Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Identity management for WireGuard

lwn.net

Post reply on HN
Print view View original

81–90 of 107 posts

Re: Identity management for WireGuard

#81

Post by sph »

afeiszli wrote: post #72
Mister_Snuggles wrote: post #23

I really want to like WireGuard, and these get so close to what I want. I think as soon as Headscale gets the iOS story sorted out I'll be able to switch away from IKEv2/IPSec. Right now the thing that's stopping me is the lack of Split-DNS. I'd even be happy if I could configure this in the official client, I've only got a handful of devices so distributing the configuration by hand is fine. My IKEv2/IPSec set up do…

Split DNS is super complicated to implement client side. We halfway implemented a solution and backtracked, eventually settling on just setting /etc/hosts. There's way too many variables involved across all the different operating systems.

These days it's pretty simple to achieve with systemd-resolved. I've been playing with split DNS and VPNs for a while and it seems it's a solved problem on Linux, finally.

The big hurdle is understanding the concept of search domain vs routing domain and the interaction with resolved and NetworkManager.

Re: Identity management for WireGuard

#82

Post by ilydfhilfyjhgf »

LinuxBender wrote: post #29

I only do self-hosted options so it might be a while before I really tinker with Wireguard. I've looked into setting it up but it does not meet my needs today for dynamic mesh routing and requires much of the system configuration of OpenVPN or Strongswan albeit simpler configuration but the same concepts still apply. My preferred ideal dream setup would be if the Tinc open source VPN had integration with OpenLDAP for…

tinc's "anycast" support is pretty spiffy. i have three servers in different geographic regions acting as nameservers for my "internal" network. tinc ensures the one with the lowest latency gets the request

Re: Identity management for WireGuard

#83

Post by tssva »

tptacek wrote: post #71
tssva wrote: post #66

Earlier quoted context omitted.

"First, even with third-party code, WireGuard is going to be significantly smaller than OpenVPN (and significantly easier to audit)." Do you have some evidence for that or is it just speculation? "But more importantly, you can't just count lines of code as if they're all equivalent." You're right but the Wireguard white paper conclusion claims an advantage for Wireguard based solely upon the lines of code needed to i…

Yes, there is plenty of evidence for this; see for instance the WireGuard paper. Numerous code size comparisons have been done here. Further, that is not what the WireGuard paper concludes. For instance: the paper makes a note of the fact that WireGuard is designed to be implemented without dynamic memory allocation, which is not a function of lines of code (in fact, it probably adds lines of code). You do you, but a…

Plenty of code size comparisons with Wireguard and 3rd party apps providing feature parity with OpenVPN? Can you provide some links?

The Wireguard paper makes notes of many things including the lines of code needed to implement.

"I'd say using OpenVPN or IPSEC in 2022 without some powerful compatibility, regulatory, or network complexity concern to support it is malpractice."

Life is complicated and those type of concerns are almost always in play which means OpenVPN and IPsec are also always in play. Wireguard is great where it is a fit but there are characteristics of Wireguard which also make it the more complicated and fragile solution in some circumstances.

Re: Identity management for WireGuard

#84

Post by afeiszli »

afeiszli wrote: post #72
Mister_Snuggles wrote: post #23

I really want to like WireGuard, and these get so close to what I want. I think as soon as Headscale gets the iOS story sorted out I'll be able to switch away from IKEv2/IPSec. Right now the thing that's stopping me is the lack of Split-DNS. I'd even be happy if I could configure this in the official client, I've only got a handful of devices so distributing the configuration by hand is fine. My IKEv2/IPSec set up do…

Split DNS is super complicated to implement client side. We halfway implemented a solution and backtracked, eventually settling on just setting /etc/hosts. There's way too many variables involved across all the different operating systems.

Yeah that’s what we used, but not all Linux supports it, and that still leaves non-Linux as well. But hosts files are universal.

Re: Identity management for WireGuard

#85

Post by zamalek »

> Despite Headscale's unofficial status, Tailscale seems to be fully supportive of its efforts; Tailscale has coordinated with Headscale's creator on API changes and hired one of Headscale's maintainers.

I have noticed an interesting change psychology arising from behavior such as this. I am more likely to use Tailscale (at the very least professionally, if not personally) instead of the free/OSS version because of this goodwill. Another example is Aeotec, who produce Z-Wave appliances. Aeotec's cooperation with the community (in terms of firmware) gives me significantly more confidence in the longevity of their devices.

