Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard 1.0 for Linux 5.6

lists.zx2c4.com

Post reply on HN
Print view View original

141–150 of 214 posts

Re: WireGuard 1.0 for Linux 5.6

#141

Post by Godel_unicode »

PureParadigm wrote: post #126
Florin_Andrei wrote: post #125

Earlier quoted context omitted.

> not needing to do the whole CA/easyrsa stuff is a huge bonus That's good to hear, but how does it handle authentication / authorization?

Before connecting each client needs to be set up with (1) its own private key and (2) the server's public key. The server also needs to have each client's public key. Once you have securely shared this information out-of-band, there cannot be a man-in-the-middle attack because both sides know the expected public key of the other side, and can prove ownership of their own public key.

And no, out of the box there's no equivalent to "trust any cert issued by this CA and lookup the username in ldap based off of the cn". Enterprisey auth is left as an exercise for the reader.

Re: WireGuard 1.0 for Linux 5.6

#142

Post by oedmarap »

tjoff wrote: post #127

Does anyone know of a decent bash-script (or even self-hosted page) that one could use to administer wireguard? Could go very far with trivial functionality, such as listing, adding, removing users and download a config file/qr-code.

I forked such a script [0] and use it for setup/admin of my WireGuard server/users for my PCs and phone.

[0] https://github.com/oedmarap/wg-install

Re: WireGuard 1.0 for Linux 5.6

#143

Post by vbezhenar »

exabrial wrote: post #23

One thing I wish for wireguard: the ability to look up keys/ips in an external system like LDAP. I moved an entire call center [50+ people] fully remote last week. We're using wireguard. Key management stinks, and that is my only complaint! It is an incredible piece of software and I'm very thankful for it.

Why not OpenVPN?

Re: WireGuard 1.0 for Linux 5.6

#144

Post by tptacek »

Florin_Andrei wrote: post #125
djsumdog wrote: post #103

I recently setup WireGuard on my new dedicated server and it is amazingly easier compared to OpenVPN. I've setup several site-to-site and client-to-site VPNs on OpenVPN so maybe I'm just use to all the iptables/route gotchas, but not needing to do the whole CA/easyrsa stuff is a huge bonus. I like how their official tutorial video shows all the raw ip commands and then shows their wg-quick configuration script. That…

> not needing to do the whole CA/easyrsa stuff is a huge bonus That's good to hear, but how does it handle authentication / authorization?

Pretty much the same way vanilla SSH does, without the trust-on-first-use bit.

Re: WireGuard 1.0 for Linux 5.6

#146

Post by blacksmith_tb »

L_Rahman wrote: post #134
eadmund wrote: post #26

Earlier quoted context omitted.

I think the idea is that you're supposed to build a system to manage WireGuard using that sort of information. I.e. WireGuard provides the basic primitives and second- or third-party tooling uses them. I like that idea, because it means that the actual WireGuard core is small and it's usable right now. It is annoying that someone hasn't yet developed neat integrations for WireGuard and stuff I might want to use, but…

I'm looking forward to the days when we have good user management for Wireguard. It's so hard to scale it across just my family right now.

Algo (mentioned above) will generate a bunch of profiles for you (including QR codes to configure mobile devices without needing to type awkward strings), which works pretty well for me - at least with a family you won't need to add or revoke identities very often I'd hope...

Re: WireGuard 1.0 for Linux 5.6

#147

Post by bjoli »

zajio1am wrote: post #65
api wrote: post #52

Earlier quoted context omitted.

WG is much faster in our tests than OpenVPN, and a bit faster than IPSec depending on the system. OpenVPN uses UDP too but OpenVPN is kind of slow.

Or much slower on systems with AES-NI, but relatively slow CPU. Like are used in some hi-end SOHO routers. I did not test IPSec vs WireGuard, but scp from/to my home router/NAS is about three times faster with AES (used by IPSec) than with Chacha20 (used by WG).

i did test it. in my setup we couldn't get IPsec to not drop a lotmof packages, so the benefits of aes-ni was lost in retries. switching that IPsec setup to chacha20-poly1305 actually made most of the drops go away.

I have no idea what was going on, but wireguard and IPsec was comparable in that test, with ispec being sliiiightly faster. the network has almost no latency, so if the retries remain on slower networks, that would change.

Re: WireGuard 1.0 for Linux 5.6

#148

Post by curiousgal »

dzonga wrote: post #122
newscracker wrote: post #14

For anyone wanting to try it, WireGuard with Algo VPN [1] to set it up on a server is a great combination. I found it quite easy to setup and use. Algo has built-in support for various cloud providers, where, when you run it from, day, your desktop, it can setup the VPN server for you based on answers to some questions (with sensible defaults) and some information on connecting to the provider (like an API key, for e…

Algo vpn is the best way to set up wireguard.

I wish people would stop automatically recommending Algo, for instance it doesn't support Arch. It's the best if your platform is supported. Otherwise, it's easier to just manually set up everything.

Re: WireGuard 1.0 for Linux 5.6

#149

Post by joombaga »

L_Rahman wrote: post #133
mcdevilkiller wrote: post #123

Earlier quoted context omitted.

I id have some problems with algo behind a NAT. Though my usecase is a bit different, more of a road warrior, as I wanted to be able to access a server in one property (behind NAT) from my home PC (also NAT). I suppose I just need port forwarding.

I was in a similar situation. Port forwarding worked perfectly. In my case the server I was trying to access was behind an ISP (Comcast) managed NAT so I had to go through them to open the port. Much to my surprise they were extremely helpful and understanding of the request.

Was this residential or business? I didn't know there were Comcast managed NATs beyond their internal network.

Re: WireGuard 1.0 for Linux 5.6

#150

Post by kaylynb »

WireGuard is great, but I think it's really undersold when it's described as being just a vpn. It's really an encrypted tunnel that is configured like a network adapter in the Linux network stack.

This lets you configure it with stuff like systemd-networkd and unit files, or easily spin up a tunnel with a few `ip` commands, and setup some simple nftables rules to do all sorts of stuff.

I do use it as a vpn as well, but it's so much easier to setup than, say, OpenVPN, where you need to create tun/br interfaces and then tie them together with a service, etc. That said, OpenVPN and other actual VPN software does more than just a tunnel (like pushing routes, config settings, etc), so WireGuard cannot replace everything by itself.

The documentation is rather sparse, but there isn't much to it either. The manpages have what you need to know and the rest is just general Linux network stack knowledge.

Post reply on HN