Really recommend if your systemd is up to date, describing your wg interfaces in .netdev files. Really clean, starting to really like systemd with things like this...
WireGuard is submitted for Linux kernel inclusion
151–160 of 189 posts
Re: WireGuard is submitted for Linux kernel inclusion
#152I've been using Wireguard on both my laptop and my Android phone for about two months. I've been using the wg-quick systemd units, and everything has worked amazingly well. The only downside I've notice is slightly increased battery consumption on my phone, but that's to be expected (it uses approximately 5% of the battery per day). I use dnsmasq to resolve DNS queries on the server side. Dnsmasq's configuration file…
>slightly increased battery consumption on my phone, but that's to be expected (it uses approximately 5% of the battery per day). Are you using the user-space implementation or the kernel module? I'm curious as to the difference in battery consumption.
I'm using the user space implementation.
Re: WireGuard is submitted for Linux kernel inclusion
#153I've been using Wireguard on both my laptop and my Android phone for about two months. I've been using the wg-quick systemd units, and everything has worked amazingly well. The only downside I've notice is slightly increased battery consumption on my phone, but that's to be expected (it uses approximately 5% of the battery per day). I use dnsmasq to resolve DNS queries on the server side. Dnsmasq's configuration file…
You can install pretty easy the F-Droid repository / store and download DNS66 from there. ( FOSS Ad-Blocking via DNS ).
I was using DNS66, much is user friendly and very effective. Unfortunately, it is implemented as a VPN, and Android will allow one VPN to be active at a time.
Re: WireGuard is submitted for Linux kernel inclusion
#154You may want to check out the very nice presentation on WireGuard at Kernel Recipes: https://www.youtube.com/watch?v=9Rk4doELmwM
There are several other (and newer) presentations here as well: https://www.wireguard.com/presentations/
is there a presentation explaining some of the networking setup you need to understand in order to get wireguard working properly? For example, a common openVPN complaint is that the default setup hijacks all your network traffic -- and on ubuntu since 16.04 the default config gives a dns leak (they changed to systemd-resolved)
Re: WireGuard is submitted for Linux kernel inclusion
#155Earlier quoted context omitted.
Doing DH with Curve25519 is a broadly understood conventional public key based key agreement scheme. We have good reason to think these are an excellent, fast, secure way to do things, unless your adversary has a working large Quantum Computer so that they can use Shor's algorithm. NTRU Prime is for a post-quantum KEM. This does, yes, solve the same piece of the puzzle in a sense. But it's essentially one enormous ex…
The docs do say: "Finally, WireGuard is cryptographically opinionated. It intentionally lacks cipher and protocol agility. If holes are found in the underlying primitives, all endpoints will be required to update." ECDH 25519 will fall like a house of cards to a capable quantum computer. Since Wireguard is already entirely DJB, the introduction of a tiny bit of agility with one of Bernstein's submissions (Classic McE…
If you believe that demanding agility is "far from unreasonable" I strongly recommend taking that line rather than insisting people should use relatively untried shiny new toys out of fear of a monster that may not actually be under their beds.
I don't know that WireGuard's author will agree, but you at least have a coherent argument that makes sense. Replacing 25519 with NTRU because you're terrified of a bogeyman (in the form of Quantum Computers able to run an algorithm that solves the appropriate hard problem) doesn't make sense.
Re: WireGuard is submitted for Linux kernel inclusion
#156Re: WireGuard is submitted for Linux kernel inclusion
#157Earlier quoted context omitted.
I'll make a new post here, I'm guessing a few people will want to know.
Yes, we'd all love to see it when you're done.
If you don't want to wait, I posted the configuration in a sibling comment. It's pretty much that, along with some more details on how to add it and run it.
Re: WireGuard is submitted for Linux kernel inclusion
#158I've been using Wireguard on both my laptop and my Android phone for about two months. I've been using the wg-quick systemd units, and everything has worked amazingly well. The only downside I've notice is slightly increased battery consumption on my phone, but that's to be expected (it uses approximately 5% of the battery per day). I use dnsmasq to resolve DNS queries on the server side. Dnsmasq's configuration file…
> The only downside I've notice is slightly increased battery consumption on my phone, but that's to be expected (it uses approximately 5% of the battery per day). Note that if you run a phone that has the WireGuard kernel module (rather than the userspace implementation), battery usage winds up being basically nil in my tests. As for the userspace fallback, we expect performance (and hence battery life) to increase…
>Note that if you run a phone that has the WireGuard kernel module
I wonder if LineageOS plans to include this module..
Re: WireGuard is submitted for Linux kernel inclusion
#159Earlier quoted context omitted.
Doing DH with Curve25519 is a broadly understood conventional public key based key agreement scheme. We have good reason to think these are an excellent, fast, secure way to do things, unless your adversary has a working large Quantum Computer so that they can use Shor's algorithm. NTRU Prime is for a post-quantum KEM. This does, yes, solve the same piece of the puzzle in a sense. But it's essentially one enormous ex…
The docs do say: "Finally, WireGuard is cryptographically opinionated. It intentionally lacks cipher and protocol agility. If holes are found in the underlying primitives, all endpoints will be required to update." ECDH 25519 will fall like a house of cards to a capable quantum computer. Since Wireguard is already entirely DJB, the introduction of a tiny bit of agility with one of Bernstein's submissions (Classic McE…
You can use WireGuard with rather expensive but conservative PQ primitives like Classic McEliece using the PSK feature of WireGuard, giving you hybrid PQ secrecy. The PSK feature was explicitly designed for this. The idea is that first you create a normal WireGuard tunnel. Then _through it_, so that it's authenticated, maybe even over boring old TCP, you negotiate your potpourri of experimental post quantum exchanges, maybe several of them if you don't want to trust a first round NIST submission right off the bat. Then you put the resultant key from this into WireGuard's PSK slot, and voila, now you have post quantum forward secrecy.
The Noise protocol framework (on which WireGuard is based) is now looking into doing PQ authentication, so that will be interesting. But until we actually have a clue which PQ primitives to use and have spent some time working out PQ handshakes, I think it's best to keep this all separate and ad-hoc, making it possible with the simple PSK feature.
Re: WireGuard is submitted for Linux kernel inclusion
#160Earlier quoted context omitted.
Based on what you stated, I assume this VPS is running on OpenVZ? If so, I doubt it will ever see newer kernel features, in part due to OpenVZ hosts relying on ancient LTS kernel branches and also due to OpenVZ "optimizations", whereby kernel features that use extra resources to enable just get disabled. Or, if your lucky they'll give you a button to re-enable them for youe container on an ad-hoc basis. Heads up, $20…
Where do you get these $20/y deals?
Lots of offers on lowendtalk.com. Not all equally reliable.
Arubacloud is pretty good, but €1 offer is only available in Italy.
Besides that RamNode, BuyVM, Hetzner and Ultravps are pretty good (though all a bit more expensive than 20$/year).