WireGuard 1.0 for Linux 5.6 • Hacker News Board

Re: WireGuard 1.0 for Linux 5.6

#161

Post by DaniloDias » Mon, Mar 30, 2020, 11:54 PM UTC

kaylynb wrote: post #150

WireGuard is great, but I think it's really undersold when it's described as being just a vpn. It's really an encrypted tunnel that is configured like a network adapter in the Linux network stack. This lets you configure it with stuff like systemd-networkd and unit files, or easily spin up a tunnel with a few `ip` commands, and setup some simple nftables rules to do all sorts of stuff. I do use it as a vpn as well, b…

Is there an application for containers? E.g. a way to set up an encrypted tunneling interface between containers that would allow you to avoid using TLS between the containers?

Re: WireGuard 1.0 for Linux 5.6

#162

Post by yjftsjthsd-h » Mon, Mar 30, 2020, 11:54 PM UTC

cyphar wrote: post #89

laktak wrote: post #74

I use WireGuard and it works perfectly fine as it is. Can someone explain why we need/want to put it into the Linux kernel?

WireGuard on Linux has always been implemented as a kernel module (a very small one at that). If you've used it on Linux, you've used the code that has been included in Linux 5.6. This is about the code being merged upstream into the main kernel repository which means that it'll likely be built-in to lots of distribution kernels and will no longer have the second-class status that most out-of-tree kernel modules have…

Well, strictly you could use the userspace implementations on Linux (which I looked at because I wanted to try running it in a Docker container, which does work with openconnect).

Re: WireGuard 1.0 for Linux 5.6

#163

Post by yjftsjthsd-h » Tue, Mar 31, 2020, 12:04 AM UTC

Hamuko wrote: post #104

Has the codebase been audited now?

I think you're getting downvoted because the post mentions the "codebase undergoing a quick security audit", which... I grant isn't the most in-depth and reassuring thing they could say, but certainly beats the previous "nobody has audited this, don't use it" (paraphrasing, but that's loosely what their front page used to say).

Re: WireGuard 1.0 for Linux 5.6

#164

Post by eliaspro » Tue, Mar 31, 2020, 12:47 AM UTC

DaniloDias wrote: post #161

kaylynb wrote: post #150

WireGuard is great, but I think it's really undersold when it's described as being just a vpn. It's really an encrypted tunnel that is configured like a network adapter in the Linux network stack. This lets you configure it with stuff like systemd-networkd and unit files, or easily spin up a tunnel with a few `ip` commands, and setup some simple nftables rules to do all sorts of stuff. I do use it as a vpn as well, b…

Is there an application for containers? E.g. a way to set up an encrypted tunneling interface between containers that would allow you to avoid using TLS between the containers?

There isn't really a need for a separate application to do this. Just create a WireGuard interface and move it to the container's namespace.

Re: WireGuard 1.0 for Linux 5.6

#165

Post by justlexi93 » Tue, Mar 31, 2020, 1:01 AM UTC

My understanding is that the standard Wireguard basically exposes all devices on LAN A to all devices on LAN B. A fair amount of software has to be added around it to use it for a single-machine-through-VPN-to-internet connection. Maybe commercial VPN providers have most of that software already, I don't know. But Wireguard by itself is not complete for that application.

Re: WireGuard 1.0 for Linux 5.6

#166

Post by m4b0 » Tue, Mar 31, 2020, 1:18 AM UTC

dang wrote: post #137

MrStonedOne wrote: post #129

This is not an appropriate announcement post for a product, as it does not explain what the fuck a wireguard is, and given that it has been in beta up until now, the number of people who read hacker news and won't know what the fuck a wireguard is, is high enough to warrant only a proper announcement post for the product.

We assume HN readers are smart enough to figure things out. https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... https://arstechnica.com/gadgets/2020/03/wireguard-vpn-makes-... is a related article, if that helps!

Thanks for the link. I got this news through the following link

https://www.phoronix.com/scan.php?page=news_item&px=Linux-5....

Re: WireGuard 1.0 for Linux 5.6

#167

Post by borplk » Tue, Mar 31, 2020, 1:53 AM UTC

Could WireGuard be a good choice for server-to-server encryption instead of TLS? (for example between a TLS terminating load balancer to the application servers)

Re: WireGuard 1.0 for Linux 5.6

#168

Post by kasey_junk » Tue, Mar 31, 2020, 2:39 AM UTC

borplk wrote: post #167

Could WireGuard be a good choice for server-to-server encryption instead of TLS? (for example between a TLS terminating load balancer to the application servers)

That’s precisely what my favorite “smart cdn” does https://fly.io/docs/architecture/

Re: WireGuard 1.0 for Linux 5.6

#169

Post by kalaracey » Tue, Mar 31, 2020, 3:01 AM UTC

dfcarney wrote: post #54

exabrial wrote: post #23

One thing I wish for wireguard: the ability to look up keys/ips in an external system like LDAP. I moved an entire call center [50+ people] fully remote last week. We're using wireguard. Key management stinks, and that is my only complaint! It is an incredible piece of software and I'm very thankful for it.

(Tailscale co-founder here.) Building on what katnegermis said, this is what we're trying to help with. We integrate with identity management systems and handle the key management (and NAT traversal) on top of WireGuard, making it easier to deploy and manage. If you're interested, a colleague of mine wrote up a blog post on how things work: https://tailscale.com/blog/how-tailscale-works/

Tailscale looks awesome but I would love a tier between “free single user with gmail” and “$10/user/month + GSuite/etc” (GSuite itself is $5/user/month I think?). Something like 1Password’s family plan, with the ability to use gmail accounts.

Then I would use it for my family, e.g. I could replace DynDNS + port forwarding I set up so my dad can control his home automation software (Hass.io) from his iPhone app, even off the WiFi. I’m unfortunately just not willing to set up/shell out for GSuite/Active Directory/Office365 for my family.

What really hooked me was your story about the medical practice a little while back.

Re: WireGuard 1.0 for Linux 5.6

#170

Post by [deleted] » Tue, Mar 31, 2020, 3:42 AM UTC

kitotik wrote: post #83

lifty wrote: post #25

I really hope WireGuard becomes a standard and get's included in the macOS/iOS and Windows kernels as well. Key management and and other fancy features could be left to userspace applications but having the basic wg capability in the kernel would be great.

Seems like a very long shot to make it into Apple products both because of the license and the fact it wasn’t invented in Cupertino. FWIW the userspace implementations are quite good, and still out performs IPSec.

[deleted]