Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard: Beyond the most basic configuration

sloonz.github.io

Post reply on HN
Print view View original

81–90 of 115 posts

Re: WireGuard: Beyond the most basic configuration

#81

Post by bogantech »

tptacek wrote: post #70
icelancer wrote: post #37

No RBAC is sad, though understandable. Wireguard is so much faster than OpenVPN. We use Wireguard for S2S but unfortunately need OpenVPN for our employees and contractors due to RBAC. All posts and writeups we've found trying to shoehorn RBAC into Wireguard ultimately ends up with people saying "don't do this."

The point of the WireGuard design is to be agnostic to "upper-layer" concerns like this; it's a fast (optionally) kernel-resident secure transport that you can build whatever you'd like on top of. WireGuard isn't about RBAC and doesn't have a "don't do RBAC" position.

> The point of the WireGuard design is to be agnostic to "upper-layer" concerns like this;

And there will probably never be any standard (non-commercial) "upper-layer" because of this.

The project prides itself on being much simpler than IPSEC etc but that's easy when you leave out half of the functionality

Re: WireGuard: Beyond the most basic configuration

#83

Post by vardump »

teleforce wrote: post #82

Is there any good books on Wireguard that cover the principles, implementation and configurations? We have plenty of books on IPSEC but for Wireguard it's a rarity.

I don’t think you could write that thick of a book about wireguard.

For IPSEC you’re going to need a bookshelf.

Re: WireGuard: Beyond the most basic configuration

#84

Post by tptacek »

bogantech wrote: post #81
tptacek wrote: post #70

Earlier quoted context omitted.

The point of the WireGuard design is to be agnostic to "upper-layer" concerns like this; it's a fast (optionally) kernel-resident secure transport that you can build whatever you'd like on top of. WireGuard isn't about RBAC and doesn't have a "don't do RBAC" position.

> The point of the WireGuard design is to be agnostic to "upper-layer" concerns like this; And there will probably never be any standard (non-commercial) "upper-layer" because of this. The project prides itself on being much simpler than IPSEC etc but that's easy when you leave out half of the functionality

That's a good thing. The higher up the stack you go, the less value there is in standardizing, and more painful the costs (of being constrained in implementation).

Also: it is much simpler than IPSEC. Pretty much everybody can get WireGuard working in minutes. It's approximately as easy as setting up SSH. That's simply not true of IPSEC.

Anyways, I think the jury is in on this one.

Re: WireGuard: Beyond the most basic configuration

#85

Post by tapirl »

irunmyownemail wrote: post #74
smw wrote: post #26

Earlier quoted context omitted.

Just give in and use tailscale, life is so much better on the dark side!

Staying with Wireguard. The article, by the way, is about Wireguard, not an opinion piece comparing alternative technologies.

@smw just says that tailscale is more convenient than dynamic DNS.

Re: WireGuard: Beyond the most basic configuration

#86

Post by zaptheimpaler »

Im trying to set up a personal server with services that may be accessible from the web with a real domain name or only via Tailscale. I got the web part working with Caddy and mapping subdomains to services, but the problem is Tailscale Magic DNS doesn't support subdomains. I could try to host services on paths like "blah.blah.ts.net/svc1" and strip the paths in Caddy but that causes all sorts of problems that you have to debug per service - like maybe links breaking, websockets breaking etc. So it seems subdomains are the only clean solution.

I don't know much about this stuff but it seems the best way to circumvent this limitation is to create a private DNS server that can resolve any subdomains I want to the tailscale IP, so i'm working on getting pihole setup to do that.. is this a limitation of Wireguard? How do people set up this kind of network?

Re: WireGuard: Beyond the most basic configuration

#87

Post by franga2000 »

entangledqubit wrote: post #5

Not to hijack but last time I was setting up wireguard, I found this site to be super useful: https://www.procustodibus.com/blog/2020/10/wireguard-topolog...

+1 for this, any time I or a colleague have a wireguard issue that smells of "you're using it wrong" I come back to this set of articles (don't miss the links to separate detailed posts for each configuration!)

Re: WireGuard: Beyond the most basic configuration

#88

Post by smashed »

vladvasiliu wrote: post #19
diggan wrote: post #4

Earlier quoted context omitted.

A pretty common setup is to have a public VPS/dedicated server with wireguard/openvpn hosted at some trusted company and use that as an entry/exit point. It's basically what Tailscale is (massively simplified, obviously).

As far as I understand it, that's not how Tailscale works most of the time. The actual connection is established between the VPN nodes, and actual traffic doesn't travel through Tailscale's servers. The VPS solution is usually the hub of a star-shaped network, so everything has to go through it, which may be limiting, given that, at least where I live, gigabit fiber is fairly widespread and reasonably priced. Most VP…

Tailscale will fallback to tuns servers which are dumb "cloud" relays if direct connection can't be established.

Re: WireGuard: Beyond the most basic configuration

#89

Post by sintax »

ahalimah wrote: post #71
icelancer wrote: post #37

No RBAC is sad, though understandable. Wireguard is so much faster than OpenVPN. We use Wireguard for S2S but unfortunately need OpenVPN for our employees and contractors due to RBAC. All posts and writeups we've found trying to shoehorn RBAC into Wireguard ultimately ends up with people saying "don't do this."

I like Defguard for this https://defguard.net/

Not played with this yet, but https://github.com/firezone/firezone is another example.

Re: WireGuard: Beyond the most basic configuration

#90

Post by Jnr »

irunmyownemail wrote: post #78
Jnr wrote: post #20

Earlier quoted context omitted.

Tailscale (also using wireguard for transport) and similar overlay networks kind of do that. With Tailscale there is a central server, you can sign in with single-sign-on, that server enables automatic mesh configuration and helps nodes communicate specifics for port knocking, routing, dns, etc. And there are derp servers (think of them like TURN servers) that can be used as proxies when direct communication can't be…

With Wireguard I own or control everything. Why would I surrender any of that to Tailscale?

Would be great if someone made something with the polish of Tailscale and made it completely free and open source, but I don't think it is happening any time soon. Wireguard itself has been an unbelievably great gift to the whole IT ecosystem and Jason will forever be cemented in my hall of fame.

But he did intend for Wireguard to be used in all sorts of solutions and Tailscale is one of them.

Tailscale apps themselves are open source for open source platforms (linux, android) and the 3rd party management server Headscale is open source, enabling you to maintain control.

Post reply on HN