Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wireguard-docs: Setup, usage, configuration, and a full example

github.com

Post reply on HN
Print view View original

51–60 of 96 posts

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#51

Post by oarsinsync »

jchook wrote: post #5

Gotta say, if you just want a VPN to work now, definitely check out Algo or Streisand. You can get a VPN running in an hour or less. Algo even supports wireguard. I currently have two VPNs — Algo Wireguard & iVPN. Anecdotally the wireguard VPN rocks— crazy fast in every way, including connection/disconnection. Sometimes YouTube is slow.. I just hop on WG and it’s fast again. I’ve achieved faster downloads via WG than…

> 1. If you use a VPS to host your own VPN.. you don’t gain privacy. Usually your IP can (mostly) still identify you. And your VPS company will hold you accountable for your traffic eg DMCA.

Unfortunately, the same can be said for your VPN provider, depending on the provider. They can (and more than one does) save your name, address, billing details, as well as your source IP, and which IP and source ports you appear as after VPN translation has occurred.

Even if they don't do this, traffic analysis by the underlying network provider can de-anonymise your VPN'd traffic from your original source traffic too, and it doesn't take a genius to do this either.

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#53

Post by Hello71 »

zx2c4 wrote: post #37
3xblah wrote: post #31

Earlier quoted context omitted.

"2. OpenVPN never borks my resolv.conf but Wireguard often leaves my DNS resolution in a state of confusion." Checking the source... excerpt from src/tools/wg-quick/openbsd.bash: set_dns() { [[ ${#DNS[@]} -gt 0 ]] || return 0 # TODO: this is a horrible way of doing it. Has OpenBSD no resolvconf? cmd cp /etc/resolv.conf "/etc/resolv.conf.wg-quick-backup.$INTERFACE" cmd printf 'nameserver %s\n' "${DNS[@]}" > /etc/resol…

We're doing something better on other platforms. But for OpenBSD I'm not entirely sure the best way. Suggestions welcome.

did you check what openvpn does? I would assume they have something at a local maximum.

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#54

Post by cesarb »

rswail wrote: post #43
nprateem wrote: post #28

Earlier quoted context omitted.

> You don't seem to have spent a single minute researching before posting Correct. This is a discussion site after all. > The original implementation is a kernel module How does that make it safer if it's written in C? Of course no one likes to think they're writing vulnerable code...

If you want a module to be accepted in to the Linux kernel upstream, then you have to comply with the kernel's rules. The kernel uses various C macros and GCC extensions. Ensuring that a module written in another language was compatible, even given that it would need to be built outside the normal tree would make its maintenance within the kernel tree impossible. In terms of being written in C++/Rust/whatever, as an…

> the kernel ABI (not guaranteed between kernel releases)

Even within a single release, the kernel ABI varies depending on several kernel configuration options (for instance, CONFIG_SMP).

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#55

Post by genghizkhan »

mahkoh wrote: post #26
genghizkhan wrote: post #14

I wish there was good documentation/a tutorial which shows one how to use systemd-networkd and nftables to manage wireguard interfaces. The Arch Wiki has some documentation[0], but I've never been able to get it past the initial handshake (which always succeeds) and no one on the IRC channel was able to help me out. I don't want to ask for hand-holding, but some more comprehensive and accessible documentation might h…

If you want to enable forwarding then set the sysctl [0] and masquerade [1]. nftables also has a `log` rule which might be useful for debugging. If you can't even connect to services on the peer then first delete all iptables and nftables rules and try again. [0] https://wiki.archlinux.org/index.php/WireGuard#Server [1] https://wiki.archlinux.org/index.php/Nftables#Masquerading

Thank you, kind stranger! I know what tomorrow's project is going to be!

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#56

Post by puzzlingcaptcha »

>IPSec (IKEv2)/strongSwan: lots of brittle config that's different for each OS, NAT busting setup is very manual and involves updating the central server and starting all the others in the correct order, not great at reconnecting after network downtime, had to be manually restarted often

I don't follow, NAT traversal is integral to IKEv2 and pretty much "just works" [1]. Reconnecting after network downtime is not an issue either, with either on demand connection setup (auto=add) or pretty standard ifupdown scripts/networkmanager. I don't believe I had to restart my strongswan daemons in the past few months either...

I also disagree that config is 'brittle'. Quite to the contrary, I think strongswan with its exhaustive documentation and a complete test suite which provides configuration for every host in every scenario in the test suite is a great accomplishment and an incredibly useful resource [example: 2].

I think wireguard has a great niche to fill as OpenVPN replacement (which has a lot of issues) but some of its supposed benefits over ipsec are a bit overblown and a confluence of 'I couldn't be bothered to read the manual', failure to understand a difference between host-based and policy-based routing [3] and a pinch of hype-driven development.

[1] https://wiki.strongswan.org/projects/strongswan/wiki/NatTrav...

[2] https://www.strongswan.org/testing/testresults/ikev2/rw-cert...

[3] https://wiki.strongswan.org/projects/strongswan/wiki/Introdu...

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#57

Post by apexalpha »

Use this as a permanent VPN on my phone to my home. It only forwards requests in the 192.168.1.0/24 range and that includes all DNS requests that go to my pihole. All regular traffic is unaffected as my upload at home is slower than my 4G download speed and I don't want to limit it.

Can recommend this setup to everyone, especially on devices with spotty connections like a phone.

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#58

Post by zymhan »

puzzlingcaptcha wrote: post #56

>IPSec (IKEv2)/strongSwan: lots of brittle config that's different for each OS, NAT busting setup is very manual and involves updating the central server and starting all the others in the correct order, not great at reconnecting after network downtime, had to be manually restarted often I don't follow, NAT traversal is integral to IKEv2 and pretty much "just works" [1]. Reconnecting after network downtime is not an…

> OpenVPN replacement (which has a lot of issues)

Care to elaborate?

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#59

Post by tgragnato »

StavrosK wrote: post #46
syedamer wrote: post #33

Beware all examples in this don't cover ipv6. Should you have an ipv6 address, you are not using the vpn for most of your connections. Sadly most Wireguard howtos don't cover ipv6.

If you give me some sample config I can add it to my howto here: https://www.stavros.io/posts/how-to-configure-wireguard/

I based my configuration on yours. You just need to add another 'Address = ' (client and server), and add ip6tables.

The address is going to be static: I'm not aware of a way to simulate privacy extensions with Wireguard. A workaround is to assign ULAs and apply NAT.

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#60

Post by anilakar »

zymhan wrote: post #58
puzzlingcaptcha wrote: post #56

>IPSec (IKEv2)/strongSwan: lots of brittle config that's different for each OS, NAT busting setup is very manual and involves updating the central server and starting all the others in the correct order, not great at reconnecting after network downtime, had to be manually restarted often I don't follow, NAT traversal is integral to IKEv2 and pretty much "just works" [1]. Reconnecting after network downtime is not an…

> OpenVPN replacement (which has a lot of issues) Care to elaborate?

This. I'm using OpenVPN for ethernet bridging, which Wireguard cannot do.
Post reply on HN