Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is submitted for Linux kernel inclusion

marc.info

Post reply on HN
Print view View original

61–70 of 189 posts

Re: WireGuard is submitted for Linux kernel inclusion

#61

Post by cm2187 »

phaer wrote: post #21
simias wrote: post #18

Earlier quoted context omitted.

Can you explain what makes it better than venerable old OpenVPN?

Mostly speed, a more minimal configuration syntax, more modern crypto. OpenVPN works fine, is quite portable and runs in user space. It's quite a lot slower, but is well-tested and can be managed with a Certificate Authority in organisation where that's desired.

I presume speed on linux? Otherwise doesn't wireguard suffer from the same peformance drawback than OpenVPN on windows (running in user mode)?

Re: WireGuard is submitted for Linux kernel inclusion

#62

Post by moviuro »

arctux wrote: post #53

I've been using Wireguard on both my laptop and my Android phone for about two months. I've been using the wg-quick systemd units, and everything has worked amazingly well. The only downside I've notice is slightly increased battery consumption on my phone, but that's to be expected (it uses approximately 5% of the battery per day). I use dnsmasq to resolve DNS queries on the server side. Dnsmasq's configuration file…

> it uses approximately 5% of the battery per day

OpenVPN uses about 20% of mine, so I guess it really is a step forward.

Also, for your DNS lying file, you might be interested in: https://gitlab.com/moviuro/moviuro.bin/blob/master/lie-to-me (which sources multiple domain lists)

Re: WireGuard is submitted for Linux kernel inclusion

#63

Post by moviuro »

zaarn wrote: post #51

I can't wait until pfSense supports it. That'll be the moment I'll set the OpenVPN config on fire, because honestly, OpenVPN configs are magic and if it's not generated by some UI wizard, it's probably broken in some scenario. And even if you do the wizard, it's probably broken. Atm I have that funny bug where my laptop drops connection after 3 seconds but my desktop does fine. With the same configuration! Thank OVPN…

> Thank OVPN for that annoyance!

Certainly, you reported that issue through proper channels, and attached detailled information regarding your hardware, software, as well as packet logs?

Re: WireGuard is submitted for Linux kernel inclusion

#64

Post by brg1007 »

arctux wrote: post #53

I've been using Wireguard on both my laptop and my Android phone for about two months. I've been using the wg-quick systemd units, and everything has worked amazingly well. The only downside I've notice is slightly increased battery consumption on my phone, but that's to be expected (it uses approximately 5% of the battery per day). I use dnsmasq to resolve DNS queries on the server side. Dnsmasq's configuration file…

You can install pretty easy the F-Droid repository / store and download DNS66 from there. ( FOSS Ad-Blocking via DNS ).

Re: WireGuard is submitted for Linux kernel inclusion

#65

Post by [deleted] »

cm2187 wrote: post #61
phaer wrote: post #21

Earlier quoted context omitted.

Mostly speed, a more minimal configuration syntax, more modern crypto. OpenVPN works fine, is quite portable and runs in user space. It's quite a lot slower, but is well-tested and can be managed with a Certificate Authority in organisation where that's desired.

I presume speed on linux? Otherwise doesn't wireguard suffer from the same peformance drawback than OpenVPN on windows (running in user mode)?

[deleted]

Re: WireGuard is submitted for Linux kernel inclusion

#66

Post by emddudley »

paulrd wrote: post #42

How would this compare to ZeroTier? (zerotier.com)

It seems that someone asks about ZeroTier on every thread about WireGuard. According to tptacek:

https://news.ycombinator.com/item?id=13601928

ZeroTier is cryptographically inferior to Wireguard, but also isn't really a VPN: it has centralized configuration and rendezvous. If you're running VPNs to get the US Netflix from your UK vacation, this is probably fine. If your VPN is how remote employees access your prod network, it is way less fine.

I think it's a bit unfair to judge ZeroTier in comparison to VPNs, because that's not strictly speaking what it's trying to be. I like overlay networks!

And here's some info from the ZeroTier developer:

https://news.ycombinator.com/item?id=11996687

You can think of ZeroTier as a virtual smart switch built on a P2P network

...

WireGuard does have some things in common with ZeroTier, such as the use of cryptography to identify endpoints and eliminate the hard-coding of endpoint addresses. ... I really like the WireGuard design in general and I think it has a somewhat different use case from ZeroTier, namely fast long-lived provisioned links across WANs and insecure LANs. You could use ZT for that but this being in-kernel makes it likely faster.

Re: WireGuard is submitted for Linux kernel inclusion

#67

Post by storrgie »

Osiris wrote: post #10

I have a VPS I use for VPN, which means, unfortunately, no custom kernels or kernel modules. So, I'm stuck with OpenVPN. It would be awesome to have WireGuard included in the kernel by default.

find a VPS provider that supports using KVM properly as a hypervisor. Vultr is a good one to look at first.

Re: WireGuard is submitted for Linux kernel inclusion

#68

Post by sigmar »

arctux wrote: post #53

I've been using Wireguard on both my laptop and my Android phone for about two months. I've been using the wg-quick systemd units, and everything has worked amazingly well. The only downside I've notice is slightly increased battery consumption on my phone, but that's to be expected (it uses approximately 5% of the battery per day). I use dnsmasq to resolve DNS queries on the server side. Dnsmasq's configuration file…

>slightly increased battery consumption on my phone, but that's to be expected (it uses approximately 5% of the battery per day).

Are you using the user-space implementation or the kernel module? I'm curious as to the difference in battery consumption.

Re: WireGuard is submitted for Linux kernel inclusion

#69

Post by swsieber »

So, since lots of people here have experience with VPN, I'd like to ask theoretical project question:

I have distant family memebers, and it'd be nice to have a simple way to get devices on the same network easily.

My initial thought would be to setup a VPN server somewhere central and fast, and then distribute wireless routers with custom firmware that they could plugin to their network. Then anything they connect to that router would be connected to the VPN (because the router is pre-setup to connect to the VPN).

Is that doable? Is it a good idea? I know just enough about networking to be dangerous...

Re: WireGuard is submitted for Linux kernel inclusion

#70

Post by Foxboron »

StavrosK wrote: post #11

I started using Wireguard two days ago to access my home LAN and love it, I can access everything with one command, as if I'm home. The only problem I have with it is the complete lack of documentation. The tutorial refers to a configuration file, but nowhere on the site does it tell you how to write one. It also took me days to set up what I think is a common use case, logging in to a server/router at home and acces…

I assume this is what you want? https://wiki.archlinux.org/index.php/WireGuard#Setup_a_VPN_s...
Post reply on HN