Identity management for WireGuard
1–10 of 107 posts
Re: Identity management for WireGuard
#2What about Pritunl - https://pritunl.com/sso, it's a pretty good solution as well.
Re: Identity management for WireGuard
#3What about Pritunl - https://pritunl.com/sso , it's a pretty good solution as well.
Last time I worked with pritunl, it was based on openvpn. So unless that changed, it doesn’t fit the “for WireGuard networks” category.
Re: Identity management for WireGuard
#4When Wireguard was 1st rolled out the smaller code base vs OpenVPN was touted as a feature. Now that 3rd party systems are available to bring feature parity with OpenVPN, it would be interesting to see a comparison of the size of the code base inclusive of these 3rd party systems. Not interesting enough for me to put forth the effort to do it but still interesting.
Re: Identity management for WireGuard
#5Things I wish WireGuard supported out of the box:
- Logging of peer IPs when they initially connect or change (yes, you can do this with module flags, but it should come out of the box).
- Tieing WireGuard private keys to a source IP. As far as I know the endpoint flag does not enforce an IP, a peer can use a different one and still connect.
- More control over DNS resolution for endpoints. I want WireGuard to periodically refresh the endpoint IP when I change networks, for instance.
Re: Identity management for WireGuard
#6I'm currently running Tailscale at home, but will switch to Headscale once they get iOS support sorted out.
It's magical. It's well on the way towards being a critical piece of infrastructure in my mind.
Re: Identity management for WireGuard
#7Things I wish WireGuard supported out of the box: - Logging of peer IPs when they initially connect or change (yes, you can do this with module flags, but it should come out of the box). - Tieing WireGuard private keys to a source IP. As far as I know the endpoint flag does not enforce an IP, a peer can use a different one and still connect. - More control over DNS resolution for endpoints. I want WireGuard to period…
> I want WireGuard to periodically refresh the endpoint IP when I change networks, for instance.
Out of curiosity, why do you want this?
Re: Identity management for WireGuard
#8Things I wish WireGuard supported out of the box: - Logging of peer IPs when they initially connect or change (yes, you can do this with module flags, but it should come out of the box). - Tieing WireGuard private keys to a source IP. As far as I know the endpoint flag does not enforce an IP, a peer can use a different one and still connect. - More control over DNS resolution for endpoints. I want WireGuard to period…
wrt the IP not being enforced, do you mean different endpoints can require different IPs, or a client can connect to an endpoint with a different IP configured and it's all good? Last time I tested, if you set one IP per user in your wireguard config, that user must connect with that IP.
Re: Identity management for WireGuard
#9When Wireguard was 1st rolled out the smaller code base vs OpenVPN was touted as a feature. Now that 3rd party systems are available to bring feature parity with OpenVPN, it would be interesting to see a comparison of the size of the code base inclusive of these 3rd party systems. Not interesting enough for me to put forth the effort to do it but still interesting.
OpenVPN doesn't have awesome credential management baked in and the core networking code is an order of magnitude more complex, which is why the performance sucks compared to wireguard.
Re: Identity management for WireGuard
#10Things I wish WireGuard supported out of the box: - Logging of peer IPs when they initially connect or change (yes, you can do this with module flags, but it should come out of the box). - Tieing WireGuard private keys to a source IP. As far as I know the endpoint flag does not enforce an IP, a peer can use a different one and still connect. - More control over DNS resolution for endpoints. I want WireGuard to period…
> I want WireGuard to periodically refresh the endpoint IP when I change networks, for instance. Out of curiosity, why do you want this?
Split DNS, where WireGuard may resolve an endpoint differently on a LAN vs internet. Also for IPv4/IPv6 roaming--if WireGuard resolves an IPv6 address but moves to a non IPv6 network, the peer will never connect as far as I know.