Sadly, I don't think this psychology is ever going to become pervasive. People like what they already like.

Re: Identity management for WireGuard

#86

Post by pvg »

tssva wrote: post #83
tptacek wrote: post #71

Earlier quoted context omitted.

Yes, there is plenty of evidence for this; see for instance the WireGuard paper. Numerous code size comparisons have been done here. Further, that is not what the WireGuard paper concludes. For instance: the paper makes a note of the fact that WireGuard is designed to be implemented without dynamic memory allocation, which is not a function of lines of code (in fact, it probably adds lines of code). You do you, but a…

Plenty of code size comparisons with Wireguard and 3rd party apps providing feature parity with OpenVPN? Can you provide some links? The Wireguard paper makes notes of many things including the lines of code needed to implement. "I'd say using OpenVPN or IPSEC in 2022 without some powerful compatibility, regulatory, or network complexity concern to support it is malpractice." Life is complicated and those type of con…

You were asking whether Wireguard's design goals and criteria still hold up and the answer to that is that they do.

Re: Identity management for WireGuard

#87

Post by 3np »

LinuxBender wrote: post #37
mbreese wrote: post #36

Earlier quoted context omitted.

If you don’t need identity controls (using a fixed node configuration), you can always use vanilla Wireguard without the user management. You don’t get a NAT traversing mesh, but if your nodes are visible to the net, you do get direct node to node networking. If you only have one node directly visible, you can also use that as a gateway. I like these more traditional VPN style use tools for Wireguard, but you can alw…

vanilla Wireguard without the user management That is how I use Tinc today. I briefly tried Wireguard but it works very much like OpenVPN and Strongswan in that it does not have dynamic mesh routing. Privacy advantages aside, the dynamic mesh routing I get from Tinc works around internet outages, albeit slower than I would like but a 2 minute routing outage is still better than {n} time it takes for ISP's to manually…

You may be interested in Innernet

https://github.com/tonarino/innernet

Re: Identity management for WireGuard

#88

Post by cgb_ »

candiddevmike wrote: post #10
ericpauley wrote: post #7

Earlier quoted context omitted.

> I want WireGuard to periodically refresh the endpoint IP when I change networks, for instance. Out of curiosity, why do you want this?

Split DNS, where WireGuard may resolve an endpoint differently on a LAN vs internet. Also for IPv4/IPv6 roaming--if WireGuard resolves an IPv6 address but moves to a non IPv6 network, the peer will never connect as far as I know.

I see this when my equipment roams back into my private network and the wireguard server is inside that LAN. It can be solved by NAT'ing packets arriving on your edge router's inside interface, destinated to your outside IP, back to the inside wireguard server IP.

Alternatively if your client is Linux, there is:

https://github.com/WireGuard/wireguard-tools/tree/master/con...

Re: Identity management for WireGuard

#89

Post by tomschlick »

zamalek wrote: post #85

> Despite Headscale's unofficial status, Tailscale seems to be fully supportive of its efforts; Tailscale has coordinated with Headscale's creator on API changes and hired one of Headscale's maintainers. I have noticed an interesting change psychology arising from behavior such as this. I am more likely to use Tailscale (at the very least professionally, if not personally) instead of the free/OSS version because of t…

I agree. It probably helps make the decision because of how easy it would be to fall back on the FOSS version if needed, but for now its worth offloading the setup/hosting for the relatively small fee.

Re: Identity management for WireGuard

#90

Post by zrail »

dpifke wrote: post #76
LinuxBender wrote: post #37

Earlier quoted context omitted.

vanilla Wireguard without the user management That is how I use Tinc today. I briefly tried Wireguard but it works very much like OpenVPN and Strongswan in that it does not have dynamic mesh routing. Privacy advantages aside, the dynamic mesh routing I get from Tinc works around internet outages, albeit slower than I would like but a 2 minute routing outage is still better than {n} time it takes for ISP's to manually…

You can run dynamic routing protocols such as OSPF or iBGP over Wireguard. It's not built in, but that's a feature, not a bug—I vastly prefer software that does one thing and does it well. I have a full mesh of Wireguard tunnels configured between home/office/datacenters/laptop, and run bird[0] on the VPN endpoints to direct traffic between them. [0] https://bird.network.cz/

This is really interesting. Would you be willing to do a writeup of how your setup works?
Post reply on HN