Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wireguard-docs: Setup, usage, configuration, and a full example

github.com

Post reply on HN
Print view View original

61–70 of 96 posts

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#61

Post by StavrosK »

tgragnato wrote: post #59
StavrosK wrote: post #46

Earlier quoted context omitted.

If you give me some sample config I can add it to my howto here: https://www.stavros.io/posts/how-to-configure-wireguard/

I based my configuration on yours. You just need to add another 'Address = ' (client and server), and add ip6tables. The address is going to be static: I'm not aware of a way to simulate privacy extensions with Wireguard. A workaround is to assign ULAs and apply NAT.

I see, thank you. Unfortunately I don't have IPv6 on my network and don't know the IPv6 local addresses and ip6tables config, if you could give me the actual config you used I'd appreciate it, especially if it works with both IPv4 and IPv6 together.

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#62

Post by Hikikomori »

moviuro wrote: post #41
alias_neo wrote: post #35

Earlier quoted context omitted.

You're aware that /32 is the correct way of specifying one, single IPv4 address using this notation? There is nothing weird about it at all. If you've used IPv6 you'll see the equivalent /128 for a single address.

Try setting 192.168.1.25/32 on your eth0 interface, you're in for a bad time.

2: eth0: mtu 1500 qdisc pfifo_fast state UP group default qlen 1000

    inet 192.168.101.12/24 brd 192.168.101.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet 192.168.1.25/32 scope global eth0
       valid_lft forever preferred_lft forever
    inet 192.168.1.32/31 scope global eth0
       valid_lft forever preferred_lft forever
Seems to work fine, added a /31 just for fun.

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#63

Post by puzzlingcaptcha »

zymhan wrote: post #58
puzzlingcaptcha wrote: post #56

>IPSec (IKEv2)/strongSwan: lots of brittle config that's different for each OS, NAT busting setup is very manual and involves updating the central server and starting all the others in the correct order, not great at reconnecting after network downtime, had to be manually restarted often I don't follow, NAT traversal is integral to IKEv2 and pretty much "just works" [1]. Reconnecting after network downtime is not an…

> OpenVPN replacement (which has a lot of issues) Care to elaborate?

A few off the top of my head: juggling packets between userspace and kernel resulting in poor performance, tacked-on hacky features (hmac authentication), fragmented and often outdated documentation (the community wiki is a mess), homebrew key generation helper tools with hardcoded openssl versions, no native support on Windows/MacOS, autostart services on Windows are a mess (OpenVPNService, OpenVPNServiceInteractive, OpenVPNServiceLegacy), faffing about with socket buffer sizes on windows to get any sort of throughput and so on...

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#64

Post by tgragnato »

StavrosK wrote: post #61
tgragnato wrote: post #59

Earlier quoted context omitted.

I based my configuration on yours. You just need to add another 'Address = ' (client and server), and add ip6tables. The address is going to be static: I'm not aware of a way to simulate privacy extensions with Wireguard. A workaround is to assign ULAs and apply NAT.

I see, thank you. Unfortunately I don't have IPv6 on my network and don't know the IPv6 local addresses and ip6tables config, if you could give me the actual config you used I'd appreciate it, especially if it works with both IPv4 and IPv6 together.

Sure

------------------

[Interface] Address = 172.16.31.1/24 Address = 2001:__::1/64 PrivateKey = __ ListenPort = 443

[Peer] PublicKey = __ PresharedKey = __ AllowedIPs = 172.16.31.2/32, 2001:__::2/128

[Peer] PublicKey = __ PresharedKey = __ AllowedIPs = 172.16.31.3/32, 2001:__::3/128

[...]

------------------

PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -A FORWARD -i %i -j ACCEPT; ip6tables -A FORWARD -o %i -j ACCEPT PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -D FORWARD -i %i -j ACCEPT; ip6tables -D FORWARD -o %i -j ACCEPT

------------------

[Interface] Address = 172.16.31.2/24 Address = 2001:__::2/64 PrivateKey = __ DNS = 172.16.31.1, 2001:__::1 [Peer] PublicKey = __ PresharedKey = __ AllowedIPs = 0.0.0.0/0, ::/0 Endpoint = :443 PersistentKeepalive = 25

------------------

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#65

Post by StavrosK »

tgragnato wrote: post #64
StavrosK wrote: post #61

Earlier quoted context omitted.

