Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

lists.zx2c4.com

Post reply on HN
Print view View original

91–100 of 187 posts

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#91

Post by compressedgas »

bpye wrote: post #88
compressedgas wrote: post #87

Earlier quoted context omitted.

Have you tried connecting two computers with just a patch cable? With the auto-sensing Ethernet ports, it works as if the cable were a crossover cable.

I believe this is only true for gigabit - though almost any device today should be?

I'll admit that I don't know if it would have worked then. And it has only been recently that I have got two computers which both have gigabit ports. I don't remember ever using a crossover cable as I always had a switch. I do remember having to manually assign IP addresses in that configuration as it didn't have a DHCP server to assign them.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#92

Post by YPPH »

ec109685 wrote: post #76

Any thought if Windows will embed this natively similar to how Linux pulled WireGuard into the kernel?

Licensing issues aside, do we really want to rely on Microsoft to keep it up to date? I can imagine it becoming quickly outdated, particularly in enterprise skews.

I think it's best left to the Wireguard team and not Redmond.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#93

Post by YPPH »

The Wireguard team are simply brilliant. It's incredible how they have developed low-level, cross-platform solutions across Linux, OpenBSD, FreeBSD and now Windows.

I think they are truly exceptional programmers. It's hard to think of people who have come anywhere close to such an achievement.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#94

Post by nightfly »

1vuio0pswjnm7 wrote: post #85
jiggawatts wrote: post #84

For reference, I've never seen the built-in Windows VPN protocols exceed ~70 Mbps in any scenario. Maybe it's possible with a crossover cable between two Mellanox 100 Gbps NICs, using water-cooled and overclocked CPUs, but not over ordinary networks with ordinary servers. I have gigabit wired Internet to a site with gigabit Internet. Typical performance of SSTP or IKEv2 is 15-30 Mbps. That's 1.5% to 3% max utilisatio…

"... with a crossover cable..." Many years ago, I once brought a crossover cable from home to the office to do some data transfer from a workstation to a company-issued laptop. The IT department issuing the laptop, being lovers of all things Microsoft, claimed crossover cable was "obsolete" due to auto-sensing used by Windows. I am just another dumb end user, I do not work in IT, but I still get faster data transfer…

As a sibling comment alluded to; the _crossover_ cable was obsolete, not the the ethernet cable. You can usually use a straight ethernet cable with modern devices, you don't need a crossover cable. The auto-sensing they were talking about is what's built into the NIC, and it detects how the pairs of pins in your cable are being used.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#95

Post by perryizgr8 »

netr0ute wrote: post #47
basch wrote: post #34

Earlier quoted context omitted.

dramatically simpler than IPsec. IPSec is Internet Layer, while TLS/SSL (OpenSSL) are Application Layer

>IPSec is Internet Layer Technically not, since IPSec can also be tunneled over UDP which then turns it into an application layer protocol.

I don't think it works like that. Vxlan can tunnel ethernet frames over UDP, but that doesn't make Ethernet an application layer protocol.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#96

Post by hackmiester »

bpye wrote: post #88
compressedgas wrote: post #87

Earlier quoted context omitted.

Have you tried connecting two computers with just a patch cable? With the auto-sensing Ethernet ports, it works as if the cable were a crossover cable.

I believe this is only true for gigabit - though almost any device today should be?

Not all auto-MDIX ports are gigabit, but almost all gigabit ports have auto-MDIX.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#97

Post by fomine3 »

midasuni wrote: post #58
bob1029 wrote: post #41

This is exciting to me. I have tripped over every VPN technology listed on Wikipedia at one point or another during my career. Always open to something better. I think IPSec or OpenVPN are probably the opposite of what WG is offering here... Microsoft's SSTP offering is actually not causing me any major frustration at the moment. I almost like using it. But, seeing these other comments telling tales of 600 megabit VP…

I had an sstp tunnel refuse to establish a few weeks ago. WireGuard was fine. Turns out the provider was MITMing tcp/443 traffic

It's interesting that such "provider" (I assume corporate network, rather than consumer ISP) allows traffic on WireGuard UDP port.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#98

Post by tptacek »

starfallg wrote: post #82
tptacek wrote: post #55

Earlier quoted context omitted.

I think you could reasonably look at WireGuard as a repudiation of previous VPN protocols, almost from root to branch. For instance, WireGuard reconsiders what the role of a VPN "protocol" actually is, and in WireGuard the protocol itself delivers a point-to-point secure tunnel and nothing else, so that the system is composable with multiple different upper-level designs (for instance, how you mesh up with multiple e…

Wireguard isn't so different from previous protocols establishing encrypted tunnels. Functionally it's IPSEC tunnel mode with all the complexities of IPSEC removed. With a bit of multipoint goodness (ala DMVPN) sprinkled in. The reason why it's hyped is because it's a non-encumbered, gratis, libre, fast replacement for OpenVPN. Yes, it doesn't handle algorithm negotiation. So if there's something wrong with the algor…

No, I think this is essentially wrong. It's hyped because it:

(a) Doesn't have selectable or negotiable algorithms and constructions.

(b) Exclusively uses modern constructions everybody trusts.

(c) Has a minuscule implementation footprint, designed in part to avoid dynamic allocation altogether, that is straightforward to audit.

(d) As a result of all of this, it is very fast.

(e) As a result of all of this, software security and cryptography engineers generally trust it more than any alternative protocol.

(f) As a result of all of this, it is absurdly simple to configure and get running.

Yes, IPSEC does a bunch of stuff WireGuard doesn't do. Yes, that's the tradeoff WireGuard made. Making that tradeoff is (a) the point of WireGuard and (b) the reason people like it so much.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#100

Post by psanford »

lights0123 wrote: post #72
simcop2387 wrote: post #69

Earlier quoted context omitted.

It's more like client certs with tls that are signed by the server's key I believe.

Nope. You have a private and public key per connection.

Generally, you have a keypair per host, not per connection.
Post reply on HN