Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Identity management for WireGuard

lwn.net

Post reply on HN
Print view View original

101–107 of 107 posts

Re: Identity management for WireGuard

#101

Post by LouisvilleGeek »

tomschlick wrote: post #89
zamalek wrote: post #85

> Despite Headscale's unofficial status, Tailscale seems to be fully supportive of its efforts; Tailscale has coordinated with Headscale's creator on API changes and hired one of Headscale's maintainers. I have noticed an interesting change psychology arising from behavior such as this. I am more likely to use Tailscale (at the very least professionally, if not personally) instead of the free/OSS version because of t…

I agree. It probably helps make the decision because of how easy it would be to fall back on the FOSS version if needed, but for now its worth offloading the setup/hosting for the relatively small fee.

Have either of you priced the product for 150+ users?

Re: Identity management for WireGuard

#102

Post by bongobingo1 »

yardstick wrote: post #99
bongobingo1 wrote: post #97

Earlier quoted context omitted.

My point is, you deny by default and only allow your static ips at the FW. You need a firewall rule anyway to let the wg traffic through. WG was built to handle roaming, and the FW can do a great job of filtering by address already, so it makes sense to not bloat wg with extra code to me.

But the FW can’t filter by source IP and key, which is important to some people. There’s a gap in security coverage between WG and FW. This is commonly supported by IPsec implementations already. Remember your WG service could be terminating many tunnels from many different sources. Some yes roaming may be valid. Others not. There is no way in WG to selectively disable roaming for some keys but not others. This may b…

Ah yes, great point.

Re: Identity management for WireGuard

#103

Post by asmr »

I'll definitely check out Headscale, I have similar infrastructure setup with pfsense running wg on a VPS that connects to my pfsense box at home. I have other VPS that connect to the cloud pfsense box and routes setup to the home box so I essentially have an extended LAN. This seems promising as it will remove the pain of configuring additional clients.

Re: Identity management for WireGuard

#104

Post by tssva »

pvg wrote: post #86
tssva wrote: post #83

Earlier quoted context omitted.

Plenty of code size comparisons with Wireguard and 3rd party apps providing feature parity with OpenVPN? Can you provide some links? The Wireguard paper makes notes of many things including the lines of code needed to implement. "I'd say using OpenVPN or IPSEC in 2022 without some powerful compatibility, regulatory, or network complexity concern to support it is malpractice." Life is complicated and those type of con…

You were asking whether Wireguard's design goals and criteria still hold up and the answer to that is that they do.

I never asked that! I said it would be interesting to see how the line count of Wireguard and the 3rd party software needed to bring it in feature parity with OpenVPN compared with OpenVPN since the line count of Wireguard by itself is touted as an advantage.

Re: Identity management for WireGuard

#105

Post by tssva »

stoplying1 wrote: post #91
tssva wrote: post #83

Earlier quoted context omitted.

Plenty of code size comparisons with Wireguard and 3rd party apps providing feature parity with OpenVPN? Can you provide some links? The Wireguard paper makes notes of many things including the lines of code needed to implement. "I'd say using OpenVPN or IPSEC in 2022 without some powerful compatibility, regulatory, or network complexity concern to support it is malpractice." Life is complicated and those type of con…

The hand waving and moving goalposts would be less glaring if you, you know, mention a single use case where WG is supposedly the inferior solution?

What hand waving and moving of goalposts it that? All I stated was that it would be interesting to see a comparison of line count of Wireguard and the 3rd party tools needed to bring it into feature parity with OpenVPN to the line count of OpenVPN. My above comment just asked for references to studies doing just that which the comment I was responding to claimed to exist.

Re: Identity management for WireGuard

#106

Post by pvg »

tssva wrote: post #104
pvg wrote: post #86

Earlier quoted context omitted.

You were asking whether Wireguard's design goals and criteria still hold up and the answer to that is that they do.

I never asked that! I said it would be interesting to see how the line count of Wireguard and the 3rd party software needed to bring it in feature parity with OpenVPN compared with OpenVPN since the line count of Wireguard by itself is touted as an advantage.

It's not 'touted as an advantage' based on line count alone and the 'feature parity' thing doesn't apply as explained in the comments above.

Re: Identity management for WireGuard

#107

Post by Handytinge »

mr337 wrote: post #20
lifty wrote: post #12

Earlier quoted context omitted.

is there any chance they will be able to fix it? as far as I know the iOS client does not support setting a custom control server.

So far doesn't look like it unless you go the MDM route, which I guess is aimed mainly at enterprise users. https://github.com/tailscale/tailscale/issues/5431

Wow, that's a pretty bullshit sounding response from tailscale. "We don't want to overcrowd the settings". It's ok to say "we'd prefer our users used our paid auth, rather than self host auth and use the fruits of our labour for the app". No need to be so opaque about it.
Post reply on HN