Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wireguard-docs: Setup, usage, configuration, and a full example

github.com

Post reply on HN
Print view View original

41–50 of 96 posts

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#41

Post by moviuro »

alias_neo wrote: post #35
moviuro wrote: post #29

It's seriously weird that `Address=10.0.1.2/32` works at all. An Address should have a correct subnet mask (like your IP at home might be 192.168.1.25/24, not 192.168.1.25/32). The documentation is complete, but I think the most important topic is `AllowedIPs`. The rest is pretty standard and unsurprising (if you have any networking knowledge at all). I had written a bit about AllowedIPs when I switched to WG myself:…

You're aware that /32 is the correct way of specifying one, single IPv4 address using this notation? There is nothing weird about it at all. If you've used IPv6 you'll see the equivalent /128 for a single address.

Try setting 192.168.1.25/32 on your eth0 interface, you're in for a bad time.

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#42

Post by garblegarble »

davidcollantes wrote: post #16
sowbug wrote: post #4

Author, if you're reading this: thank you. This weekend I wrote a simple tool to manage a client/server-style Wireguard setup. It's a little less tedious than copying and pasting "wg genkey" and "wg pubkey" output as you're setting up new clients. It's not quite easy enough for someone to use without prior Wireguard setup knowledge, but if you've gotten your first client-server pair running, then you'll recognize whe…

Where is the tool you build?

I'm not the person you're replying to, but I think this is what they were referring to from their github: https://github.com/sowbug/mkwgconf

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#43

Post by rswail »

nprateem wrote: post #28
moreentropy wrote: post #24

Earlier quoted context omitted.

You don't seem to have spent a single minute researching before posting :/ The original implementation is a kernel module. You can find a bunch of (excellent) talks online by wireguard's author which all have a focus on security aspects and avoiding vulnerabilities. Besides, Go and Rust (3rd pty) implementations exist.

> You don't seem to have spent a single minute researching before posting Correct. This is a discussion site after all. > The original implementation is a kernel module How does that make it safer if it's written in C? Of course no one likes to think they're writing vulnerable code...

If you want a module to be accepted in to the Linux kernel upstream, then you have to comply with the kernel's rules.

The kernel uses various C macros and GCC extensions. Ensuring that a module written in another language was compatible, even given that it would need to be built outside the normal tree would make its maintenance within the kernel tree impossible.

In terms of being written in C++/Rust/whatever, as an external module that complies with the kernel ABI (not guaranteed between kernel releases), go for it.

But if you want to have your protocol/module in the standard kernel tree, C is your choice.

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#45

Post by [deleted] »

alels wrote: post #36

I looked a bit into Wireguard. But it seems it's only really useful with static IPs. Say my "Server" is behind a DDns Hostname and i want to connect to it from my Phone. So my problem is. I allow incoming from 0.0.0.0 but on my mobile the DDns Hostname gets compiled to a specific IP. OpenVpn has no problem with this setup. Is it solvable with Wireguard? wg-dynamic seems to tackle this but wasn't really ready last tim…

[deleted]

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#46

Post by StavrosK »

syedamer wrote: post #33

Beware all examples in this don't cover ipv6. Should you have an ipv6 address, you are not using the vpn for most of your connections. Sadly most Wireguard howtos don't cover ipv6.

If you give me some sample config I can add it to my howto here: https://www.stavros.io/posts/how-to-configure-wireguard/

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#47

Post by alias_neo »

moviuro wrote: post #41
alias_neo wrote: post #35

Earlier quoted context omitted.

You're aware that /32 is the correct way of specifying one, single IPv4 address using this notation? There is nothing weird about it at all. If you've used IPv6 you'll see the equivalent /128 for a single address.

Try setting 192.168.1.25/32 on your eth0 interface, you're in for a bad time.

You're correct, but you're confusing the notation and the implementation.

On your (eth0) network interface you're specifying a network that your interface belongs to, its used to determine routing on that interface, if you give it a single /32, there is no "network" for it to route to.

WireGuard isn't using the CIDR notation in the address value for routing, it's using allowed-ips.

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#48

Post by anilakar »

Wireguard is a great solution for a secure, high-performance data pipe. However, it only supports layer 3 static routing by itself, which by itself fits none of my typical use cases.

If you're willing to think of it as a secure control plane where the cryptographic identities of peers are mapped to IP addresses, you can run other tried-and-tested but insecure tunnels over it.

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#49

Post by oedmarap »

For anyone wanting to get WireGuard up and running in a few minutes with zero hassle, I usually use this excellent bash script [0] as my goto.

Can be edited for DNS/subnet config, generates .conf files as needed and also handles QR code generation for adding mobile devices. Pair this with a $5 DO droplet and you're all set.

[0] https://github.com/its0x08/wg-install

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#50

Post by learntofly »

jchook wrote: post #5

Gotta say, if you just want a VPN to work now, definitely check out Algo or Streisand. You can get a VPN running in an hour or less. Algo even supports wireguard. I currently have two VPNs — Algo Wireguard & iVPN. Anecdotally the wireguard VPN rocks— crazy fast in every way, including connection/disconnection. Sometimes YouTube is slow.. I just hop on WG and it’s fast again. I’ve achieved faster downloads via WG than…

I flagged the slow YouTube issues to iVPN (openvpn) previously but got palmed off by support, otherwise they offer an excellent service.
Post reply on HN