Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

im.salty.fish

Post reply on HN
Print view View original

21–30 of 66 posts

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#21

Post by manmal »

garbagecoder wrote: post #17

I just moved from OpenVPN to tailscale, which uses Wireguard, on my personal stuff. I have a similar situation as OP describes at first where my residential account has the ports blocked. I am quite happy so far, just wish it was innately supported in my consumer grade router, which support vanilla wireguard.

I thought tailscale works through all kinds of firewalls due to some connection setup magic (initiating connection from both sides at once).

EDIT: I think I misunderstood your comment, you probably are wishing for tailscale client support in the router?

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#22

Post by nirav72 »

garbagecoder wrote: post #17

I just moved from OpenVPN to tailscale, which uses Wireguard, on my personal stuff. I have a similar situation as OP describes at first where my residential account has the ports blocked. I am quite happy so far, just wish it was innately supported in my consumer grade router, which support vanilla wireguard.

>consumer grade router, which support vanilla wireguard.

See if your consumer grade router supports flashing OpenWRT. It supports Wireguard.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#23

Post by icehawk »

jmclnx wrote: post #8

For people using wireguard, it was not designed to provide anonymity. Otherwise it is fine for use in Countries with decent protections for their citizens. If you need privacy, you should use OpenVPN. Quote: >WireGuard is highly secure, but it’s not designed with privacy in mind. from https://www.tomsguide.com/how-to/is-the-new-wireguard-protoc...

Parts of this article are just downright wrong

At time of writing, the biggest privacy weakness that WireGuard has is how it assigns IP addresses. When you connect to a VPN service using OpenVPN or IKEv2, you’re assigned a different IP address each time. WireGuard instead gives you the same IP address each time. This is faster, but it means the VPN server must keep logs of your real IP address and connection timestamps.

The address assigned inside the tunnel has nothing to do with your real address, and definitely does not have anything to do with whether or not the VPN server is keeping logs of your real IP address and timestamps of your connection.

OpenVPN and charon keep far more logs of those things by default that wireguard and you have to trust your VPN provider turned them off.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#24

Post by slacka »

1970-01-01 wrote: post #18

>I always felt, and still feel, that applied Linux networking is difficult to get started with, mainly due to lack of good guidance. Most of the time I had to dig through small pieces of documentation scattered throughout the internet, trying to put them together to form a systematic overview of the network stack in Linux. ... >It is extremely frustrating when somebody interested in setting up their own network infra…

I experienced this back when I configured my home Linux boxes as a router, VPN server, firewall, media server, etc. Since I had the time, compiled all of the info I found on random blogs and sites and added them to the Ubuntu Community wiki. That was the 12.x days, when Ubuntu was in its prime and the distro to use.

While these blogs were a great resource, I often found the commands outdated or applied to a different distro. A distro specific wiki solves both those issue. While I don't get the glory of a blog, I just checked an it's nice to see my notes still there for future Denvercoder9's.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#25

Post by easytiger »

1970-01-01 wrote: post #18

>I always felt, and still feel, that applied Linux networking is difficult to get started with, mainly due to lack of good guidance. Most of the time I had to dig through small pieces of documentation scattered throughout the internet, trying to put them together to form a systematic overview of the network stack in Linux. ... >It is extremely frustrating when somebody interested in setting up their own network infra…

Ironically enterprise networking on Linux is incredibly simple

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#26

Post by mulmen »

Meta: Huh. I don’t use “shallow dive” enough. “Deep dive” of course, everyone loves a good deep dive. But what about a shallow dive, or even just “getting your feet wet”? These are useful concepts too. This headline alone revealed a blind spot for me.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#27

Post by gerdesj »

systems_glitch wrote: post #12

We recently switched a bunch of stuff from OpenVPN to Wireguard. A number of the links were OpenVPN layer 2 tunnels to pass, of all things, Novell Netware running on IPX (the particular situation precludes switching to TCP/IP for those customers). Now, layer 2 tunneling is being performed using RFC 3378 EtherIP, and it's much more performant, not to mention easier to manage. Old and new systems are running OpenBSD.

Good grief - NetWare with only IPX! Presumably you'll be installing their Y2K patches any day soon 8)

I'm pretty sure NetWare can natively tunnel IPX/SPX over TCP/IP, assuming you are not stuck on 3.12. I don't think you have to fork out for the multi protocol router thing. They will crash regularly until you get the magic combination spot on and then run forever.

A NW 6.5 box will run quite happily as a pretty tiny VM - you could scatter them around as routers to support whatever nightmare of an app you need to run over IPX. Tunnel them over IPSEC or whatever floats your boat.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#28

Post by garbagecoder »

nirav72 wrote: post #22
garbagecoder wrote: post #17

I just moved from OpenVPN to tailscale, which uses Wireguard, on my personal stuff. I have a similar situation as OP describes at first where my residential account has the ports blocked. I am quite happy so far, just wish it was innately supported in my consumer grade router, which support vanilla wireguard.

>consumer grade router, which support vanilla wireguard. See if your consumer grade router supports flashing OpenWRT. It supports Wireguard.

It doesn't, really. It's an AX-82 and there's only a hackish version for it.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#29

Post by zokier »

gammajmp wrote: post #20
generalizations wrote: post #14

Earlier quoted context omitted.

If you have a write up of how you managed to get layer 2 working inside wireguard, I'd love to read it.

Use a GRETAP interface; Red Hat's virtual interface documentation is phenomenal: https://developers.redhat.com/blog/2019/05/17/an-introductio...

The docs are indeed great, but to me it seems like they are recommending GENEVE (RFC 8926):

> Generic Network Virtualization Encapsulation (GENEVE) supports all of the capabilities of VXLAN, NVGRE, and STT and was designed to overcome their perceived limitations. Many believe GENEVE could eventually replace these earlier formats entirely

I'm bit surprised that they didn't have section on vxlan there considering it is pretty popular afaik?

Anyways, I think tunneling GENEVE (or any other Ethernet-over-IP protocol) should work fine over WireGuard, same as using regular network interfaces.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#30

Post by zokier »

usui wrote: post #19
generalizations wrote: post #14

Earlier quoted context omitted.

If you have a write up of how you managed to get layer 2 working inside wireguard, I'd love to read it.

Since WireGuard is Layer 3, what would is everyone's use case of doing Layer 2 on it? Or, what can it improve over existing solutions? I have tried to do the same for a bit while still learning networking, but ran into Layer 3 limitations.

One example usecase would be to try to tunnel something like BOOTP/DHCP/PXE/TFTP stack, which iirc is bit tricky with only L3 tunneling.
Post reply on HN