Commercial enterprise VPN products are an open sewer, and there aren't any, from any vendor, that I trust. I don't like OpenVPN or strongSwan, but you'd be better off with either of them than you would be with a commercial VPN appliance. The gold standard, as ever, is Wireguard.
What do you recommend for a personal use?
Vulnerabilities exploited in VPN products used worldwide
131–140 of 140 posts
Re: Vulnerabilities exploited in VPN products used worldwide
#132Earlier quoted context omitted.
Yes. WireGuard is cryptographically superior to SSH, attaches at a network layer without fussy interactions with a Unix shell (that then also needs to be accounted for in a security model), has higher performance, is practically bulletproof in terms of keeping connections alive, and gets you direct access to whatever resources you've provisioned the network to provide. I wouldn't ding someone using SSH tunnels (caref…
Wireguard does not have better performance or is faster verses Openvpn in any independent Benchmark released up to now.
I was just benchmarking routers in VM. I also tested Openvpn vs Wireguard. Results:
Openwrt 18.06.4 32-bit
wireguard: 645 Mbit/s ping 1.1ms
openvpn: 164 Mbit/s ping 1.2ms
Openwrt 19 (snapshot r11159) 64-bit:
wireguard: 1.16 Gbit/s ping 1.1ms
openvpn: 230 Mbit/s ping 1.2ms
pfsense 2.4.4-p3 (amd64):
openvpn: 115 Mbit/s ping 1.2ms
1 core, 2GB per VM
iperf3 -t 60
Settings:
Wireguard: defaults
OpenVPN: no compression, udp, tun, defaults
Re: Vulnerabilities exploited in VPN products used worldwide
#133Earlier quoted context omitted.
Of course they're used for security -- VPNs are a hassle for users and admins, it'd be easier for everyone (except security!) if all internal apps were just public on the internet. VPNs are a band-aid / work-around for "we don't have strong authentication and authorization on all services". That's fine , not everyone can do the latter, and they can provide some safety v.s. the anonymous attacker case. But too often t…
You're ignoring the reality that most enterprise software is a tire fire (from a security standpoint) and that it's not feasible to secure hundreds (or even dozens!) of enterprise apps. VPN's are the enabler that ensures status quo remains.
I agree — band-aids aren't per-se a bad thing. However, a VPN isn't the ideal end state. Even if you can't modify the underlying application, the goal should be "wrap in a reverse-proxy that handles authn / some-amount-of-authz so you can minimise the risk".
VPNs handle network security, but don't protect you against an attacker able to compromise an endpoint in your corporate environment.
Re: Vulnerabilities exploited in VPN products used worldwide
#134Earlier quoted context omitted.
depends
Can you elaborate? Honestly asking.
I wouldn't recommend it with PCs, notebooks, phones, random crapware, but:
When you control¹ all the devices on the network, the network is small enough and the danger from the non-authenticated protocols isn't too high, then I would say it is reasonable to assume being present in the network is sufficient authentication. Not saying it could not be improved, but there are probably many more pressing concerns.
¹ you don't fully control anything anymore, but you're not going to fix that either.
Re: Vulnerabilities exploited in VPN products used worldwide
#135Earlier quoted context omitted.
If all of my remote access can be done via ssh {+ local/remote forwarding}, is there a reason for me to consider wireguard?
Yes. WireGuard is cryptographically superior to SSH, attaches at a network layer without fussy interactions with a Unix shell (that then also needs to be accounted for in a security model), has higher performance, is practically bulletproof in terms of keeping connections alive, and gets you direct access to whatever resources you've provisioned the network to provide. I wouldn't ding someone using SSH tunnels (caref…
>> If all of my remote access can be done via ssh {+ local/remote forwarding}..
> WireGuard .. has higher performance ...
Note there are circumstances where ssh port forwarding (-L, -R, -D) is faster than any L2/L3 vpn because it breaks TCP connections in two segments, so any flaky retransmission causing issues are localized, RTTs are smaller, TCP ramp-up is faster, etc.
On the other hand, ssh tun/tap forwarding will almost certainly be slower.
If you are connecting over a flaky wifi/2g/3g connection, possibly to a flaky/distant counterpart, and have performance issues, I would recommend trying (L4 is it?) ssh/socks or even http forwarding via a stable middle host.
Re: Vulnerabilities exploited in VPN products used worldwide
#136Earlier quoted context omitted.
Can you elaborate? Honestly asking.
I wouldn't recommend it with PCs, notebooks, phones, random crapware, but: When you control¹ all the devices on the network, the network is small enough and the danger from the non-authenticated protocols isn't too high, then I would say it is reasonable to assume being present in the network is sufficient authentication. Not saying it could not be improved, but there are probably many more pressing concerns. ¹ you d…
Thanks a lot. That gave some perspective. I'll keep that in mind.
Re: Vulnerabilities exploited in VPN products used worldwide
#137Earlier quoted context omitted.
Can you elaborate? Honestly asking.
I wouldn't recommend it with PCs, notebooks, phones, random crapware, but: When you control¹ all the devices on the network, the network is small enough and the danger from the non-authenticated protocols isn't too high, then I would say it is reasonable to assume being present in the network is sufficient authentication. Not saying it could not be improved, but there are probably many more pressing concerns. ¹ you d…
The air gapped power plant networks I work on have unused Ethernet ports shut off and the ones in use only accept traffic from the MAC address of the device that is meant to be there. So you can’t just show up and plug in.
Re: Vulnerabilities exploited in VPN products used worldwide
#138Earlier quoted context omitted.
There's nothing in the GPL about compensation or saying thanks. This is part and parcel of licensing your software in a way that respects user freedom. Also, I doubt Cloudflare forked WG, because 1) that could very well violate the terms of GPLv2 if they don't make the source available (at the very least, the client source code which utilises code lifted from WG would have to be open source), and 2) their offerings d…
I'm not accusing Cloud Flare of violating the GPL.
If you’re not saying that Cloudflare has done anything wrong or illegal, then I don’t get the point of what you’re saying. What are you trying to say?
Re: Vulnerabilities exploited in VPN products used worldwide
#139Earlier quoted context omitted.
I'm not accusing Cloud Flare of violating the GPL.
If you’re not saying that Cloudflare has done anything wrong or illegal, then I don’t get the point of what you’re saying. What are you trying to say?
The GP is saying Cloudflare did something ethicaly wrong, but not illegal.
Re: Vulnerabilities exploited in VPN products used worldwide
#140Commercial enterprise VPN products are an open sewer, and there aren't any, from any vendor, that I trust. I don't like OpenVPN or strongSwan, but you'd be better off with either of them than you would be with a commercial VPN appliance. The gold standard, as ever, is Wireguard.
Why do you prefer Wireguard over Openvpn?
Old thread, but I also really appreciate the simplicity. Configuring wireguard takes a little knowledge of routing (either iptables or firewalld, etc) but is vastly simpler to understand compared to OpenVPN. When things aren't working, there's a lot fewer thing to check.
Oh and it's blazing fast. I often times get better connection speeds when connected to the wireguard VPN than not, presumably because the TCP overhead all happens in the cloud rather than locally where latencies are much higher and bandwidth is more limited.
The roaming of Wireguard also makes it completely seamless. I'll often forget I'm even connected for days at a time.