Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard Gives Linux a Faster, More Secure VPN

wired.com

Post reply on HN
Print view View original

161–170 of 306 posts

Re: WireGuard Gives Linux a Faster, More Secure VPN

#161

Post by grumblez »

kortilla wrote: post #156
grumblez wrote: post #153

Earlier quoted context omitted.

Your physical network settings likely didn't allow direct connections between peers. Fix that and it'll work fine.

If it’s replacing an ipsec mesh that’s pretty hard to believe. And if that was the issue and commercial support couldn’t even identify that as the cause, ZeroTier has bigger issues.

If all sites are behind symmetric NATs, there's not much ZeroTier could do to help aside from telling him to assign direct mappings on the NAT/Firewall to each ZT instance. Symmetric NATs are antithetical to peer to peer communication. Many I've run across in the wild have special rules to handle IPSec which won't exist for other lesser known protocols. It's also possible the user wasn't willing or able to make network configuration changes to make those p2p connections possible. Without seeing what the user tried & support recommended, it's not really fair to throw out such baseless accusations.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#162

Post by oaiey »

fivesixzero wrote: post #13

Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…

I think opinionated is the real deal. You can make smarter software and focus on features and on the way create a better future. Being able to twist and specialize everything is not always good.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#163

Post by globular-toast »

fivesixzero wrote: post #13

Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…

I think most developers are technocrats at heart and this is the manifestation of that.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#164

Post by nikisweeting »

0xbadcafebee wrote: post #60

What I don't like about WireGuard: - Basically no real user or admin-oriented docs. There's some example configs and some getting started guides, and then some crypto-nerd look-how-secure-our-algorithms-are docs, but no real guidance on how to set up a reasonably simple network of hosts. - Authentication/authorization is just IP addresses and public keys? What about users and service accounts that you want to rotate…

Here's some docs: https://github.com/pirate/wireguard-docs

Re: WireGuard Gives Linux a Faster, More Secure VPN

#165

Post by api »

lapinot wrote: post #142

I really like wireguard, but one thing that bugs me is the fact that it's layer 3 (an ip tunnel) and has no code to support layer 2 (ethernet MAC tunnel). The downside for me is that you have to manage static ips in the configurations (specifically it's not compatible with ipv6 slaac and NDP). There is https://git.zx2c4.com/wg-dynamic but it's very experimental at the moment. The level 3-only tunnel is motivated as "…

Substituting MAC for IP address is exactly what ZeroTier does. MACs can't be spoofed, though nodes can be designated as bridges and that allows them to impersonate MACs.

There's still the issue of authenticating IPv4 IPs though, which are too small to embed anything useful into. ZeroTier has a certificate system for that but it requires the use of the rules engine to enable it.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#166

Post by nikisweeting »

philsnow wrote: post #98
HideousKojima wrote: post #44

Earlier quoted context omitted.

Wouldn't it only be 70^2 (or 69^2 or 69*70 maybe?)? Each of the 70 devices has a VPN connection to 69 other devices. So only ~5,000 total

wireguard uses UDP so they're not actual "connections"

Yeah this is a critical point that the others are ignoring, it only sends packets when they're actual traffic. Maintaining 5000 connections is pretty easy when they're not big stateful TCP sockets.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#167

Post by api »

cpach wrote: post #152
lapinot wrote: post #142

I really like wireguard, but one thing that bugs me is the fact that it's layer 3 (an ip tunnel) and has no code to support layer 2 (ethernet MAC tunnel). The downside for me is that you have to manage static ips in the configurations (specifically it's not compatible with ipv6 slaac and NDP). There is https://git.zx2c4.com/wg-dynamic but it's very experimental at the moment. The level 3-only tunnel is motivated as "…

Out of curiosity, what is the use case for doing VPN at layer 2?

Someone else said broadcast/multicast, so I'll also add communication with legacy systems that don't speak IP or have other wacky requirements. These do exist in industrial and embedded settings. It's a niche use case but it's very useful there.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#168

Post by wahern »

Avamander wrote: post #157
Hello71 wrote: post #106

Earlier quoted context omitted.

the "none" cipher isn't even that bad... if you do a packet capture, you can clearly see that the data is unencrypted. the worst part about IPsec is that there are many modes which look secure, but actually aren't secure at all. examples: encrypted but unauthenticated packets, encrypted but unauthenticated channel negotiation, encrypted by default but downgradable cipher negotiation...

This is why I abandoned using it, knowing the average quality of an online article I couldn't trust that the configuration was secure and there were no official very secure templates.

This is a problem with the IKE implementation. A secure IPSec configuration on OpenBSD is a single line, and you can copy+paste it from the excellent man page.

Part of what makes WireGuard "simple" is that it doesn't support any kind of key management--i.e. PKI. Instead you're expected to copy keys around manually. IKE is the most complex part of the IPSec software stack but in many ways the most important part.

Ironically but entirely predictably, people are using homegrown scripts and proprietary third-party services to replace the missing key management aspect of WireGuard. When these turn out to be insecure, or at least the weakest link in the chain, nobody will ever blame WireGuard, even though it will be a predictable consequence of using WireGuard.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#169

Post by api »

kortilla wrote: post #156
grumblez wrote: post #153

Earlier quoted context omitted.

Your physical network settings likely didn't allow direct connections between peers. Fix that and it'll work fine.

If it’s replacing an ipsec mesh that’s pretty hard to believe. And if that was the issue and commercial support couldn’t even identify that as the cause, ZeroTier has bigger issues.

It was probably behind finicky and heavily restrictive symmetric NAT (very p2p-hostile) but with IPSec ALG in the NAT, making it work fine with IPSec but horribly with anything else. This is common in "enterprise" settings and hard to diagnose without direct remote access to run NAT characterization tests.

Symmetric NAT basically breaks everything that doesn't use a simple client/server hub-and-spoke networking model.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#170

Post by nightfly »

rattray wrote: post #160
kortilla wrote: post #155

Earlier quoted context omitted.

Broadcast/multicast propagation.

Can you say more to explain the utility of this to those unfamiliar with networking?

You can send data to N hosts by only sending it once, rather than N times.
Post reply on HN