »

purplerabbit wrote: post #69
philosopher1234 wrote: post #52

Earlier quoted context omitted.

Nit: THE top HN contributor

my goodness, you're right... https://news.ycombinator.com/leaders (edit: by a factor of ~2, no less!)

I like how he decided he should only copyright his comments from years 2010 + Fn.

Re: Our User-Mode WireGuard Year

#97

Post by chrissnell »

anonymousisme wrote: post #49

Back in the day (nearly 30 years ago) people would run a user-mode stack to obtain Internet connectivity via a (dial-up) Unix shell account. The program was "slirp" which was named after SLIP/CSLIP, but then upgraded to support PPP once that became a thing. https://en.wikipedia.org/wiki/Slirp

SLIP was a problem for us when I worked at an ISP in 1995. Cheapsakes would buy our barebones "shell access only" package and then run SLIP on our shell server. We eventually wrote a cron job to kill their processes when we found them. Sneaky ones just renamed the binary.

Re: Our User-Mode WireGuard Year

#98

Post by anurag »

sa1 wrote: post #54
mrkurt wrote: post #44

Earlier quoted context omitted.

Tailscale will do this! tailscaled --tun=userspace-networking --socks5-server=localhost:1081

Sadly, on the only machine that I would have wanted this on, where I didn't have root access, this has never worked for me. I should try to recreate the logs and issue for the tailscale folks.

Our customers at Render run Tailscale in user mode every day. Here's the repo they use: https://github.com/render-examples/tailscale.

An example of using Tailscale to access VSCode in the cloud: https://render.com/blog/host-a-dev-environment-on-render-wit...

Re: Our User-Mode WireGuard Year

#99

Post by mobilio »

anderspitman wrote: post #14

Usermode WireGuard would be a big deal. I maintain a list[0] of tunneling solutions, and one of the only limitations of systems built on WireGuard is the requirement for admin privileges. Even with the performance hit from running outside the kernel, UDP-based tunnels have a lot of advantages for multiplexing channels. Pretty much your only mainstream options today are QUIC and WireGuard, and only QUIC is intended to…

TunSafe also runs on userspace: https://github.com/TunSafe/TunSafe

Re: Our User-Mode WireGuard Year

#100

Post by tonyarkles »

anonymousisme wrote: post #49

Back in the day (nearly 30 years ago) people would run a user-mode stack to obtain Internet connectivity via a (dial-up) Unix shell account. The program was "slirp" which was named after SLIP/CSLIP, but then upgraded to support PPP once that became a thing. https://en.wikipedia.org/wiki/Slirp

Heh, as a middle time between the dial-up days and the WireGuard days, I used to use PPP as a poor-man's VPN. SSH to a host inside the work network and run pppd on both sides. Tada, suddenly my home computer is on the work network, NATted from the jump box.
Post reply on HN