Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Identity management for WireGuard

lwn.net

Post reply on HN
Print view View original

31–40 of 107 posts

Re: Identity management for WireGuard

#31

Post by generalizations »

tssva wrote: post #4

When Wireguard was 1st rolled out the smaller code base vs OpenVPN was touted as a feature. Now that 3rd party systems are available to bring feature parity with OpenVPN, it would be interesting to see a comparison of the size of the code base inclusive of these 3rd party systems. Not interesting enough for me to put forth the effort to do it but still interesting.

The feature parity I'm waiting for is L2 VPNs. Wireguard is strictly L3-only, and so far all I've seen are some custom hacks to tunnel L2 ethernet frames over wg.

Re: Identity management for WireGuard

#32

Post by jetbalsa »

LinuxBender wrote: post #29

I only do self-hosted options so it might be a while before I really tinker with Wireguard. I've looked into setting it up but it does not meet my needs today for dynamic mesh routing and requires much of the system configuration of OpenVPN or Strongswan albeit simpler configuration but the same concepts still apply. My preferred ideal dream setup would be if the Tinc open source VPN had integration with OpenLDAP for…

Sounds like you are looking for a self hosted ZeroTier or Tailscale.

Re: Identity management for WireGuard

#33

Post by syntaxing »

Spooky23 wrote: post #22
snoopy_telex wrote: post #6

I'm currently running Tailscale at home, but will switch to Headscale once they get iOS support sorted out. It's magical. It's well on the way towards being a critical piece of infrastructure in my mind.

I felt the same way until Tailscale mysteriously stopped working one day for iOS. There’s no way to troubleshoot. A bunch of forum posters reported the same issue after an update, but no solution for a few months.

As in tailscale stopped working or headscale?

Re: Identity management for WireGuard

#34

Post by bradfitz »

Spooky23 wrote: post #22
snoopy_telex wrote: post #6

I'm currently running Tailscale at home, but will switch to Headscale once they get iOS support sorted out. It's magical. It's well on the way towards being a critical piece of infrastructure in my mind.

I felt the same way until Tailscale mysteriously stopped working one day for iOS. There’s no way to troubleshoot. A bunch of forum posters reported the same issue after an update, but no solution for a few months.

(Tailscale engineer here)

What's the bug? I hadn't heard about this.

Metrics show no drop in iOS control plane connections.

Re: Identity management for WireGuard

#35

Post by LinuxBender »

jetbalsa wrote: post #32
LinuxBender wrote: post #29

I only do self-hosted options so it might be a while before I really tinker with Wireguard. I've looked into setting it up but it does not meet my needs today for dynamic mesh routing and requires much of the system configuration of OpenVPN or Strongswan albeit simpler configuration but the same concepts still apply. My preferred ideal dream setup would be if the Tinc open source VPN had integration with OpenLDAP for…

Sounds like you are looking for a self hosted ZeroTier or Tailscale.

It does not appear that Tailscale is an identity provider but rather integrates into commercial ID providers? Do they integrate into OpenLDAP or into OAuth/SAML providers that are in front of OpenLDAP?

[Edit] Answering my own question. Custom SAML providers are only supported with the Enterprise edition. [1]

[1] - https://tailscale.com/kb/1119/sso-saml-oidc/

Re: Identity management for WireGuard

#36

Post by mbreese »

LinuxBender wrote: post #29

I only do self-hosted options so it might be a while before I really tinker with Wireguard. I've looked into setting it up but it does not meet my needs today for dynamic mesh routing and requires much of the system configuration of OpenVPN or Strongswan albeit simpler configuration but the same concepts still apply. My preferred ideal dream setup would be if the Tinc open source VPN had integration with OpenLDAP for…

If you don’t need identity controls (using a fixed node configuration), you can always use vanilla Wireguard without the user management. You don’t get a NAT traversing mesh, but if your nodes are visible to the net, you do get direct node to node networking. If you only have one node directly visible, you can also use that as a gateway.

I like these more traditional VPN style use tools for Wireguard, but you can always use the lower level version itself, if you’re comfortable with the configuration limitations.

