Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

im.salty.fish

Post reply on HN
Print view View original

11–20 of 66 posts

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#11

Post by freedomben »

jmclnx wrote: post #8

For people using wireguard, it was not designed to provide anonymity. Otherwise it is fine for use in Countries with decent protections for their citizens. If you need privacy, you should use OpenVPN. Quote: >WireGuard is highly secure, but it’s not designed with privacy in mind. from https://www.tomsguide.com/how-to/is-the-new-wireguard-protoc...

You're not wrong, but there are VPN services that add on privacy to their wireguard offerings, such as PIA (private internet access). They open sourced the connection code so you can see how they do it[1] using an API that initializes a temporary wireguard connection for you. I've been really pleased with PIA's wireguard setup, which even includes forwarding of an incoming port!

[1]: https://github.com/pia-foss/manual-connections/blob/master/c...

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#12

Post by systems_glitch »

We recently switched a bunch of stuff from OpenVPN to Wireguard. A number of the links were OpenVPN layer 2 tunnels to pass, of all things, Novell Netware running on IPX (the particular situation precludes switching to TCP/IP for those customers). Now, layer 2 tunneling is being performed using RFC 3378 EtherIP, and it's much more performant, not to mention easier to manage.

Old and new systems are running OpenBSD.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#13

Post by [deleted] »

systems_glitch wrote: post #12

We recently switched a bunch of stuff from OpenVPN to Wireguard. A number of the links were OpenVPN layer 2 tunnels to pass, of all things, Novell Netware running on IPX (the particular situation precludes switching to TCP/IP for those customers). Now, layer 2 tunneling is being performed using RFC 3378 EtherIP, and it's much more performant, not to mention easier to manage. Old and new systems are running OpenBSD.

[deleted]

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#14

Post by generalizations »

systems_glitch wrote: post #12

We recently switched a bunch of stuff from OpenVPN to Wireguard. A number of the links were OpenVPN layer 2 tunnels to pass, of all things, Novell Netware running on IPX (the particular situation precludes switching to TCP/IP for those customers). Now, layer 2 tunneling is being performed using RFC 3378 EtherIP, and it's much more performant, not to mention easier to manage. Old and new systems are running OpenBSD.

If you have a write up of how you managed to get layer 2 working inside wireguard, I'd love to read it.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#15

Post by FL410 »

generalizations wrote: post #14
systems_glitch wrote: post #12

We recently switched a bunch of stuff from OpenVPN to Wireguard. A number of the links were OpenVPN layer 2 tunnels to pass, of all things, Novell Netware running on IPX (the particular situation precludes switching to TCP/IP for those customers). Now, layer 2 tunneling is being performed using RFC 3378 EtherIP, and it's much more performant, not to mention easier to manage. Old and new systems are running OpenBSD.

If you have a write up of how you managed to get layer 2 working inside wireguard, I'd love to read it.

Me too.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#16

Post by Snawoot »

Or instead you can have HTTP proxy over TLS in just four steps: https://github.com/Snawoot/dumbproxy/wiki/Quick-deployment

You don't even need a client for this, any modern browser can work with it right away: https://github.com/Snawoot/dumbproxy#using-http-over-tls-pro...

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#17

Post by garbagecoder »

I just moved from OpenVPN to tailscale, which uses Wireguard, on my personal stuff. I have a similar situation as OP describes at first where my residential account has the ports blocked.

I am quite happy so far, just wish it was innately supported in my consumer grade router, which support vanilla wireguard.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#18

Post by 1970-01-01 »

>I always felt, and still feel, that applied Linux networking is difficult to get started with, mainly due to lack of good guidance. Most of the time I had to dig through small pieces of documentation scattered throughout the internet, trying to put them together to form a systematic overview of the network stack in Linux.

...

>It is extremely frustrating when somebody interested in setting up their own network infrastructure has to at some point get stuck at some convoluted networking concepts, intricate and abstract tools, mysterious errors here and there, or lack of systematic documentation. I wish everyone has some choices other than spending days and weeks trying to figure these out alone, so I decided to write down what I have done, what I have learned and what I have to share with the rest of the internet. I sincerely hope that some day IT operations would be more beginner-friendly, and hosting one's own network infrastructure no longer means headache and mess.

These are exactly my feelings. Stinky.fish makes more sense for a Linux blog. Everything about it stinks until it actually works. :)

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#19

Post by usui »

generalizations wrote: post #14
systems_glitch wrote: post #12

We recently switched a bunch of stuff from OpenVPN to Wireguard. A number of the links were OpenVPN layer 2 tunnels to pass, of all things, Novell Netware running on IPX (the particular situation precludes switching to TCP/IP for those customers). Now, layer 2 tunneling is being performed using RFC 3378 EtherIP, and it's much more performant, not to mention easier to manage. Old and new systems are running OpenBSD.

If you have a write up of how you managed to get layer 2 working inside wireguard, I'd love to read it.

Since WireGuard is Layer 3, what would is everyone's use case of doing Layer 2 on it? Or, what can it improve over existing solutions? I have tried to do the same for a bit while still learning networking, but ran into Layer 3 limitations.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#20

Post by gammajmp »

generalizations wrote: post #14
systems_glitch wrote: post #12

We recently switched a bunch of stuff from OpenVPN to Wireguard. A number of the links were OpenVPN layer 2 tunnels to pass, of all things, Novell Netware running on IPX (the particular situation precludes switching to TCP/IP for those customers). Now, layer 2 tunneling is being performed using RFC 3378 EtherIP, and it's much more performant, not to mention easier to manage. Old and new systems are running OpenBSD.

If you have a write up of how you managed to get layer 2 working inside wireguard, I'd love to read it.

Use a GRETAP interface; Red Hat's virtual interface documentation is phenomenal:

https://developers.redhat.com/blog/2019/05/17/an-introductio...

Post reply on HN