I see, thank you. Unfortunately I don't have IPv6 on my network and don't know the IPv6 local addresses and ip6tables config, if you could give me the actual config you used I'd appreciate it, especially if it works with both IPv4 and IPv6 together.

Sure ------------------ [Interface] Address = 172.16.31.1/24 Address = 2001:__::1/64 PrivateKey = __ ListenPort = 443 [Peer] PublicKey = __ PresharedKey = __ AllowedIPs = 172.16.31.2/32, 2001:__::2/128 [Peer] PublicKey = __ PresharedKey = __ AllowedIPs = 172.16.31.3/32, 2001:__::3/128 [...] ------------------ PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROU…

This is extremely helpful, thanks!

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#66

Post by kitotik »

anilakar wrote: post #60
zymhan wrote: post #58

Earlier quoted context omitted.

> OpenVPN replacement (which has a lot of issues) Care to elaborate?

This. I'm using OpenVPN for ethernet bridging, which Wireguard cannot do.

Tinc would be a nice choice for this purpose.

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#67

Post by sowbug »

garblegarble wrote: post #42
davidcollantes wrote: post #16

Earlier quoted context omitted.

Where is the tool you build?

I'm not the person you're replying to, but I think this is what they were referring to from their github: https://github.com/sowbug/mkwgconf

Aaaaand I'm awake after a good night's sleep and far past the edit window for my original comment. Thank you for that link; yes, it's the one I meant to post. Sigh.

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#68

Post by module0000 »

puzzlingcaptcha wrote: post #63
zymhan wrote: post #58

Earlier quoted context omitted.

> OpenVPN replacement (which has a lot of issues) Care to elaborate?

A few off the top of my head: juggling packets between userspace and kernel resulting in poor performance, tacked-on hacky features (hmac authentication), fragmented and often outdated documentation (the community wiki is a mess), homebrew key generation helper tools with hardcoded openssl versions, no native support on Windows/MacOS, autostart services on Windows are a mess (OpenVPNService, OpenVPNServiceInteractive…

I don't know where you got your information...but you can achieve wire speed with OpenVPN over a 1gb link. If I had a bigger pipe, then I could run a bigger test, and expect the same results. The rest of your points fall under "it's not easy for average users" - which I agree with.

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#69

Post by ktta »

> ZeroTier: haven't tried it yet, sould I?

Yes. If connectivity to clients behind NAT is important and you don't want to waste effort creating a 'bounce off' server.

ZeroTier makes it really easy to setup a private VPN with minimal config. The real value add with it is the work that's done regarding hole punching and if you have a carrier grade NAT that is tough to get through, it will relay your traffic (albeit at a throttled speed) which can be a great time saver.

The other thing is their online 'Central' where you can add/remove devices, assign IP addresses, set flow rules and more. I really like their service and the best part of it compared to my WireGuard server is I don't have to worry about downtime due to some problem with my server.

Re: Wireguard-docs: Setup, usage, configuration, and a full example

#70

Post by mises »

module0000 wrote: post #68
puzzlingcaptcha wrote: post #63

Earlier quoted context omitted.

A few off the top of my head: juggling packets between userspace and kernel resulting in poor performance, tacked-on hacky features (hmac authentication), fragmented and often outdated documentation (the community wiki is a mess), homebrew key generation helper tools with hardcoded openssl versions, no native support on Windows/MacOS, autostart services on Windows are a mess (OpenVPNService, OpenVPNServiceInteractive…

I don't know where you got your information...but you can achieve wire speed with OpenVPN over a 1gb link. If I had a bigger pipe, then I could run a bigger test, and expect the same results. The rest of your points fall under "it's not easy for average users" - which I agree with.

That depends on how much horsepower you have on both ends. I run my vpn off of a cheap cloud vps, which does the job, but doesn't have a lot of cpu power. I probably tripled my speed from openvpn to wireguard, all though both fail to max out my internet connection.
Post reply on HN