Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our User-Mode WireGuard Year

fly.io

Post reply on HN
Print view View original

31–40 of 169 posts

Re: Our User-Mode WireGuard Year

#31

Post by tptacek »

anderspitman wrote: post #28
tptacek wrote: post #25

Earlier quoted context omitted.

1. Tailscale is amazing. I hate them so much. (We use Tailscale and are very happy with it.) 2. Tailscale is user-mode WireGuard. 3. "User-mode WireGuard" in the sense this post uses the term is a misnomer and refers to the fact that we run TCP/IP itself in userland (Tailscale normally runs through a tunnel device and uses your native TCP/IP stack). 4. But Tailscale also has code to do user-mode TCP/IP (they've got i…

Last I heard[0] they were experimenting but hadn't shipped it. AFAIK their client still requires root, no? Running on wasm sounds awesome. This[1] looks like it. Do you know how they're doing the actual networking? WebRTC tunnel? [0]: https://news.ycombinator.com/item?id=24483173 [1]: https://twitter.com/bradfitz/status/1451423386777751561?lang...

Yeah, their client is always going to require privileges, because it needs to enable every other program on the system to interact directly with remote hosts transparently. User-mode TCP/IP works for us because we own the client-side program that our users run to talk to stuff on Fly.io.

Re: Our User-Mode WireGuard Year

#33

Post by anderspitman »

pmarreck wrote: post #23
anderspitman wrote: post #14

Usermode WireGuard would be a big deal. I maintain a list[0] of tunneling solutions, and one of the only limitations of systems built on WireGuard is the requirement for admin privileges. Even with the performance hit from running outside the kernel, UDP-based tunnels have a lot of advantages for multiplexing channels. Pretty much your only mainstream options today are QUIC and WireGuard, and only QUIC is intended to…

Is https://tailscale.com/ not "usermode WireGuard"? I've been playing with it for a while now (it has a fairly generous free tier) and am quite impressed. I can access any of my LAN machines (my servers, my NAS, etc.) from anywhere that is also connected to the same network, and the names work for DNS as well.

It depends on what sort of tunneling you're doing. If you just want a general-purpose private VPN, Tailscale is amazing. That list is more focused on the use case where you want to host a public server on a machine that isn't accessible to the internet (NAT, corporate firewall, etc). Think a shared Jellyfin server for your friends and family.

You can use Tailscale here but you'll need to separately run a reverse-proxy on a public machine. There are more moving pieces but if you're using Tailscale already then it's a good option.

Re: Our User-Mode WireGuard Year

#34

Post by tptacek »

mwcampbell wrote: post #16

> being able to pop a shell on a running app was table-stakes for the platform. Tangent: that's debatable IMO. In my company's current AWS infrastructure, there's no shell access to either the production containers or the host machines. I did write a script to create an ephemeral container that lets me (and future staff) run a shell inside the production network. And the thing I usually do in that shell is run psql;…

It's funny you bring this up, because I had the same thought when I was first implementing SSH (the initial implementation relied on native WireGuard, and just plugged a client certificate into your running SSH agent). I thought people might not want to enable SSH access, and so I made the provisioning of the root SSH certificate optional: you have to run `flyctl ssh establish` to tell us to set up a root cert for your organization.

It's turning out to have been a misfeature that confuses people more than it helps anyone, and we may get to a place soon where we just automatically provision a root cert for new organizations.

Re: Our User-Mode WireGuard Year

#35

Post by ffk »

anderspitman wrote: post #14

Usermode WireGuard would be a big deal. I maintain a list[0] of tunneling solutions, and one of the only limitations of systems built on WireGuard is the requirement for admin privileges. Even with the performance hit from running outside the kernel, UDP-based tunnels have a lot of advantages for multiplexing channels. Pretty much your only mainstream options today are QUIC and WireGuard, and only QUIC is intended to…

Very cool!

Found a gap, Linux Foundation's FD.io's VPP (a high performance network virtual switch) has native wireguard support as well, all in userspace. Support here means you can do full kernel bypass from the app all the way down to the NIC card (e.g. via DPDK).

https://docs.fd.io/vpp/20.09/d5/d54/wireguard_plugin_doc.htm...

