Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard 1.0 for Linux 5.6

lists.zx2c4.com

Post reply on HN
Print view View original

41–50 of 214 posts

Re: WireGuard 1.0 for Linux 5.6

#41

Post by api »

middleclick wrote: post #29
myu701 wrote: post #11

Earlier quoted context omitted.

Someone else can give a much better comparison than me, this is just to get you started. Compared to the 80% use case of OpenVPN, Wireguard is: 1. Much less code. A few thousand lines of code vs lots more for OpenVPN 2. Speedier. WG does UDP traffic so there is less overhead on the protocol level for syncs acks etc. 3. Easier on mobile battery life due to decreased complexity For one example use case comparing them s…

On that note, I wish and hope Wireguard did TCP as well. Some countries block UDP traffic or at least throttle it.

ISPs or countries?

Re: WireGuard 1.0 for Linux 5.6

#42

Post by kertis »

tw04 wrote: post #20
kertis wrote: post #12

Earlier quoted context omitted.

Among other features WireGuard has roaming mode, it's fantastic for mobile devices. Just try it, it's easy and quick!

In my experience the problem with roaming mode is it blocks the login page for wireless networks. IE: in a coffee shop. Maybe that's been fixed recently, but it was a giant PITA in the past.

I suppose because of DNS servers. Shops give you own "correct" dns for showing you adds on any first request.

Re: WireGuard 1.0 for Linux 5.6

#43

Post by darkwater »

exabrial wrote: post #39
eadmund wrote: post #26

Earlier quoted context omitted.

I think the idea is that you're supposed to build a system to manage WireGuard using that sort of information. I.e. WireGuard provides the basic primitives and second- or third-party tooling uses them. I like that idea, because it means that the actual WireGuard core is small and it's usable right now. It is annoying that someone hasn't yet developed neat integrations for WireGuard and stuff I might want to use, but…

Yep, that's what I'm asking for... right now wireguard can only look at configuration text files AFAIK. If it had a way to invoke a command/script to lookup a key/ip, any number of external management systems could be created!

You can already easily do the other way round: populate the config files with keys retrieved in an external system

Re: WireGuard 1.0 for Linux 5.6

#44

Post by MartijnBraam »

exabrial wrote: post #39
eadmund wrote: post #26

Earlier quoted context omitted.

I think the idea is that you're supposed to build a system to manage WireGuard using that sort of information. I.e. WireGuard provides the basic primitives and second- or third-party tooling uses them. I like that idea, because it means that the actual WireGuard core is small and it's usable right now. It is annoying that someone hasn't yet developed neat integrations for WireGuard and stuff I might want to use, but…

Yep, that's what I'm asking for... right now wireguard can only look at configuration text files AFAIK. If it had a way to invoke a command/script to lookup a key/ip, any number of external management systems could be created!

actually wireguard doesn't look at text files at all, it only has a netlink interface so you can configure it using the `ip` command. The current tools read the text files and set up the network interface.

Re: WireGuard 1.0 for Linux 5.6

#45

Post by kertis »

K0SM0S wrote: post #33
kertis wrote: post #13

Earlier quoted context omitted.

> little more setup A lot more! PKI infrastructure, chiphersuites and so on and so forth... By the way OpenVPN also can work with UDP, even it's default mode.

It's a lot more if you do it all manually, however for most "common" use cases, one should probably go with automatically generated config files. For instance pfSense provides you with single-click configs for any target platform, with certs, credentials etc. properly tied to some ACL or ID management system, etc. It's neat and pain-free and just works. You could learn all the theory underneath (I mean systems, IT, n…

First setup always needs to be manual.

Re: WireGuard 1.0 for Linux 5.6

#46

Post by kertis »

middleclick wrote: post #29
myu701 wrote: post #11

Earlier quoted context omitted.

Someone else can give a much better comparison than me, this is just to get you started. Compared to the 80% use case of OpenVPN, Wireguard is: 1. Much less code. A few thousand lines of code vs lots more for OpenVPN 2. Speedier. WG does UDP traffic so there is less overhead on the protocol level for syncs acks etc. 3. Easier on mobile battery life due to decreased complexity For one example use case comparing them s…

On that note, I wish and hope Wireguard did TCP as well. Some countries block UDP traffic or at least throttle it.

As I know WireGuard team have no plans and desire for that.

Re: WireGuard 1.0 for Linux 5.6

#47

Post by chrisweekly »

tw04 wrote: post #21
rubenbe wrote: post #19

Earlier quoted context omitted.

Does the VPS have unencrypted access to the VPN? It's something I would want to avoid. (A VPS is a prime candidate to be compromised)

If you're subject to state level actors attacking you, a VPS is probably the least of your worries. If you're just trying to make sure some kiddiot in a coffee shop isn't doing mass collections, a VPS is perfectly secure.

+1 for good points.

Also, ty for "kiddiot" (much better than "script kiddie" term)

Re: WireGuard 1.0 for Linux 5.6

#48

Post by igetspam »

darkwater wrote: post #43
exabrial wrote: post #39

Earlier quoted context omitted.

Yep, that's what I'm asking for... right now wireguard can only look at configuration text files AFAIK. If it had a way to invoke a command/script to lookup a key/ip, any number of external management systems could be created!

You can already easily do the other way round: populate the config files with keys retrieved in an external system

This is what I do. I have a small dynamo table and a Python script I run from cron. I grab all updates since the last run and apply all changes to the running service. I have the config option set to write out the config on service stop, so I don't lose anything on a restart and don't have to replay everything. I have lots of room for improvement but it's a quick hack that works for my needs. (Not sharing yet because it doesn't fully CRUD right now.)

Re: WireGuard 1.0 for Linux 5.6

#49

Post by fulafel »

rubenbe wrote: post #19
newscracker wrote: post #14

For anyone wanting to try it, WireGuard with Algo VPN [1] to set it up on a server is a great combination. I found it quite easy to setup and use. Algo has built-in support for various cloud providers, where, when you run it from, day, your desktop, it can setup the VPN server for you based on answers to some questions (with sensible defaults) and some information on connecting to the provider (like an API key, for e…

Does the VPS have unencrypted access to the VPN? It's something I would want to avoid. (A VPS is a prime candidate to be compromised)

Yes.

Re: WireGuard 1.0 for Linux 5.6

#50

Post by AnIdiotOnTheNet »

myu701 wrote: post #11
xal wrote: post #5

Given the occasion, could someone write a paragraph about what downstream effects are expected by wireguard existing? So far I’ve seen mostly technical arguments for it. VPNs have become a more important piece of infrastructure now. The most significant approachability increase really came from mobile based solutions and auto pilot systems like Google’s Outline. Will WG make a marked difference in stability, speed, a…

Someone else can give a much better comparison than me, this is just to get you started. Compared to the 80% use case of OpenVPN, Wireguard is: 1. Much less code. A few thousand lines of code vs lots more for OpenVPN 2. Speedier. WG does UDP traffic so there is less overhead on the protocol level for syncs acks etc. 3. Easier on mobile battery life due to decreased complexity For one example use case comparing them s…

Wiregard may be speedier (I've never used it so I can't say for certain), but OpenVPN can also use UDP.
Post reply on HN