Re: Identity management for WireGuard

#37

Post by LinuxBender »

mbreese wrote: post #36
LinuxBender wrote: post #29

I only do self-hosted options so it might be a while before I really tinker with Wireguard. I've looked into setting it up but it does not meet my needs today for dynamic mesh routing and requires much of the system configuration of OpenVPN or Strongswan albeit simpler configuration but the same concepts still apply. My preferred ideal dream setup would be if the Tinc open source VPN had integration with OpenLDAP for…

If you don’t need identity controls (using a fixed node configuration), you can always use vanilla Wireguard without the user management. You don’t get a NAT traversing mesh, but if your nodes are visible to the net, you do get direct node to node networking. If you only have one node directly visible, you can also use that as a gateway. I like these more traditional VPN style use tools for Wireguard, but you can alw…

vanilla Wireguard without the user management

That is how I use Tinc today. I briefly tried Wireguard but it works very much like OpenVPN and Strongswan in that it does not have dynamic mesh routing. Privacy advantages aside, the dynamic mesh routing I get from Tinc works around internet outages, albeit slower than I would like but a 2 minute routing outage is still better than {n} time it takes for ISP's to manually work around fiber breaks and datacenter network changes gone-wrong. But that is just my preference, it certainly isn't for everyone. I could probably accomplish this in Wireguard using weighted routing table rules but that gets complicated and messy very fast and I just lazy enough to avoid this. Perhaps someone has created an Ansible playbook that calculates all the routing rules and weights for this setup but I have not actually looked for it.

That said I can layer things on top of Wireguard, OpenVPN and Strongswan that accomplish similar goals such as using HAproxy but then protocol support is limited whereas a dynamic mesh in Tinc allows all TCP/UDP for my needs.

Re: Identity management for WireGuard

#38

Post by throwaway294566 »

cpach wrote: post #30
throwaway294566 wrote: post #25

Earlier quoted context omitted.

While not totally awesome, OpenVPN is miles beyond Wireguard when it comes to credential management. There are several auth plugins, you can use "the usual stuff" like PAM, and through that LDAP/Kerberos, ActiveDirectory, RADIUS, etc.. For higher security demands, client certificates are also possible and standardized X.509, PKCS#11/15 like CaC, Yubikeys and usual employee ID cards work. Also, OpenVPN supports at lea…

“Wireguard is a nightmare for any attempt at sane system administration.” It’s quite simple really: WireGuard is a building block. TFA mentions several systems built on top of WireGuard, that enables sophisticated handling of users/roles, authentication, ACLs, etc.

The problem with the building block approach is that it usually compromises any supposed security advantages Wireguard may have. You get a supersecure bank safe where the key is handed to you in the baker's shop opposite if you ask nicely.

Re: Identity management for WireGuard

#39

Post by jacob019 »

generalizations wrote: post #31
tssva wrote: post #4

When Wireguard was 1st rolled out the smaller code base vs OpenVPN was touted as a feature. Now that 3rd party systems are available to bring feature parity with OpenVPN, it would be interesting to see a comparison of the size of the code base inclusive of these 3rd party systems. Not interesting enough for me to put forth the effort to do it but still interesting.

The feature parity I'm waiting for is L2 VPNs. Wireguard is strictly L3-only, and so far all I've seen are some custom hacks to tunnel L2 ethernet frames over wg.

Wireguard is L3 encryption. It's great because it's simple. Linus called it poetry. If you are bridging L2 over the Internet, then one way or another you're stuffing Ethernet frames into IP packets. Linux has built in L2 tunneling, sans encryption. I wouldn't call it a custom hack to open an L2 tunnel over wireguard. It's a one liner on each end. A configuration utility like wg-quick could be made to set it up for you. I wouldn't want wireguard to become OpenVPN.

Re: Identity management for WireGuard

#40

Post by bongobingo1 »

candiddevmike wrote: post #17
matthewaveryusa wrote: post #13

Earlier quoted context omitted.

I think that goes against the tenant of wireguard working well while roaming. In general the concept of an identifying ip (outside of wireguard) will only lead to problems: devices can have multiple ips, and also share ips in the case of NAT/CGNAT. In my experience it's never been worth the trouble (again excluding wireguard)

Your EC2 instance probably shouldn't be roaming to Russia though, right?

You already have to open your fw for wg traffic, doesn't seem too obnoxious to just allow/drop there.
Post reply on HN