Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is submitted for Linux kernel inclusion

marc.info

Post reply on HN
Print view View original

91–100 of 189 posts

Re: WireGuard is submitted for Linux kernel inclusion

#91

Post by [deleted] »

moviuro wrote: post #62
arctux wrote: post #53

I've been using Wireguard on both my laptop and my Android phone for about two months. I've been using the wg-quick systemd units, and everything has worked amazingly well. The only downside I've notice is slightly increased battery consumption on my phone, but that's to be expected (it uses approximately 5% of the battery per day). I use dnsmasq to resolve DNS queries on the server side. Dnsmasq's configuration file…

> it uses approximately 5% of the battery per day OpenVPN uses about 20% of mine, so I guess it really is a step forward. Also, for your DNS lying file, you might be interested in: https://gitlab.com/moviuro/moviuro.bin/blob/master/lie-to-me (which sources multiple domain lists)

[deleted]

Re: WireGuard is submitted for Linux kernel inclusion

#93

Post by cm2187 »

Hello71 wrote: post #89
cm2187 wrote: post #61

Earlier quoted context omitted.

I presume speed on linux? Otherwise doesn't wireguard suffer from the same peformance drawback than OpenVPN on windows (running in user mode)?

OpenVPN is quite configurable, not as much as IPsec, but still a lot, and (from what I hear) has quite a bit of code bloat. I believe that userspace WireGuard has better performance than OpenVPN.

My understanding (and experience) is that OpenVPN on windows is structurally capped at about 5-10 MB/s. I was curious of how that compares to WireGuard.

Re: WireGuard is submitted for Linux kernel inclusion

#94

Post by brightball »

swsieber wrote: post #69

So, since lots of people here have experience with VPN, I'd like to ask theoretical project question: I have distant family memebers, and it'd be nice to have a simple way to get devices on the same network easily. My initial thought would be to setup a VPN server somewhere central and fast, and then distribute wireless routers with custom firmware that they could plugin to their network. Then anything they connect t…

ZeroTier. It's excellent for your use case.

Re: WireGuard is submitted for Linux kernel inclusion

#95

Post by zaarn »

moviuro wrote: post #63
zaarn wrote: post #51

I can't wait until pfSense supports it. That'll be the moment I'll set the OpenVPN config on fire, because honestly, OpenVPN configs are magic and if it's not generated by some UI wizard, it's probably broken in some scenario. And even if you do the wizard, it's probably broken. Atm I have that funny bug where my laptop drops connection after 3 seconds but my desktop does fine. With the same configuration! Thank OVPN…

> Thank OVPN for that annoyance! Certainly, you reported that issue through proper channels, and attached detailled information regarding your hardware, software, as well as packet logs?

It's a configuration error, not a OVPN bug itself. OVPN's configs are just so obfuscated that it's difficult to find the error.

Re: WireGuard is submitted for Linux kernel inclusion

#96

Post by alias_neo »

Hello71 wrote: post #82
alias_neo wrote: post #25

Earlier quoted context omitted.

I agree. I've been using Wireguard for about 6 months now. The quick start is great for getting a quick overview but it doesn't really document properly how a configuration file should be made. There is no real detail about how a wg-quick config differs from a wg one, and they're not compatible; it'll complain about unknown keys/values or something if you use a wg-quick config with extra firewall rules and the like w…

> I also saw nothing anywhere about how if you modify your config file and down/up with wg-quick it'll delete anything you entered in your config as the 'down' will write back the current state of the interface. It's not a big deal, but it messes with the usual workflow of editing the config file of a service (you don't want to down it while updating your config, which could take time). `down` only writes the state o…

> `down` only writes the state of the interface if you put SaveConfig = true in your configuration file. If so... you asked for it.

Nope, it's not in my config file. I didn't even know the option existed until you mentioned it, again, nothing on the Quick Start about it.

> WireGuard uses the standard Linux routing infrastructure...

I meant more in terms of the Android app, not really a WG issue, but it has a check box to add exclusions to the allowed ip list, by basically adding ranges inverse to what you'd input if you were saying "exclude these".

What's the inverse of 192.168.0.0/16? I have no idea without looking it up.

Re: WireGuard is submitted for Linux kernel inclusion

#97

Post by arghwhat »

phs2501 wrote: post #80
arghwhat wrote: post #76

Earlier quoted context omitted.

> Well, this is a network where only SSH and one or two more TCP ports are open, and it's not something I can "get fixed". Are the other TCP ports, as well as UDP blocked by a force of nature? :) > Still, I do not have any practical reason for switching to Wireguard, as I do not really see any reduced speed - it is possible that the bandwidth limitation of this network's internet connection is low enough for that to…

> Are the other TCP ports, as well as UDP blocked by a force of nature? :) Yes; the force in question is usually spelled out as "auditors." :(

Ah, that force. Does this force allow VPNs, or are you just reusing existing open ports for... alternative purposes? :)

In case of the former, then Wireguard will likely be permitted some day as the status quo of VPNs. OpenVPN and IPSec appear as dead ends, so it's just a matter of time. If Wireguard is successfully upstreamed soon, I wouldn't be surprised if it rose to the throne of VPN monopoly sooner rather than later.

In case of the latter, you're out of luck without a compat mode or a bridge tool... :/

Re: WireGuard is submitted for Linux kernel inclusion

#98

Post by move-on-by »

moviuro wrote: post #62
arctux wrote: post #53

I've been using Wireguard on both my laptop and my Android phone for about two months. I've been using the wg-quick systemd units, and everything has worked amazingly well. The only downside I've notice is slightly increased battery consumption on my phone, but that's to be expected (it uses approximately 5% of the battery per day). I use dnsmasq to resolve DNS queries on the server side. Dnsmasq's configuration file…

> it uses approximately 5% of the battery per day OpenVPN uses about 20% of mine, so I guess it really is a step forward. Also, for your DNS lying file, you might be interested in: https://gitlab.com/moviuro/moviuro.bin/blob/master/lie-to-me (which sources multiple domain lists)

Steven Black's list sources from multiple lists as well. Checking out your lie-to-me project, there is actually a lot of overlap between what Steven is already pulling in and what you are getting. Looks like one of your sources 'palevotracker.abuse.ch' is discontinued and responds with a 500.

Re: WireGuard is submitted for Linux kernel inclusion

#99

Post by scott_s »

porjo wrote: post #37
nialv7 wrote: post #30

They are trying to get a completely new crypto interface into the kernel, and they are posting the patches to linux-netdev mailing list. This is not gonna fly.

> This is not gonna fly This response on the 'linux-crypto' list seems to agree: https://marc.info/?l=linux-crypto-vger&m=153310819905231

"Not gonna fly" in the sense that this maintainer doesn't want the patch as-is, but they lay out a clear set of steps the WireGuard authors can take to get it in shape for an eventual commit.

Re: WireGuard is submitted for Linux kernel inclusion

#100

Post by znpy »

swsieber wrote: post #69

So, since lots of people here have experience with VPN, I'd like to ask theoretical project question: I have distant family memebers, and it'd be nice to have a simple way to get devices on the same network easily. My initial thought would be to setup a VPN server somewhere central and fast, and then distribute wireless routers with custom firmware that they could plugin to their network. Then anything they connect t…

Certainly doable, but it really looks like the unnecessary hard way to do it.

If you set up openvpn somewhere you can just handout .ovpn files and tell your relatives to install the openvpn client on windows. Then they just have to double-click the .ovpn file and iconise "that black window that appears" (the DOS prompt window).

Post reply on HN