Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our User-Mode WireGuard Year

fly.io

Post reply on HN
Print view View original

71–80 of 169 posts

Re: Our User-Mode WireGuard Year

#71

Post by bityard »

ulzeraj wrote: post #64

I was using wireguard-go on FreeBSD jail running on top of an APU2C2 board. Torrenting from my laptop caused wireguard-go cpu usage to spike to high loads and 30-50% CPU usage. Loading wireguard-kmod on the host machine plus some devfs rules dropped the CPU load to 0s. Not sure what happened there. The processor seems to score less than an RPi4 on Geekbench.

I use one of these as a firewall (running OPNSense) and they're very nice but the CPU is indeed _slow_. It's plenty good enough for everything the firewall does but booting it up takes minutes and that's saying something for FreeBSD.

Re: Our User-Mode WireGuard Year

#72

Post by tptacek »

mbesto wrote: post #67
marcus_cemes wrote: post #11

Fly.io's blog posts are incredible, they really seem to really enjoy what they do and want to share what they've made with everyone else. I love them for that. I wish that more companies could be like this and skip the corporate BS, it shows that they really have something outstanding to offer.

> I wish that more companies could be like this and skip the corporate BS, it shows that they really have something outstanding to offer. The nature of the blog typically cater towards the intended audience. The CIO of Disney doesn't give a sh*t if the protocol is called WireGuard or OpenVPN or that if it uses AES-256 encryption - he/she wants someone to tell them that their developers are securely accessing their in…

So Eden sank to grief, so dawn goes down to day.

Re: Our User-Mode WireGuard Year

#73

Post by mrkurt »

mbesto wrote: post #67
marcus_cemes wrote: post #11

Fly.io's blog posts are incredible, they really seem to really enjoy what they do and want to share what they've made with everyone else. I love them for that. I wish that more companies could be like this and skip the corporate BS, it shows that they really have something outstanding to offer.

> I wish that more companies could be like this and skip the corporate BS, it shows that they really have something outstanding to offer. The nature of the blog typically cater towards the intended audience. The CIO of Disney doesn't give a sh*t if the protocol is called WireGuard or OpenVPN or that if it uses AES-256 encryption - he/she wants someone to tell them that their developers are securely accessing their in…

For better or worse, I can guarantee you that we won't ever write articles for the Disney CIO. Unless I get fired.

Whitepapers. They want whitepapers and magic quadrants.

Re: Our User-Mode WireGuard Year

#74

Post by tedunangst »

tptacek wrote: post #62
tedunangst wrote: post #58

Earlier quoted context omitted.

How complete is the ssh implementation? I'm thinking I probably want to at least run git/hg push, and maybe even do port forwarding.

Not very. You can scp and rsync over it. You can run with or without a pty. That's pretty much it. It should work with git! You probably shouldn't do port forwarding on Fly.io; if you're running into an actual need for that, we should talk about extending our network access control model.

Perhaps atypical, but about 50% of my ssh use is port forwarding to construct impoverished man's VPNs. Like I send mail by forwarding localhost:25 to localhost:25 on the mail server.

If I were running PoE (Postgres on Edge) I'd probably want to connect a local client for poking around, but without the bother of meshing my laptop into the cloud.

Re: Our User-Mode WireGuard Year

#75

Post by anderspitman »

bradfitz wrote: post #59
anderspitman wrote: post #28

Earlier quoted context omitted.

Last I heard[0] they were experimenting but hadn't shipped it. AFAIK their client still requires root, no? Running on wasm sounds awesome. This[1] looks like it. Do you know how they're doing the actual networking? WebRTC tunnel? [0]: https://news.ycombinator.com/item?id=24483173 [1]: https://twitter.com/bradfitz/status/1451423386777751561?lang...

> Last I heard[0] they were experimenting but hadn't shipped it. AFAIK their client still requires root, no? Tailscale's gvisor/netstack-based userspace networking mode has been supported and in wide use for quite some time. It's the default on Synology DSM7, for instance. You don't need root when you run tailscaled with `--tun=userspace-networking`. Peers can still connect inbound to the non-root tailscaled, but to…

Thanks for the update!

