Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard 1.0 for Linux 5.6

lists.zx2c4.com

Post reply on HN
Print view View original

191–200 of 214 posts

Re: WireGuard 1.0 for Linux 5.6

#191

Post by seanalltogether »

twic wrote: post #185

I'm a bit baffled by WireGuard. From 10 000 feet, the protocol is similar to IPSec - encrypt packets, and send them over the internet using a connectionless protocol. So why is it so much better? Is it because it's a new and simpler implementation than what we have for IPSec? Is it because the protocol, being newer, is simpler and cleaner than IPSec? Is it because, being newer, it can use a modern ciphersuite? Are th…

From what I understand, Wireguard is intentionally non crypto-agile. Wireguard 1.0 has a mandated cyrpto suite, and in the future 2.0 or 3.0 would have mandated standards as well. As a result the connection negotiation is simplified and interop is guaranteed between providers.

Re: WireGuard 1.0 for Linux 5.6

#192

Post by kungtotte »

dewey wrote: post #156
curiousgal wrote: post #148

Earlier quoted context omitted.

I wish people would stop automatically recommending Algo, for instance it doesn't support Arch. It's the best if your platform is supported. Otherwise, it's easier to just manually set up everything.

So they shouldn't recommend a project that works for a bunch of popular platforms out of the box because it doesn't support one niche OS?

Three of the top 20 list on distrowatch are Arch or Arch derivatives, including the number 2 spot. Its wiki is widely recommended as well for users of any distro.

"Niche" is a bad way to describe Arch.

It's probably more likely that a person interested in setting up WireGuard and their own VPN are running Arch or a derivative than any other distro.

Re: WireGuard 1.0 for Linux 5.6

#193

Post by Craighead »

apawloski wrote: post #55
wisam wrote: post #37

Earlier quoted context omitted.

Just be careful when setting up Algo VPN. Its secure defaults will probably block all other services you're running on your server and render them inaccessible. You might even end up not being able to ssh to your server if you choose not to let Algo set up ssh configurations (because you have your own). I would say install Algo on a dedicated droplet or backup your VPS before setting it up.

This is the intended behavior/deployment model of Algo (as a dedicated VPN server on a dedicated VM). If you are running other co-resident services and need more lenient firewall rules / system configuration, you should consider another option.

So how does one update it? Don't say "ssh into the host".

Re: WireGuard 1.0 for Linux 5.6

#194

Post by andrewnicolalde »

dfcarney wrote: post #54
exabrial wrote: post #23

One thing I wish for wireguard: the ability to look up keys/ips in an external system like LDAP. I moved an entire call center [50+ people] fully remote last week. We're using wireguard. Key management stinks, and that is my only complaint! It is an incredible piece of software and I'm very thankful for it.

(Tailscale co-founder here.) Building on what katnegermis said, this is what we're trying to help with. We integrate with identity management systems and handle the key management (and NAT traversal) on top of WireGuard, making it easier to deploy and manage. If you're interested, a colleague of mine wrote up a blog post on how things work: https://tailscale.com/blog/how-tailscale-works/

Wow! I'm super happy I gave this a try. I've been trying to put together an elegant solution to this problem for my personal infrastructure for over a year now and the furthest I ever got was an OpenVPN server on DigitalOcean and an EasyRSA folder full of certificates. I was living in UK university halls at the time, so my main use-case was being able to access my computers located in my UK uni dorm while visiting home in the US and accessing my US machines while at university in the UK.

It is extremely refreshing to not have to deal with key/certificate management, and to have all my VPN traffic be directly client to client instead of via a slow (or expensive) and likely remote VPN server.

Great product and I can't wait for some time to play around with it further!

Re: WireGuard 1.0 for Linux 5.6

#196

Post by angristan »

tjoff wrote: post #127

Does anyone know of a decent bash-script (or even self-hosted page) that one could use to administer wireguard? Could go very far with trivial functionality, such as listing, adding, removing users and download a config file/qr-code.

I made this very basic script to setup a quick wg server and client: https://github.com/angristan/wireguard-install

Re: WireGuard 1.0 for Linux 5.6

#198

Post by hitpointdrew »

JustFinishedBSG wrote: post #184
dzonga wrote: post #122

Earlier quoted context omitted.

Algo vpn is the best way to set up wireguard.

In my experience Wireguard is nearly trivial to setup so I don't see the point of algo

I honestly think the algo ansible scripts just make it more confusing. I agree with you, setup isn't that hard, and you learn it better setting it up without ansible scripts.

Re: WireGuard 1.0 for Linux 5.6

#199

Post by dfc »

kungtotte wrote: post #192
dewey wrote: post #156

Earlier quoted context omitted.

So they shouldn't recommend a project that works for a bunch of popular platforms out of the box because it doesn't support one niche OS?

Three of the top 20 list on distrowatch are Arch or Arch derivatives, including the number 2 spot. Its wiki is widely recommended as well for users of any distro. "Niche" is a bad way to describe Arch. It's probably more likely that a person interested in setting up WireGuard and their own VPN are running Arch or a derivative than any other distro.

I love Arch's wiki and the userbase's enthusiasm. But how in the world do you think Arch is the most probable distro base for a wg user? Using your distrowatch reference, 4 of the top 5 are Debian based.

Re: WireGuard 1.0 for Linux 5.6

#200

Post by cyphar »

packetlost wrote: post #81
fullstop wrote: post #59

Earlier quoted context omitted.

It was merged in 5.6, which was tagged less than 24 hours ago.

Ah, I remember reading about it like a month ago or so but I though it had already been released

You're not misremembering -- Linux has releases every 6-7 weeks. WireGuard was merged into 5.6-rc1 a little over a month ago and the story was posted to HN from memory.
Post reply on HN