WireGuard 1.0 for Linux 5.6 • Hacker News Board

Re: WireGuard 1.0 for Linux 5.6

#211

Post by borplk » Wed, Apr 01, 2020, 8:35 AM UTC

jblwps wrote: post #209

borplk wrote: post #167

Could WireGuard be a good choice for server-to-server encryption instead of TLS? (for example between a TLS terminating load balancer to the application servers)

What net benefits would you see that having? If I'm allowed to assume that you wouldn't use TLS because of PKI management concerns, I have a hard time seeing how using WireGuard in the large wouldn't have the same problems--you still have to build some kind of management platform on top that verifies host authenticity (ultimately including revocations and more). That is to say, WireGuard in the large will surely (rig…

Yes mainly because of proper PKI management overhead.

Wouldn't Wireguard work with a simple shared secret on both ends?

Re: WireGuard 1.0 for Linux 5.6

#212

Post by terrywang » Wed, Apr 01, 2020, 11:42 AM UTC

place1 wrote: post #174

I'm a big fan of Wireguard. I wrote wg-access-server [1] as an all-in-one wireguard VPN solution. I recently added some docs [2] and support for deploying with Helm. I'd love some feedback on here or on github. Give it a try. [1] https://github.com/place1/wg-access-server [2] https://place1.github.io/wg-access-server/

Thank you place1.

I was looking for something like wg-access-server web UI when moving away from strongSwan. Found Subspace but id didn't work the way I wanted, settled pretty well with some shell scripting for my own use cases and happy lol

I think wg-access-server makes a lot of sense to people who want to self-host VPN on cheap VPS like Vultr or DigitalOcean, Lightsail, etc., it is simple, easy to deploy and use, flexible and scalable (if deployed to k8s).

Re: WireGuard 1.0 for Linux 5.6

#213

Post by L_Rahman » Thu, Apr 02, 2020, 2:17 AM UTC

d00bianista wrote: post #208

L_Rahman wrote: post #134

Earlier quoted context omitted.

I'm looking forward to the days when we have good user management for Wireguard. It's so hard to scale it across just my family right now.

Like a good Unix tool, that's outside of WG's scope. User management is done with the likes of LDAP and such.

I completely agree that it should never be part of Wireguard itself. Mostly looking forward to the project and tooling ecosystem that develops around it.

Re: WireGuard 1.0 for Linux 5.6

#214

Post by L_Rahman » Thu, Apr 02, 2020, 2:21 AM UTC

blacksmith_tb wrote: post #146

L_Rahman wrote: post #134

Earlier quoted context omitted.

I'm looking forward to the days when we have good user management for Wireguard. It's so hard to scale it across just my family right now.

Algo (mentioned above) will generate a bunch of profiles for you (including QR codes to configure mobile devices without needing to type awkward strings), which works pretty well for me - at least with a family you won't need to add or revoke identities very often I'd hope...

I'm using Algo right now and it's perfect if I plan to maintain the same server consistently. The problem is that we're constantly traveling around and latency suffers when trying to connect to a box in DO's NYC3 from Vietnam.

It's a huge hassle to take that box down, spin up a new instance in Singapore, distribute profiles and authenticate. This is neither Algo nor Wireguard's fault. I just wish we had some more tooling to make it easier to move between instances.