Do you have any links that talk more about how the wasm stuff works? I'd love to read more about that.

Re: Our User-Mode WireGuard Year

#76

Post by dan-robertson »

marcus_cemes wrote: post #11

Fly.io's blog posts are incredible, they really seem to really enjoy what they do and want to share what they've made with everyone else. I love them for that. I wish that more companies could be like this and skip the corporate BS, it shows that they really have something outstanding to offer.

A lot of (small–medium sized, tech) companies just don’t have a process to get things out on their blog like this. It might be that only a few senior people have the ability to write posts and they are not interested or busy with other things, or it might be that there is a slow review process for posts that makes writing them unpleasant, or it might be that they don’t want to reveal IP or have an opinion and so have little to talk about. Another company that does a good job of writing blog posts, often timely posts about current (and relevant) events, is cloudflare though their posts have a quite different energy to Fly.io’s.

Re: Our User-Mode WireGuard Year

#77

Post by Hendrikto »

remram wrote: post #24
iqanq wrote: post #21

Can someone explain to me why wireguard is implemented as a kernel module? Yes I get it, more performance. But isn't it completely and absolutely insane to run a complicated piece of software that is open to outside connections with kernel privileges?

Performance.

It also helps with availability. If you got a recent kernel, it‘s already there.

Re: Our User-Mode WireGuard Year

#78

Post by LilBytes »

pmarreck wrote: post #68
anderspitman wrote: post #33

Earlier quoted context omitted.

It depends on what sort of tunneling you're doing. If you just want a general-purpose private VPN, Tailscale is amazing. That list is more focused on the use case where you want to host a public server on a machine that isn't accessible to the internet (NAT, corporate firewall, etc). Think a shared Jellyfin server for your friends and family. You can use Tailscale here but you'll need to separately run a reverse-prox…

I wish I could run two separate Tailscale networks on a single device, one for business and one for personal (for example). Would make it tremendously more useful.

There's an existing GitHub ask for this to be implemented. It's not terrible jumping between work and personal and work environments but it would be nice if I didn't have to.

Re: Our User-Mode WireGuard Year

#79

Post by mrkurt »

tedunangst wrote: post #74
tptacek wrote: post #62

Earlier quoted context omitted.

Not very. You can scp and rsync over it. You can run with or without a pty. That's pretty much it. It should work with git! You probably shouldn't do port forwarding on Fly.io; if you're running into an actual need for that, we should talk about extending our network access control model.

Perhaps atypical, but about 50% of my ssh use is port forwarding to construct impoverished man's VPNs. Like I send mail by forwarding localhost:25 to localhost:25 on the mail server. If I were running PoE (Postgres on Edge) I'd probably want to connect a local client for poking around, but without the bother of meshing my laptop into the cloud.

Most port forwarding you need to connect to Fly apps is baked in. Here's how to get at a remote postgres:

    $ flyctl proxy 15432:5432 -s -a fizz-db
    ? Select instance:  [Use arrows to move, type to filter]
    > gru.fizz-db.internal
      iad.fizz-db.internal
      lax.fizz-db.internal
      lhr.fizz-db.internal
      ord (fdaa:0:446b:a7b:20db:0:77a5:2)
      ord (fdaa:0:446b:a7b:20dc:0:784c:2)
      yyz.fizz-db.internal
That forwards whichever you select to local port 15432.

Re: Our User-Mode WireGuard Year

#80

Post by thundergolfer »

This post pairs nicely with Julia Evans’ post on why most people use the Linux kernel’s TCP/IP stack and why a few others would bother with a userland stack.

In her post she doesn’t mention fly.io’s motivation for doing userland TCP-IP: a nicer end user client experience.

If I read this correctly then fly.io did all this work to make their CLI user experience markedly better. That’s pretty cool. Twist yourself in interesting knots to make your user’s lives better, maybe even in ways they won’t notice!

Post reply on HN