I use WireGuard on OPNsense (FreeBSD-based router appliance) and clients on macOS, iPhone, iPad, Android, Linux, and Windows. It's easy to setup and Just Works(tm). Throw away your AnyConnect, Tunnelblick (OpenVPN), and such.
WireGuard in FreeBSD
61–70 of 84 posts
Re: WireGuard in FreeBSD
#62Between the FreeBSD WireGuard drama and WireGuard's maintainer's (Jason Donenfeld) reaction to the NetBSD implementation, I think it's a good idea to look at not only what's happening, but why and by whom. There's something slightly fishy about it all. https://mail-index.netbsd.org/current-users/2020/08/20/msg03... https://mail-index.netbsd.org/current-users/2020/08/22/msg03... Jason Donenfeld has, to this day, never…
Thanks for the background. However, I believe your question > Jason Donenfeld has, to this day, never answered direct and simple questions about WHY he felt so strongly that NetBSD's wg implementation should be removed from NetBSD. gets answered by Jason: > In its current form, there are implementation flaws and violations that I do not consider acceptable, and deploying this kind of thing is highly irresponsible and…
NetBSD just needs Rust support for kernel dev. ;)
I appreciate when folks take a reasonable stand against craptastic software engineering practices (cough OpenSSL cough) and insist on quality code.
Re: WireGuard in FreeBSD
#63I'm really looking forward to this making its way into OPNsense and such.
I'm already running the kmod Wireguard on Opnsense unless I'm missing something?
I have a Dutch physical OPNsense (business license) box with 10 GbE ports. IIRC, it's the userland version. To be honest, I prefer most things to live outside of the kernel than use it as a kitchen sink dumping ground for "but but but it's faster!".
Re: WireGuard in FreeBSD
#64Between the FreeBSD WireGuard drama and WireGuard's maintainer's (Jason Donenfeld) reaction to the NetBSD implementation, I think it's a good idea to look at not only what's happening, but why and by whom. There's something slightly fishy about it all. https://mail-index.netbsd.org/current-users/2020/08/20/msg03... https://mail-index.netbsd.org/current-users/2020/08/22/msg03... Jason Donenfeld has, to this day, never…
No post body was provided.
Re: WireGuard in FreeBSD
#65Between the FreeBSD WireGuard drama and WireGuard's maintainer's (Jason Donenfeld) reaction to the NetBSD implementation, I think it's a good idea to look at not only what's happening, but why and by whom. There's something slightly fishy about it all. https://mail-index.netbsd.org/current-users/2020/08/20/msg03... https://mail-index.netbsd.org/current-users/2020/08/22/msg03... Jason Donenfeld has, to this day, never…
Quoted post unavailable.
except other people have implemented it and not gotten flamed.
Re: WireGuard in FreeBSD
#66Earlier quoted context omitted.
The original implementation had a lot of issues, but more importantly it was pushed to head and deployed in production without a review: https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice...
This is a lie. The bad code was never "deployed in production", it was pulled before a release. FreeBSD users were never exposed to it. HEAD code branch is where reviews happen in BSDs, this code failed that review and was removed.
A a larger backer and contributor to freeBSD pushed wireguard kernel mode support out in one of their production releases and then slowly walked it back. Whether freeBSD likes it or not, this sort of thing reflects poorly on freeBSD as a whole when a large donor/backer and contributor that advertises freeBSD then releases something that is a pile of half baked shit.
https://www.netgate.com/blog/wireguard-removed-from-pfsense-...
https://lists.zx2c4.com/pipermail/wireguard/2021-March/00650...
Re: WireGuard in FreeBSD
#67Earlier quoted context omitted.
1) That's not at all what he said. 2) In his message he also mentions that he is short on time and would be willing to elaborate on why the code is flawed as well as collaborate on getting a polished implementation of WG into the kernel a week later. 3) As mentioned by the article I linked, he did follow up on his promises: https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649...
The message you link to is in regard to the FreeBSD implementation and not NetBSD.
If anyone wants to review the NetBSD implementation, see:
Re: WireGuard in FreeBSD
#68Earlier quoted context omitted.
Generally, I would trust the defaults of FreeBSD more than the defaults of Ubuntu, but FreeBSD may require more setup of any utilities you might be using. But, I don’t actually know for sure. I plan on using FreeBSD bastions.
This is untrue in my experience. I've used FreeBSD a fair bit in the past and Ubuntu and Debian more continuously. Unless something radically changed recently. My experience is about 6-8 years old now but FreeBSD requires a lot more configuration when setting up common services, whereas Ubuntu and even Debian have good defaults that you can usually bring up without having to first consume the entire manual for that s…
This is untrue in my experience.
I was using FreeBSD as my desktop for almost 15 years, since the 4.1 times, and the amount of work it took to make some sane vpn client out of an ubuntu is nowhere near what I had as my griefs with FreeBSD back then. Not even mentioning pf vs iptables and how 20(?) years passed before linux had something comparable like nftables.
Nowadays it's mostly fine, but..
Case in point : I had to write and contribute wireguard support to the netplan to make it marginally sane.
Re: WireGuard in FreeBSD
#69Earlier quoted context omitted.
This is a lie. The bad code was never "deployed in production", it was pulled before a release. FreeBSD users were never exposed to it. HEAD code branch is where reviews happen in BSDs, this code failed that review and was removed.
It’s also a lie that it wasn’t available for review. It was in review for about 10 months before it started to land in a release.
How about you provide links that backup your claims.. It's well documented that you'll go to great lengths to act in bad faith and make nonsense claims on the internet.
https://www.wipo.int/amc/en/domains/search/text.jsp?case=D20...
Re: WireGuard in FreeBSD
#70Earlier quoted context omitted.
This is untrue in my experience. I've used FreeBSD a fair bit in the past and Ubuntu and Debian more continuously. Unless something radically changed recently. My experience is about 6-8 years old now but FreeBSD requires a lot more configuration when setting up common services, whereas Ubuntu and even Debian have good defaults that you can usually bring up without having to first consume the entire manual for that s…
This is untrue in my experience. I was using FreeBSD as my desktop for almost 15 years, since the 4.1 times, and the amount of work it took to make some sane vpn client out of an ubuntu is nowhere near what I had as my griefs with FreeBSD back then. Not even mentioning pf vs iptables and how 20(?) years passed before linux had something comparable like nftables. Nowadays it's mostly fine, but.. Case in point : I had…
I sense that we might be basing our conclusion on qualitatively and temporally different things.
My limited experience with FreeBSD was as a desktop and server for a few years around 2009ish to 2012, but also as a basic user of basic services. From memory a lot more hoops had to be jumped to get equivalent things working on FreeBSD, and I was always left with a nagging feeling after initial setup on FreeBSD that I didn't yet know enough to feel confident in the configurations I had produced, compared to Debian and et al at the time, where configuration felt like they left the bare minimum for you to customise, and working defaults for the rest that you could gradually learn to tweak without the pressure of getting every variable correct from the get go.
However as a user who already thoroughly understands the service or it's domain I expect this kind of detail may be lost... instead you can compare based more on the flaws of the configurations and their implementations (which I suspect applies to your experience). But for the rest of us it results in flaky custom initial configuration. It's the same for me if I pick out a piece of software now that I have become very familiar with and already know how to configure inside out - i wouldn't experience the same kind of problem that someone unfamiliar would.
To clarify, I guess I'm talking about sane defaults from the perspective of new users, poor defaults combined with new users can end up with insecure or problematic results - even if the default configuration alone is technically fine.
I expect Linux and FreeBSD and other BSDs have likely improved a lot over the last decade from either perspective anyway.