Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard: Beyond the most basic configuration

sloonz.github.io

Post reply on HN
Print view View original

41–50 of 115 posts

Re: WireGuard: Beyond the most basic configuration

#41

Post by kccqzy »

nikisweeting wrote: post #35
qeternity wrote: post #11

No affiliation with them but Tailscale is awesome.

Their article on how NAT traversal works is an epic piece of work in its own right too: https://tailscale.com/blog/how-nat-traversal-works

I do not think the Tailscale software implements everything described in that article. For example, the article says

> Now speak STUN through the NAT64 to discover your public ip:port on the NAT64, and you’re back to the classic NAT traversal problem — albeit with a bit more work.

I don't think the Tailscale software does this step. You can find several GitHub issues about this, such as https://github.com/tailscale/tailscale/issues/11438 or https://github.com/tailscale/tailscale/issues/11437

Re: WireGuard: Beyond the most basic configuration

#42

Post by kccqzy »

denkmoon wrote: post #38
kccqzy wrote: post #36

Earlier quoted context omitted.

Why would you need a dynamic DNS record though? Within the VPN you should feel free to hard code any address you want. You control the network after all. In my own VPN I've never had a need to have IP addresses changed.

Dynamic IP. Hard coding an address is exactly what we want to avoid.

Let's go one level deeper. Why do you need dynamic IP in your own private network?

Re: WireGuard: Beyond the most basic configuration

#43

Post by gonzo »

icelancer wrote: post #37

No RBAC is sad, though understandable. Wireguard is so much faster than OpenVPN. We use Wireguard for S2S but unfortunately need OpenVPN for our employees and contractors due to RBAC. All posts and writeups we've found trying to shoehorn RBAC into Wireguard ultimately ends up with people saying "don't do this."

Kernel wirguard may be (and often is) faster than OpenVPN without DCO, but OpenVPN with DCO is oftent substantially faster than kernel WireGuard.

DCO is available for Linux, FreeBSD and Windows.

Re: WireGuard: Beyond the most basic configuration

#44

Post by jwiz »

kccqzy wrote: post #42
denkmoon wrote: post #38

Earlier quoted context omitted.

Dynamic IP. Hard coding an address is exactly what we want to avoid.

Let's go one level deeper. Why do you need dynamic IP in your own private network?

There is a dynamic IP on the external address, from their ISP.

Re: WireGuard: Beyond the most basic configuration

#45

Post by bsder »

sevg wrote: post #6

I've always been slightly puzzled about why there isn't an easy built-in way to tunnel all traffic (ie, AllowedIPs = 0.0.0.0/0, ::/0) EXCEPT for some specific IPs. You end up having to programmatically generate a massive list of CIDRs that include everything except those specific IPs.

Or the reverse, most people have specific IPs that they'd like to route traffic through the VPN but mostly don't care about the rest.

Again, you wind up creating a huge list of exact IPs and creating the routing rules is a PITA.

Re: WireGuard: Beyond the most basic configuration

#46

Post by NhanH »

jwiz wrote: post #44
kccqzy wrote: post #42

Earlier quoted context omitted.

Let's go one level deeper. Why do you need dynamic IP in your own private network?

There is a dynamic IP on the external address, from their ISP.

Yeah but you don't use the external IP for the purpose of accessing your VPN (not via a DNS record anyway). I am also unclear on the purpose of the dynamic DNS.

Re: WireGuard: Beyond the most basic configuration

#47

Post by rkagerer »

kccqzy wrote: post #42
denkmoon wrote: post #38

Earlier quoted context omitted.

Dynamic IP. Hard coding an address is exactly what we want to avoid.

Let's go one level deeper. Why do you need dynamic IP in your own private network?

To find your private network when you're away and plugged into a public one and the former's IP may have changed. I gather the OP is talking about discovering their public-facing address, not doling out IP's on their internal VPN.

Don't ask next "Why do you need to know your home IP address?"

Re: WireGuard: Beyond the most basic configuration

#48

Post by ww520 »

NhanH wrote: post #46
jwiz wrote: post #44

Earlier quoted context omitted.

There is a dynamic IP on the external address, from their ISP.

Yeah but you don't use the external IP for the purpose of accessing your VPN (not via a DNS record anyway). I am also unclear on the purpose of the dynamic DNS.

How do you connect your VPN with your phone when you travel on the road?

Re: WireGuard: Beyond the most basic configuration

#49

Post by yjftsjthsd-h »

NhanH wrote: post #46
jwiz wrote: post #44

Earlier quoted context omitted.

There is a dynamic IP on the external address, from their ISP.

Yeah but you don't use the external IP for the purpose of accessing your VPN (not via a DNS record anyway). I am also unclear on the purpose of the dynamic DNS.

Your external IP is dynamic because the ISP can rotate it. You want to reach your home's external IP to VPN in. One common way is to create a public DNS record that's dynamically updated (by a cronjob or whatever) to always contain whatever IP your ISP last handed you.

Re: WireGuard: Beyond the most basic configuration

#50

Post by wirewarden »

Nice article, cool ideas.

I rely on IPv6 for my infrastructure: my home network and servers are all publically routable via IPv6.

I use something similar to OP's IPv6 setup to provide my smartphone with IPv6 connectivity too, so smartphone is able to reach my infra.

It's not clear what OP is getting by exposing public servers using Wireguard internally. Why not just assign servers IPv6 addresses at layer 3 and route as normal?

Given the vast majority of my infra has publically routable IPv6, it would be nice if I could keep/use that addressing layer, but benefit from Wireguard (it's modern crypto, and stateless design) without having to adopt the Wireguard addressing layer.

I guess I'm looking for something like Wireguard-without-addressing, or IPsec-transport-mode-but-stateless.

Post reply on HN