WireGuard 1.0 for Linux 5.6 • Hacker News Board

Re: WireGuard 1.0 for Linux 5.6

#101

Post by zeveb » Mon, Mar 30, 2020, 5:19 PM UTC

bawolff wrote: post #73

somehnguy wrote: post #67

Earlier quoted context omitted.

Linode has been compromised how many times now? I don't think considering a VPS insecure is really that far fetched.

That's kind of a tautology. If you assume the system is insecure, then yes its going to be insecure with that assumption. This is going to be true of any VPN system, so i think its an unfair criticism to level against this particular VPN setup. If you want to be secure against local adversaries, use TOR.

> That's kind of a tautology.

More specifically, it's begging the question. The actual definition of begging the question, not the mistaken usage.

To beg the question is to assume the thing which is to be proven.

Re: WireGuard 1.0 for Linux 5.6

#102

Post by derefr » Mon, Mar 30, 2020, 5:22 PM UTC

somehnguy wrote: post #67

tw04 wrote: post #21

Earlier quoted context omitted.

If you're subject to state level actors attacking you, a VPS is probably the least of your worries. If you're just trying to make sure some kiddiot in a coffee shop isn't doing mass collections, a VPS is perfectly secure.

Linode has been compromised how many times now? I don't think considering a VPS insecure is really that far fetched.

The bad actors who want to steal your passwords and credit-card data, and the state actors who want to spy on Persons of Interest, don't know each-other or talk to one-another. A VPS provider being compromised by a series of private individuals doesn't imply that your VPN running on such a service is going to be sneakily MITMed, because there's no obvious profit motive in doing so (unless you're a very publicly super-rich person who is also very publicly using the service, and it's very obvious how to blackmail you if you could just get data exfiltration via that service. Like Jeff Bezos with WhatsApp.)

Instead, you might get whatever elements of your identity stolen that Linode's account-management servers have possession of; or your VPS instance might become host to crypto-mining malware and then get shut down by Linode (which will come at no cost to you, other than the downtime.) But neither of these things will really focus on you personally. They're automated bulk attacks.

Re: WireGuard 1.0 for Linux 5.6

#103

Post by djsumdog » Mon, Mar 30, 2020, 5:24 PM UTC

I recently setup WireGuard on my new dedicated server and it is amazingly easier compared to OpenVPN. I've setup several site-to-site and client-to-site VPNs on OpenVPN so maybe I'm just use to all the iptables/route gotchas, but not needing to do the whole CA/easyrsa stuff is a huge bonus.

I like how their official tutorial video shows all the raw ip commands and then shows their wg-quick configuration script. That way you understand what the script is doing and what commands its running.

One big limitation is that it cannot bind to a specific IP address. The author states it shouldn't matter because it won't respond without the right auth key (and it doesn't support TCP so people can't tell if it's sitting there listening) but I found I did get into weird routing loops where packets will come in on one IP and go out on another one. The primary outgoing IP is what shows up when you run `wg show`.

It is super weird to implement a brand new service and have a config option for the port, but not the IP address(es) to listen on.

Re: WireGuard 1.0 for Linux 5.6

#104

Post by Hamuko » Mon, Mar 30, 2020, 5:28 PM UTC

Has the codebase been audited now?

Re: WireGuard 1.0 for Linux 5.6

#105

Post by jeltz » Mon, Mar 30, 2020, 5:32 PM UTC

api wrote: post #98

zajio1am wrote: post #65

Earlier quoted context omitted.

Or much slower on systems with AES-NI, but relatively slow CPU. Like are used in some hi-end SOHO routers. I did not test IPSec vs WireGuard, but scp from/to my home router/NAS is about three times faster with AES (used by IPSec) than with Chacha20 (used by WG).

Good point. AES hardware acceleration makes a massive difference. It's why ZeroTier 2.x will use AES. Tiny boxes that lack HW acceleration are generally not used in cases where they're pushing enough bandwidth to matter anyway.

No, but boxes who lack hardware acceleration might care about battery life.

Re: WireGuard 1.0 for Linux 5.6

#106

Post by jeltz » Mon, Mar 30, 2020, 5:35 PM UTC

tomcooks wrote: post #22

Should you want to try it on a cheap VPS and fail at it, make sure that your shared host has tun-tap and wireguard modules installed (open a ticket)

Yeah, I noticed that it failed on Hetzner when I tried it about a year ago. What I did instead was use boringtun from Cloudflare. Did not open any ticket though. I might want to try again and see if it works.

Re: WireGuard 1.0 for Linux 5.6

#107

Post by Glosster » Mon, Mar 30, 2020, 5:35 PM UTC

Do I understand correctly? You use WireGuard to set up your own VPN servers? Doing this is a lot more expensive than buying a VPN subscription, but it can be more secure if you know what you're doing, right?

Re: WireGuard 1.0 for Linux 5.6

#108

Post by inetknght » Mon, Mar 30, 2020, 5:35 PM UTC

djsumdog wrote: post #86

exabrial wrote: post #53

Earlier quoted context omitted.

Interesting... I'll have to take a look at what the utilities are actually done then and how they're loading the keys into the interface

If you look at their tutorial video, you can see what's going on. The tutorial has a lot of commands like ip link add wg0 type wrieguard ip addr add 10.1.20.1/24 dev wg0 wg set wg0 listen-port 5100 private-key /etc/path/to/key ip link set wg0 up wg set wg0 peer........ If you look at the wg-quick script, it basically reads an /etc/wireguard/ .conf and runs the same commands based on your settings. It's great when you…

Can you link to the video you're mentioning?

Re: WireGuard 1.0 for Linux 5.6

#109

Post by nick2k3 » Mon, Mar 30, 2020, 5:36 PM UTC

willis936 wrote: post #64

Now I really want to know when raspbian will get linux kernel 5.6. The most recent version of raspbian came out in February 2020 and uses linux kernel 4.19, which came out in late 2018. https://en.wikipedia.org/wiki/Linux_kernel_version_history

it can actually work with 4.19 and the unstable repo. I'm using 4.19.105-v7+ (to solve a macvlan bug in the default .97 and it works. It's a pain to install the headers on raspbian though

Re: WireGuard 1.0 for Linux 5.6

#110

Post by nessunodoro » Mon, Mar 30, 2020, 5:39 PM UTC

Glosster wrote: post #107

Do I understand correctly? You use WireGuard to set up your own VPN servers? Doing this is a lot more expensive than buying a VPN subscription, but it can be more secure if you know what you're doing, right?

A VPN is one use of a Wireguard tunnel. Wireguard establishes a stateless encrypted connection between two peers, and exposes it to the user as a network interface. Endpoints can roam as with mosh