Pedantic: Linus’s
Lini?
The whole Linopod order.
WireGuard is now in Linus' tree
41–50 of 293 posts
Re: WireGuard is now in Linus' tree
#42Super cool. WG is a such a great tunnel tool. They've told me not to use in production but I've been ignoring that advice for months. My first test was using in as a replacement everywhere I still has stunnel. Then right after it was proved I started using this hammer for everything.
AND! This part is critical: all of my interactions with the team and the community around it have been positive.
Brilliant!
Re: WireGuard is now in Linus' tree
#43Earlier quoted context omitted.
Your home has publicly accessible^1 IP address Or you are using a third party-controlled server with direct internet access to make home IP accessible 1. No ISP firewall blocking unsolicited incoming traffic Do you configure WG to use persistent keepalives
In the US for home connections (cable, fiber, DSL) everybody gets an accessible IP address pretty much -- the worst is that some ports are blocked like port 80 or 25. Phones don't get a dedicated IPv4.
For most people it's dynamic. Mine is dynamic with the PPPoE fibre session.
Re: WireGuard is now in Linus' tree
#44Earlier quoted context omitted.
I don’t know what PPS is, but that is an inaccurate sentiment. Running as a kernel module allows you to achieve higher throughout and lower latency.
PPS means Packets Per Second. Here’s a press release from the FD.io project (“Fido”), take it as you will: https://fd.io/latest/singles/kubernetes/
FD.io uses the VPP stack under the hood, which ultimately uses DPDK[1] for the actual IO acceleration.
The reason it's faster is because it's polling your hardware. You spend a lot of cpu time to buy the lower latency.
Re: WireGuard is now in Linus' tree
#45Earlier quoted context omitted.
So like IPSec? e: I mean that doesn’t suck
A major difference, besides WireGuard's simplicity, is that IPSec is a layer 4 protocol (ESP packets instead of TCP/UDP packets) whereas WireGuard is a layer 5 protocol (runs over UDP), so switches don't choke on it, and so a WireGuard peer doesn't need a public-routable IP address, but can be behind NAT.
IPSec works fine with UDP and NAT.
Re: WireGuard is now in Linus' tree
#46Wrote a little post some time ago on how to set it up on linux and use it on android. Super simple. https://blog.oxplot.com/wireguard-vpn-on-android/
Nice! Any idea what the minimum system requirements are? I'm wondering how cheaply I could run this.
Basically nothing for wireguard itself. I've run it on some seriously underpowered hardware and it seems to have basically no performance impact to speak of. I probably have it set up on around 30 machines presently and have used it in production environments.
Re: WireGuard is now in Linus' tree
#47Wrote a little post some time ago on how to set it up on linux and use it on android. Super simple. https://blog.oxplot.com/wireguard-vpn-on-android/
Nice! Any idea what the minimum system requirements are? I'm wondering how cheaply I could run this.
This thing should run fine just about anywhere, down to RPi Zero
Re: WireGuard is now in Linus' tree
#48Earlier quoted context omitted.
I have a public IP.
A previous thread about WG had some discussion about obtaining a publicly reachable^1 IP address. No doubt many readers are interested Can you tell us anything about how you obtained one 1. No ISP firewall blocking unsolicited incoming traffic
[deleted]
Re: WireGuard is now in Linus' tree
#49I’m using WireGuard daily on Linux and iPhone. It’s hard to describe how much better of an experience this is than OpenVPN. Connections are reliable and durable, latency is pretty low, and you can actually understand the software.
Re: WireGuard is now in Linus' tree
#50Earlier quoted context omitted.
A previous thread about WG had some discussion about obtaining a publicly reachable^1 IP address. No doubt many readers are interested Can you tell us anything about how you obtained one 1. No ISP firewall blocking unsolicited incoming traffic
I think it's pretty common in the US with the various providers. You get a public IP. I didn't do anything special for that.
[deleted]