Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is now in Linus' tree

lists.zx2c4.com

Post reply on HN
Print view View original

261–270 of 293 posts

Re: WireGuard is now in Linus' tree

#261

Post by snowwrestler »

treesknees wrote: post #215
mosselman wrote: post #192

Earlier quoted context omitted.

I have no real idea, but I wouldn't be surprised if it is less than 1%.

The problem I ran into is that my company will match employee contributions to registered non-profits. Wireguard doesn't seem to be a project under a registered non-profit. My company won't donate to a random Patreon or PayPal link.

There have been numerous threads here on HN about this: donating to people to support open source development does not match up with what companies usually do, so it runs into all sorts of corporate friction. Whereas a monthly or annual support contract is the sort of thing that companies do all the time, and at low dollar amounts it might not require much approval at all.

Unfortunately it is up to open source developers themselves to set their business model, and many don't seem to like (or want to do the work of) setting up overtly commercial relationships like support contracts.

Re: WireGuard is now in Linus' tree

#262

Post by alibert »

axiomdata316 wrote: post #253
alibert wrote: post #252

Is the Windows client offering better now? I'm still using the old alternative Tunsafe client on Windows because it is more stable than the official client on my laptop (got several bugs with sleep/resume/hibernation/long lived session). Well... I just tried to install the latest official Windows client and got an error about Wintun missing when activating a tunnel :/

I thought the Wintun driver was bundled with the WireGuard installation but if you need to install it separately I believe you can do it from https://www.wintun.net/ Hope it helps. The Windows client is very stable now.

Thank you for your help. Unfortunately, the files available on wintun.net can't be used.

Re: WireGuard is now in Linus' tree

#263

Post by plapetomain »

3xblah wrote: post #257
plapetomain wrote: post #185

Earlier quoted context omitted.

Optimum and Fios are two isps in the US. > Try running a UDP-only DNS server from home on some random port. No reason to run DNS. However, I run openvpn udp between three houses (fios, Comcast, cablevision) for nearly 15 years. It’s pretty common, works fine. Again in the US... cable, fiber and dsl internet service comes with a public mostly unfiltered IPv4 address, the address is dynamic but in practice it is extrem…

"No reason to run DNS." Hmmm, it was a yes or no question. Are you suggesting it work would if you did.

Yes, pretty much since most ISPs do not block UDP port 53.

I have no reason to run DNS on a home internet connection. What would a sane use case be? They don’t block it because it would be stupid to use it anyway.

Ports that are typically blocked include 67, 139, 161, 520, 547, etc.. ie dhcp, rip, smb, snmp... none of them are any great loss to those that want to run a vpn.

Running a VPN or ssh service is another story and it works fine both TCP and UDP.

Re: WireGuard is now in Linus' tree

#264

Post by yardstick »

treesknees wrote: post #230
yardstick wrote: post #173

Earlier quoted context omitted.

WireGuard is nice but needs 2FA support. Until then it can’t be used in various corporate road warrior scenarios. Also until Cisco, Juniper, etc add WireGuard support and enough devices are deployed with it, IPsec will remain the corporate tool of choice when connecting between different organisations. Within the same org, where you have greater control of the equipment used, WireGuard is a bit more feasible.

What you're describing (authentication/2FA) should be handled by a client application. VPN client software should handle authentication/authorization with the corporate VPN server. Once it's authenticated, it can exchange/generate the public-private keys used for the WireGuard tunnel. The VPN client then installs those keys and starts the tunnel. After that, it's up to the client and server VPN software to handle ses…

That’s still just one factor on the tunnel itself, which is the problem. If the keypair is discovered somehow, attackers could connect to your network without 2FA. Or am I missing something?

So what software can I use now to make 2FA work with WireGuard that’s simple to use - as simple as OpenVPN (cert+user/pass is trivial in OpenVPN and supported in their clients).

Re: WireGuard is now in Linus' tree

#265

Post by philjohn »

willis936 wrote: post #204
philjohn wrote: post #134

Earlier quoted context omitted.

I've run into both issues, for the first I moved my internal network to a subnet in the 10.0.0.0 range and the second was a DPI firewall at a hotel I stayed at - in the end I have a dual mode setup where if I HAVE to I connect to an OpenVPN endpoint in my network, otherwise it's wireguard all the way.

That’s irritating at best. The whole point of using wireguard, to me, was to move away from openVPN. If I can’t do that then why would I bother hosting a second way to punch through to my network?

Well, it's a lot faster for one, and I suspect it will be allowed through like OpenVPN is once traction is higher.

Re: WireGuard is now in Linus' tree

#266

Post by sdan »

rid wrote: post #193
sdan wrote: post #74

Earlier quoted context omitted.

Traefik. Recently they started supporting TCP so now I do both HTTP for websites and TCP for databases

Are you using TLS over TCP to route to the DBs?

I think I was doing TLS at one point, but removed it temporarily in an effort to focus on other infrastructure stuff.

Re: WireGuard is now in Linus' tree

#268

Post by GhettoMaestro »

throwaway2048 wrote: post #255
vbezhenar wrote: post #145

Earlier quoted context omitted.

I'm not "seriously" interacted, but I have VPN server and I'm using it on all devices in my hope (laptop, PC, phone) which are behind WiFi NAT. They work just fine. I'm using strongswan and IKEv2 on server.

Your NAT behaves and likely has (working) IPSEC ALG stuff, plenty of setups don't.

Bullshit. If you don't have ALG/fix-ups for FTP, IPSec, etc your device sucks.

Re: WireGuard is now in Linus' tree

#269

Post by [deleted] »

plapetomain wrote: post #263
3xblah wrote: post #257

Earlier quoted context omitted.

"No reason to run DNS." Hmmm, it was a yes or no question. Are you suggesting it work would if you did.

Yes, pretty much since most ISPs do not block UDP port 53. I have no reason to run DNS on a home internet connection. What would a sane use case be? They don’t block it because it would be stupid to use it anyway. Ports that are typically blocked include 67, 139, 161, 520, 547, etc.. ie dhcp, rip, smb, snmp... none of them are any great loss to those that want to run a vpn. Running a VPN or ssh service is another sto…

[deleted]

Re: WireGuard is now in Linus' tree

#270

Post by tatersolid »

Hello71 wrote: post #35
wmf wrote: post #27

Earlier quoted context omitted.

A polling/batching implementation of WireGuard would be faster than the Linux kernel implementation although it would be much less convenient to use. If WireGuard spends, say, 90% of its time in ChaCha20-Poly1305 (which is already highly optimized) then there's only room for less than 10% speedup.

it could be faster with a hardware chacha20 implementation. if wireguard gets really popular, we might see that eventually. I'd wager a guess that we would get hardware wireguard first though, with fast path acceleration, similar to hardware TLS.

Modern CPUs are pretty close to being ASICs for ARX ciphers like ChaCha. Add, rotate, and XOR all have dedicated die area. Bernstein designed it that way.

Are there any hardware ASIC implementations of ChaCha or are they basically unnecessary?

Post reply on HN