Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is in net-next

git.kernel.org

Post reply on HN
Print view View original

151–160 of 208 posts

Re: WireGuard is in net-next

#151

Post by nullbyte »

jedberg wrote: post #115
Diederich wrote: post #84

Earlier quoted context omitted.

> I had a seamless time using wireguard (via a streisand installation) ... I've been using Wireguard via https://github.com/trailofbits/algo for a while now. Of all of the VPN experiences over the last couple of decades, Wireguard has been light-years ahead of the rest. First: it's fast . If the server is up and you don't have packet loss, you can't tell when it is turned on. For fun, I wrote some trivial automation…

> Second: it's easy. To give you some perspective, it's so easy that my four year old knows how to turn it on when we're traveling and she wants to watch PBS Kids.

But can your 4 year old set up Wireguard on a Debian server?

Psh, didn't think so. Amateur.

Re: WireGuard is in net-next

#152

Post by tptacek »

kortilla wrote: post #150
tptacek wrote: post #109

Earlier quoted context omitted.

WireGuard is much faster than OpenVPN, much simpler to set up than OpenVPN (except for having to set up IP addresses it's approximately as easy to get working as SSH), and it's much, much more secure than OpenVPN.

> WireGuard is much faster than OpenVPN Not relevant for most home internet connections > much simpler to set up than OpenVPN +1 > and it's much, much more secure than OpenVPN. That’s uselessly vague. Do you mean the protocol, the implementation approach, the underlying crypto, or what?

Yes, the protocol, yes, the implementation approach, and yes, the underlying crypto. That sounds like a snarky response, but you really did kind of cover it.

Re: WireGuard is in net-next

#153

Post by kortilla »

eeZah7Ux wrote: post #40
coldpie wrote: post #34

Earlier quoted context omitted.

I don't think it's fair to say "better" here. Waiting for stable software releases is a perfectly valid approach. It may not be your approach, which is also fine, but neither approach is better than the other.

The end goal here is security. Wireguard has an excellent track record, having a tiny, simple and clean codebase and having been reviewed by many skilled eyes. Most of other solutions don't come close to that.

Every security product has an excellent track record until vulnerabilities are found. Once it hits production and sees a 10000x increase in usage so it becomes a high value target for nation states, then it will be put to the real test.

Re: WireGuard is in net-next

#154

Post by BrandoElFollito »

api wrote: post #48
datenwolf wrote: post #32

Earlier quoted context omitted.

One would wish so! I recently had to start using PulseSecure. For authentication that damn thing loads a full blown webpage in the background, actually executes the JavaScript therein, fills some forms and submits that via POST. There's a PulseSecure module for openconnect, but it's unable to send the keepalive reauthentications, because it's unable to correctly associate the presented form inputs with the credential…

I can tell you that as long as the crypto in WireGuard is DJB stuff that can't be FIPS certified, Cisco and Juniper and such will still do a strong VPN business and you will rarely see it in BigCo, at least in the US. Security is largely about checking boxes to reduce liability, and FIPS is a checkbox. Corporate IT is unbelievably conservative. It's all still about Active Directory, Windows domains, and SSL VPNs with…

One of the reasons it is still AD is that the management of users and computers is simplified. You have several layers of admin access etc.

I use Linux since 1993 and love it. All my servers are on Linux. Managing them as a group is a nightmare. I would love to have an umbrella à la AD to have all servers and users unified inside.

Re: WireGuard is in net-next

#155

Post by F00Fbug »

loeg wrote: post #124
F00Fbug wrote: post #37

This is a big step forward! I'm hoping that the 1.0 release will prompt Netgate to consider inclusion in pfSense.

pfSense is a FreeBSD downstream, right? First you'd have to port Wireguard to FreeBSD. Or you could run the userspace server, but expect poor performance.

Exactly. Netgate has long said that they won't touch it until it's production-ready; they keep pointing to the warning messages in WireGuard saying that it's beta and when the time is right, they'll consider it.

I'm happy they're being cautious. The inclusion in the Linux kernel is perhaps (to Netgate) a sign that things are headed in the right direction.

As far as FreeBSD, all that exists today is a userspace package (AFAIK). Again, I'm hoping someone sees this as a step forward and will start working on the FreeBSD port.

I'm glad to see progress and hoping for more of it!

Re: WireGuard is in net-next

#156

Post by krzyk »

kortilla wrote: post #150
tptacek wrote: post #109

Earlier quoted context omitted.

WireGuard is much faster than OpenVPN, much simpler to set up than OpenVPN (except for having to set up IP addresses it's approximately as easy to get working as SSH), and it's much, much more secure than OpenVPN.

> WireGuard is much faster than OpenVPN Not relevant for most home internet connections > much simpler to set up than OpenVPN +1 > and it's much, much more secure than OpenVPN. That’s uselessly vague. Do you mean the protocol, the implementation approach, the underlying crypto, or what?

>> WireGuard is much faster than OpenVPN

> Not relevant for most home internet connections

Why it is not relevant?

Re: WireGuard is in net-next

#157

Post by Jnr »

samgranieri wrote: post #46

This is very welcome news! I had a seamless time using wireguard (via a streisand installation) on my honeymoon in Italy on my phone and more importantly, my wife's phone. It worked seamlessly. Next up I'd like to see this be an easy config option in Unifi's network managment tools

I don't remember exactly when I started using it but it feels like forever and I have forgotten about all the VPN nightmares that I had before. I can't wait for Wireguard support in all kinds of routers and other appliances.

Re: WireGuard is in net-next

#158

Post by vocatus_gate »

LeoPanthera wrote: post #99
F00Fbug wrote: post #37

This is a big step forward! I'm hoping that the 1.0 release will prompt Netgate to consider inclusion in pfSense.

Yes! The fact that it's not in pfSense is pretty much the only reason why I'm still using openvpn.

Same with OPNSense.

Re: WireGuard is in net-next

#159

Post by novok »

What is the timeline for making wireguard viable for commerical VPNs?

"""

There's a few fundamental issues with wireguard that make it relatively unsuitable for commercial VPNs with many customers.

For a start, if you want to offer customers multiple concurrent devices, each device needs it's own key, and all keys for all customers' devices need to be loaded into kernel memory and cross checked against every packet received, which as you might imagine gets incredibly unwieldy and could savagely impact the performance of PIA servers.

When wireguard has the ability to hook a userspace daemon when it receives a valid-looking packet with unrecognised encryption, it'll be a lot closer to usable in commercial contexts, as the daemon could poke a database or cache to load the required keys on demand

"""

https://www.reddit.com/r/PrivateInternetAccess/comments/d1bl...

Re: WireGuard is in net-next

#160

Post by Avamander »

shifto wrote: post #73
pilif wrote: post #14

Earlier quoted context omitted.

way simpler (and thus, I would argue, way more secure). way faster. On the other hand: No built-in client in any of the mobile OSes, so a third-party client install is required.

I like my always-on IPsec tunnel on android. Never really understood this entire wireguard hype. Probably because VPN just got a bit easier for some people..?

WireGuard can do always-on on Android.
Post reply on HN