211–220 of 293 posts
Earlier quoted context omitted.
I setup WireGuard on my Ubiquiti router and have profiles installed on my phone and Mac. Extremely convenient for some basic privacy when on a public hotspot.
Nice! Is it one of the UniFi ones?
I'm not sure if UniFi equipment supports the run times necessary for WireGuard.
----
UniFi has its own VPN type of software. Not sure what it is or how secure it is, though.
Earlier quoted context omitted.
Nice! Is it one of the UniFi ones?
No, it's an EdgeRouter. I'm not sure if UniFi equipment supports the run times necessary for WireGuard. ---- UniFi has its own VPN type of software. Not sure what it is or how secure it is, though.
Earlier quoted context omitted.
The tunnel does not have to encapsulate messages at the same layer as the tunnel itself. Consider this thought experiment: if you send Ethernet frames over WebSockets, what layer is the protocol? My understanding is the Wireguard messages are IP (L3) but the protocol messages itself are UDP (L4) and it seems reasonable to describe Wireguard as a session layer over UDP given how much state and connection information i…
The internet does not use OSI.
1. The physical connection and voltage/light levels
2. Switching and MAC addresses
3. Routing and IP addresses
4. TCP/UDP and port numbers
Fantastic news. I deploy WireGuard to provide a private network (mesh) between VPS servers. Each VPS instance has each other vps as peer. So no single source of failure. I run PostgreSQL with Patroni and GlusterFS over this mesh with no issues. When I add or destroy a VPS with Ansible all VPS nodes get an updated config and reload. This way I don't rely on a single cloud provider because I do not use their private ne…
From my experience file locking on a distributed filesystem is either not implemented correctly or has piss-poor performance -- and databases use them
Earlier quoted context omitted.
What's the rate of companies doing this?
I have no real idea, but I wouldn't be surprised if it is less than 1%.
Fantastic news. I deploy WireGuard to provide a private network (mesh) between VPS servers. Each VPS instance has each other vps as peer. So no single source of failure. I run PostgreSQL with Patroni and GlusterFS over this mesh with no issues. When I add or destroy a VPS with Ansible all VPS nodes get an updated config and reload. This way I don't rely on a single cloud provider because I do not use their private ne…
That's really interesting. So you essentially implemented a Virtual Private Cloud(VPC) on top of the "PHY" network of your hosts? Does that mean that all your nodes have to be accessible to the public internet?
The first is that for some reason I sometimes need to ping machine B from A in order to get to C via B (in my case B sits in a VPS, while A is a laptop and C is a desktop).
The other is that I would love to be able to connect directly over the LAN from A to C and vice versa, only going via B when A is mobile. I'm pretty sure that I could fix this with more IPv6 addresses and routing tables, but so far no joy.
Earlier quoted context omitted.
Check out https://tailscale.com/ a mesh VPN built on top of wireguard.
Another example of a product that looks interesting, but the folks responsible for marketing it make it a pain in the arse. This looks like it solves a problem I have. Looks like it might be a commercial product (mentions of Okta and "get started for free"), but I can't find out any more information without signing up which I don't want to do if it doesn't support the configuration I want or is more expensive than my…
They want early adopters (their friends) to play with their prototype, and they don't want to commit to pricing and long term support before they know what they can build and if it will work and how much it costs.
Earlier quoted context omitted.
I just learned about tailscale today on twitter. Here's the tweet from the founder https://twitter.com/davidcrawshaw/status/1222203472461926401... Looks really promising
It does look very nice. It's a shame that it depends on third parties for authentication, and that they have gems like this in their documentation: > No app-level integration or reconfiguration is required, because security is built into the network itself. If you configure your network to require Tailscale, every one of your internal services will be subject to multi-factor authentication. Which is simply not true.…
Why not? Doesn't the VPN authenticate you via VPN before you can access the apps?
Earlier quoted context omitted.
The tunnel does not have to encapsulate messages at the same layer as the tunnel itself. Consider this thought experiment: if you send Ethernet frames over WebSockets, what layer is the protocol? My understanding is the Wireguard messages are IP (L3) but the protocol messages itself are UDP (L4) and it seems reasonable to describe Wireguard as a session layer over UDP given how much state and connection information i…
The internet does not use OSI.