31–40 of 172 posts
Why is this better than running wireguard directly on a cheap instance .
These over the top services handle node discovery and meshing for you, instead of you having to feed configurations manually down to each device you want to hook up to wireguard. Convenience features etc
Earlier quoted context omitted.
1. thanks for linking that 2. the comparison: - protocol: wireguard is now baseline - speed: netmaker is faster because it uses kernel wg - this is not going to hold true for all system configurations, certainly doesn't for macos - flexibility: feels like it does the same as tailscale, marketed slightly different as they list common use-cases – egress and ingress gateways; network shaping with acls is also possible i…
What’s your approach to routing the mesh? Static? BGP? Something else?
the exit-node routing is for firewall circumvention - if i find myself unable to connect to git over ssh, i simply activate routing through the exit-node and continue working
the exit-node sits at home where i set the rules
Earlier quoted context omitted.
your not the first to complain about it[0], the tone is uncalled for - you can just cmd + w that tab and move on + use it as a signal when picking your service provider [0] https://news.ycombinator.com/item?id=37143046
I can close the tab easily enough, yes. If I was a prospective customer though, he just lost a potential sale. Also, flagging? I'm not surprised, of course; this place is as left as it gets.
A pain point I still haven't resolved with WG is this. From my phone, I want to access my homelab through the WG server at home, but everything else through an external WG VPN somewhere else. My homelab ip range is 10.10.0.0/24 or whatever, but the external VPN is some other range. Wireguard doesn't seem to like this. The alternative is to route my phone to home for 100% of traffic, and my home router would egress th…
Assuming your Wireguard server at home is running Linux, you can achieve this by adding a second routing table and adding routing policies.
I've been using Netmaker for a few months now and it is incredible. Bastion VPN management for all our enviornments. The only thing we havne't gotten to work is full 0.0.0.0 forwarding. Docs say it's possible (tho not fully common use case), but we always get hangs when attempting. Usually we have to use sshuttle Other than that - incredible.
you're using it for office network or server infra? did you compare it to others, what made you go with netmaker?
A pain point I still haven't resolved with WG is this. From my phone, I want to access my homelab through the WG server at home, but everything else through an external WG VPN somewhere else. My homelab ip range is 10.10.0.0/24 or whatever, but the external VPN is some other range. Wireguard doesn't seem to like this. The alternative is to route my phone to home for 100% of traffic, and my home router would egress th…
A single wg interface/config on your phone, with two peers, one for home wg and one for remote vpn, with AllowedIPs on the home peer as 10.10.0.0/24 and AllowedIPs on the remote vpn peer as 0.0.0.0/24?
Have you tried excluding the cidr of your home wg from the AllowedIPs of the remote vpn? Like not having 0.0.0.0/24, but one or more entries that end up excluding local cidrs.
Earlier quoted context omitted.
Is the kernel module how they claim the 5x performance over tailscale? I haven't really done any real tailscale performance metrics but can't see how else they can claim this (unless there is infrastructure performance differences).
Afaik, tailscale recently made changes to their go user space implementation that actually made their version faster than the kernel implementation, at least in some cases. I remember reading a blog post on tailscacles' website about it and how they are pushing their changes upstream (wg kernel and official wg go user space implementation). Can't find the post now though.
Earlier quoted context omitted.
Tinc is dormant these days. Very little development going on. Cool concept, but limited performance and limited uptake. Their approach to mesh was neat at the time.
Dormant, or stable? I've been running a tinc mesh network for eons w/ my systems and it's never given me any trouble. I use git to check in the 'hosts/' folder and add/remove hosts as needed, pull down to all the nodes, and they can all connect. I do wish the encryption + transport could be as performant as wireguard, but for my needs, I haven't been pushing it hard enough that it's a concern for me.
It also does not really have a decent mobile client.