Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard 1.0 for Linux 5.6

lists.zx2c4.com

Post reply on HN
Print view View original

111–120 of 214 posts

Re: WireGuard 1.0 for Linux 5.6

#111

Post by andrepew »

Glosster wrote: post #107

Do I understand correctly? You use WireGuard to set up your own VPN servers? Doing this is a lot more expensive than buying a VPN subscription, but it can be more secure if you know what you're doing, right?

I think it depends on what you're trying to achieve. If it is anonymity, setting it up yourself is probably not going to be a good idea.

If you can't trust a VPN provider for some reason or are trying to secure a route to a specific network, setting it up yourself starts to make sense.

Re: WireGuard 1.0 for Linux 5.6

#113

Post by RcrdBrt »

djsumdog wrote: post #88
kertis wrote: post #46

Earlier quoted context omitted.

As I know WireGuard team have no plans and desire for that.

huh .. OpenVPN is UDP by default but you can force it to TCP (we had to do that at one University site that would only open limited tcp ports for us). I also discovered Wireguard cannot bind to a specific adapter or IP address if you have multiple address on a server. That might not seem like as a big a deal since it only responds to fully authenticated packets, but it does mean that outgoing packets could be leaving…

https://github.com/wangyu-/udp2raw-tunnel

Re: WireGuard 1.0 for Linux 5.6

#114

Post by RcrdBrt »

labawi wrote: post #84
middleclick wrote: post #32

Earlier quoted context omitted.

I know, but the performance takes a massive hit. Have you tried it? Maybe it was something I did wrong.

Native wireguard is kernel-only. Udp2raw creates a detour via userspace, so more CPU time, delay, jitter .. Was it worse than you would expect? Worse than say openvpn or wireguard-rs/wireguard-go?

It's not that bad. Overhead is less than a full TCP encapsulation. I use it all the time

Re: WireGuard 1.0 for Linux 5.6

#115

Post by cjbprime »

laktak wrote: post #74

I use WireGuard and it works perfectly fine as it is. Can someone explain why we need/want to put it into the Linux kernel?

The version you've been using on Linux was already in the Linux kernel. It's a Linux kernel module. Now it's just part of the official Linux source release, so groups like Linux distributions such as Ubuntu will start turning it on by default.

Re: WireGuard 1.0 for Linux 5.6

#116

Post by djsumdog »

inetknght wrote: post #108
djsumdog wrote: post #86

Earlier quoted context omitted.

If you look at their tutorial video, you can see what's going on. The tutorial has a lot of commands like ip link add wg0 type wrieguard ip addr add 10.1.20.1/24 dev wg0 wg set wg0 listen-port 5100 private-key /etc/path/to/key ip link set wg0 up wg set wg0 peer........ If you look at the wg-quick script, it basically reads an /etc/wireguard/ .conf and runs the same commands based on your settings. It's great when you…

Can you link to the video you're mentioning?

The side-by-side video:

https://www.wireguard.com/quickstart/

Re: WireGuard 1.0 for Linux 5.6

#117

Post by gen220 »

willis936 wrote: post #75
Medicalidiot wrote: post #69

Earlier quoted context omitted.

How does raspberry pi run on stock Ubuntu?

I am actually not sure. I know raspbian has modifications in it that take care of board specific issues in it, such as high power consumption/heat from some issue related to USB PD and/or power states. I am not too familiar with the inner workings of distros and how hardware-specific fixes are propagated, but I like the idea of sticking with officially supported OS/hardware combos for "set and forget" boxes. Wireguar…

YMMV, but I was able to get https://archlinuxarm.org/ running on my pis without too much head-scratching.

arch is on 5.5.6 as of 3/1/2020 (https://www.archlinux.org/download/), and it seems like the ARM porters are pretty good about keeping their project in sync (two day delay): http://de3.mirror.archlinuxarm.org/os/rpi/.

My best guess is that by April or May, Arch will do the minor version bump, and then a couple days later Arch ARM will get it.

It doesn't have the same hardware/software synergy that you like, but it might be a fun weekend experiment.

Re: WireGuard 1.0 for Linux 5.6

#118

Post by Diederich »

newscracker wrote: post #14

For anyone wanting to try it, WireGuard with Algo VPN [1] to set it up on a server is a great combination. I found it quite easy to setup and use. Algo has built-in support for various cloud providers, where, when you run it from, day, your desktop, it can setup the VPN server for you based on answers to some questions (with sensible defaults) and some information on connecting to the provider (like an API key, for e…

Second this: I've been using Algo+Wireguard with digital ocean for the past year or so, and it's been seamless and excellent. Very easy to setup.

Re: WireGuard 1.0 for Linux 5.6

#119

Post by peterwwillis »

I like the idea of WireGuard as a simple tunnel, but I wish people would stop comparing it with VPNs. VPNs have lots of extra functionality that is necessary to support a variety of use cases, both functionally (like pushing routes or scripts to clients) and security-wise (like real key management and SSO).

I literally can't replace any VPN I currently use with Wireguard because I would lose needed functionality. I could maybe replace the tunnel to a bastion host, but even then I would actually be worse off security wise, because I'd be losing cert-based key management. (ex. https://smallstep.com/blog/use-ssh-certificates/)

Re: WireGuard 1.0 for Linux 5.6

#120

Post by willis936 »

nick2k3 wrote: post #109
willis936 wrote: post #64

Now I really want to know when raspbian will get linux kernel 5.6. The most recent version of raspbian came out in February 2020 and uses linux kernel 4.19, which came out in late 2018. https://en.wikipedia.org/wiki/Linux_kernel_version_history

it can actually work with 4.19 and the unstable repo. I'm using 4.19.105-v7+ (to solve a macvlan bug in the default .97 and it works. It's a pain to install the headers on raspbian though

That's what I've been doing, but I would like more official support for something as critical as VPN. I don't forward many ports across my NAT, so I really rely on the VPN to be rock solid. I am considering getting a second raspberry pi and running wireguard on two ports on two pis for redundancy (the ability to fix stuff after a bad update or me breaking something).
Post reply on HN