I'll open a PR on this later.

Re: Our User-Mode WireGuard Year

#36

Post by qbasic_forever »

api wrote: post #2

WireGuard is just a transport protocol, so of course you could use it in place of SSL/TLS if you wanted. Interesting though, and I prefer it to SSL/TLS because X509 certs suck.

Replacing SSL/TLS with wireguard is cool but aren't you just going to run into the same headaches of rotating certificates/keys? No one is really going to rely on using the same wireguard key indefinitely, right?

Re: Our User-Mode WireGuard Year

#37

Post by mwcampbell »

tptacek wrote: post #34
mwcampbell wrote: post #16

> being able to pop a shell on a running app was table-stakes for the platform. Tangent: that's debatable IMO. In my company's current AWS infrastructure, there's no shell access to either the production containers or the host machines. I did write a script to create an ephemeral container that lets me (and future staff) run a shell inside the production network. And the thing I usually do in that shell is run psql;…

It's funny you bring this up, because I had the same thought when I was first implementing SSH (the initial implementation relied on native WireGuard, and just plugged a client certificate into your running SSH agent). I thought people might not want to enable SSH access, and so I made the provisioning of the root SSH certificate optional: you have to run `flyctl ssh establish` to tell us to set up a root cert for yo…

So do you think I'm being too extreme on this? Or did you just implement SSH because customers want it?

Re: Our User-Mode WireGuard Year

#38

Post by tptacek »

mwcampbell wrote: post #37
tptacek wrote: post #34

Earlier quoted context omitted.

It's funny you bring this up, because I had the same thought when I was first implementing SSH (the initial implementation relied on native WireGuard, and just plugged a client certificate into your running SSH agent). I thought people might not want to enable SSH access, and so I made the provisioning of the root SSH certificate optional: you have to run `flyctl ssh establish` to tell us to set up a root cert for yo…

So do you think I'm being too extreme on this? Or did you just implement SSH because customers want it?

I think it's sensible to run an application fleet without SSH access, but it's tough for a hosting provider that has to support lots of different application fleets to not offer a way to get a shell. Our authorization systems are about to get sharply more interesting as we roll out Macaroon-style tokens this quarter, so I'm optimistic we'll get to a place where we make both styles of application owners happy.

I was more on your side when I wrote the feature, and I'm less on your side now. Also, I SSH into instances to debug things all the time. :)

Re: Our User-Mode WireGuard Year

#39

Post by tptacek »

Karrot_Kream wrote: post #20
samwillis wrote: post #13

Earlier quoted context omitted.

I think their super power here is employing a renowned security expert who is an incredibly good communicator! (And happens to be a top HN contributor)

I'm pretty sure their experience running an ISP helps too heh.

It's definitely all my talent that keeps this place running. I'm definitely not just a noisy message board guy who got hired after most of this infrastructure was built and deployed and then just proceeded to make a bunch of message board noise about it.

Re: Our User-Mode WireGuard Year

#40

Post by amscanne »

tptacek wrote: post #25
pmarreck wrote: post #23

Earlier quoted context omitted.

Is https://tailscale.com/ not "usermode WireGuard"? I've been playing with it for a while now (it has a fairly generous free tier) and am quite impressed. I can access any of my LAN machines (my servers, my NAS, etc.) from anywhere that is also connected to the same network, and the names work for DNS as well.

1. Tailscale is amazing. I hate them so much. (We use Tailscale and are very happy with it.) 2. Tailscale is user-mode WireGuard. 3. "User-mode WireGuard" in the sense this post uses the term is a misnomer and refers to the fact that we run TCP/IP itself in userland (Tailscale normally runs through a tunnel device and uses your native TCP/IP stack). 4. But Tailscale also has code to do user-mode TCP/IP (they've got i…

I think Tailscale uses user-mode TCP/IP (also gVisor netstack) for some client devices, like iOS? But could be wrong here.
Post reply on HN