Our User-Mode WireGuard Year • Hacker News Board

Re: Our User-Mode WireGuard Year

#81

Post by jacob019 » Wed, Feb 09, 2022, 11:22 PM UTC

anonymousisme wrote: post #49

Back in the day (nearly 30 years ago) people would run a user-mode stack to obtain Internet connectivity via a (dial-up) Unix shell account. The program was "slirp" which was named after SLIP/CSLIP, but then upgraded to support PPP once that became a thing. https://en.wikipedia.org/wiki/Slirp

I was using SLIRP a few years ago to tunnel traffic through a cheap OpenVZ VPS, (for downloading Linux ISOs). I had to manually patch the TCP window size and recompile the binaries to get decent speed as the original code doesn't support TCP Window Size Scaling. I tried to upstream the patch to Debian but the maintainer wouldn't reply. It worked well enough but now I use wireguard.

Modified SLIRP code is also found in VirtualBox, Qemu, UML and other virtualization software, for sharing the host connection in NAT mode.

Re: Our User-Mode WireGuard Year

#82

Post by godtoldmetodoit » Wed, Feb 09, 2022, 11:34 PM UTC

sa1 wrote: post #54

mrkurt wrote: post #44

Earlier quoted context omitted.

Tailscale will do this! tailscaled --tun=userspace-networking --socks5-server=localhost:1081

Sadly, on the only machine that I would have wanted this on, where I didn't have root access, this has never worked for me. I should try to recreate the logs and issue for the tailscale folks.

I had issues with it as well, was following the Tailscale guide for getting userspace running in Azure App Service and I could not get it to work.

Re: Our User-Mode WireGuard Year

#83

Post by renewiltord » Wed, Feb 09, 2022, 11:39 PM UTC

Incredible blog post. Thank you very much for sharing. Signing up now.

Also, this post makes me update my prior on top HN contributors being unproductive (i.e. that they spend their time on this board all the time instead of working).

Re: Our User-Mode WireGuard Year

#84

Post by mbesto » Wed, Feb 09, 2022, 11:45 PM UTC

mrkurt wrote: post #73

mbesto wrote: post #67

Earlier quoted context omitted.

> I wish that more companies could be like this and skip the corporate BS, it shows that they really have something outstanding to offer. The nature of the blog typically cater towards the intended audience. The CIO of Disney doesn't give a sh*t if the protocol is called WireGuard or OpenVPN or that if it uses AES-256 encryption - he/she wants someone to tell them that their developers are securely accessing their in…

For better or worse, I can guarantee you that we won't ever write articles for the Disney CIO. Unless I get fired. Whitepapers. They want whitepapers and magic quadrants.

> we won't ever write articles

> Whitepapers.

I probably should have said "content" instead of blog because I agree 100% with this. Point still stands.

What the OP was referring to will likely become part of an engineering blog. a la : https://codeascraft.com/

Re: Our User-Mode WireGuard Year

#85

Post by jonathanoliver » Wed, Feb 09, 2022, 11:49 PM UTC

lyeager wrote: post #32

> The Consul cluster would hold an Entmoot Hah! That one got me. They know their audience :)

This one made me laugh out loud and I had to come to HN to post this. You beat me to it.

Re: Our User-Mode WireGuard Year

#86

Post by Karrot_Kream » Thu, Feb 10, 2022, 12:03 AM UTC

mrkurt wrote: post #79

tedunangst wrote: post #74

Earlier quoted context omitted.

Perhaps atypical, but about 50% of my ssh use is port forwarding to construct impoverished man's VPNs. Like I send mail by forwarding localhost:25 to localhost:25 on the mail server. If I were running PoE (Postgres on Edge) I'd probably want to connect a local client for poking around, but without the bother of meshing my laptop into the cloud.

Most port forwarding you need to connect to Fly apps is baked in. Here's how to get at a remote postgres: $ flyctl proxy 15432:5432 -s -a fizz-db ? Select instance: [Use arrows to move, type to filter] > gru.fizz-db.internal iad.fizz-db.internal lax.fizz-db.internal lhr.fizz-db.internal ord (fdaa:0:446b:a7b:20db:0:77a5:2) ord (fdaa:0:446b:a7b:20dc:0:784c:2) yyz.fizz-db.internal That forwards whichever you select to l…

Awesome, this is a killer promo for Fly btw :D

Re: Our User-Mode WireGuard Year

#87

Post by rkeene2 » Thu, Feb 10, 2022, 12:08 AM UTC

remram wrote: post #29

anderspitman wrote: post #14

Usermode WireGuard would be a big deal. I maintain a list[0] of tunneling solutions, and one of the only limitations of systems built on WireGuard is the requirement for admin privileges. Even with the performance hit from running outside the kernel, UDP-based tunnels have a lot of advantages for multiplexing channels. Pretty much your only mainstream options today are QUIC and WireGuard, and only QUIC is intended to…

It sounds like we could have a generic userspace tool that proxies any connection to a WireGuard server. Similar to ssh -L, it would listen on a TCP/UDP port locally (or talk the SOCKS protocol) and convert that to IP packets over the WireGuard connection (using a userspace TCP or UDP implementation for that side). It looks like Fly.io has all the bits, they just need to be packaged as a stand-alone tool rather than…

SSH can do this without any WireGuard:

https://rkeene.org/viewer/tmp/ssh-ip-tunnel.txt.htm

Re: Our User-Mode WireGuard Year

#88

Post by remram » Thu, Feb 10, 2022, 12:20 AM UTC

rkeene2 wrote: post #87

remram wrote: post #29

Earlier quoted context omitted.

It sounds like we could have a generic userspace tool that proxies any connection to a WireGuard server. Similar to ssh -L, it would listen on a TCP/UDP port locally (or talk the SOCKS protocol) and convert that to IP packets over the WireGuard connection (using a userspace TCP or UDP implementation for that side). It looks like Fly.io has all the bits, they just need to be packaged as a stand-alone tool rather than…

SSH can do this without any WireGuard: https://rkeene.org/viewer/tmp/ssh-ip-tunnel.txt.htm

There's nothing userspace about this, you are using a tun device with the actual kernel IP stack.

Re: Our User-Mode WireGuard Year

#89

Post by remram » Thu, Feb 10, 2022, 12:21 AM UTC

mrkurt wrote: post #44

remram wrote: post #29

Earlier quoted context omitted.

It sounds like we could have a generic userspace tool that proxies any connection to a WireGuard server. Similar to ssh -L, it would listen on a TCP/UDP port locally (or talk the SOCKS protocol) and convert that to IP packets over the WireGuard connection (using a userspace TCP or UDP implementation for that side). It looks like Fly.io has all the bits, they just need to be packaged as a stand-alone tool rather than…

Tailscale will do this! tailscaled --tun=userspace-networking --socks5-server=localhost:1081

With any WireGuard server or a custom tailscale server/service?

Re: Our User-Mode WireGuard Year

#90

Post by dangerboysteve » Thu, Feb 10, 2022, 12:28 AM UTC

mrkurt wrote: post #73

mbesto wrote: post #67

Earlier quoted context omitted.

> I wish that more companies could be like this and skip the corporate BS, it shows that they really have something outstanding to offer. The nature of the blog typically cater towards the intended audience. The CIO of Disney doesn't give a sh*t if the protocol is called WireGuard or OpenVPN or that if it uses AES-256 encryption - he/she wants someone to tell them that their developers are securely accessing their in…

For better or worse, I can guarantee you that we won't ever write articles for the Disney CIO. Unless I get fired. Whitepapers. They want whitepapers and magic quadrants.

Correction, magic kingdom quadrants.