7 ms·

“It's been great to see Wireguard mature over the years”

86 points by zx2c4 9y ago

pedrocr 9y ago
Seems more similar to tinc[1] than to OpenVPN. How well does it overcome firewalls? I've gotten used to just setup tinc on all my machines automatically with puppet and it's really nice to have an overlay VPN over the internet that is peer-to-peer instead of having to route everything through a central server. The only thing I miss is better firewall piercing. The easiest way is to just move tinc to 443 but that won't work for servers where I actually want to serve HTTPS. [1] http://www.tinc-vpn.org/ http://www.tinc-vpn.org/
- viraptor 9y ago
  > How well does it overcome firewalls? I don't believe this is something wireguard cares about. It looks like they're aiming for doing in-kernel build-your-own routing VPN solution for servers where the networking is completely within your control. If you need a solution for privacy / working around provider limitations, then other software may be better.
  - hamandcheese 9y ago
    There is a brief section dedicated to this: https://www.wireguard.com/quickstart/#nat-and-firewall-traversal-persistence https://www.wireguard.com/quickstart/#nat-and-firewall-trave... tl;dr keepalives and the expectation of a statefull firewall keeping things open. Combined with touting IP roaming as a feature, I think it is something wireguard cares about.
- proctor 9y ago
  Have you tried ipop/social-vpn[0]? It uses libjingle (stun, turn, etc) to get through firewalls. I don't know much about it's security though, or if it has been audited. [0] http://ipop-project.org/ http://ipop-project.org/
- trizic 9y ago
  With sslh you can use port 443 for both tinc and https. https://github.com/yrutschle/sslh https://github.com/yrutschle/sslh Also you can configure haproxy to do the same.
- yjftsjthsd-h 9y ago
  Question: I've looked at tinc and really want to use it, but I have reservations about running a daemon as root on publicly accessible ports without being very confident in its security. I couldn't seem to find any mention of them ever being audited, although http://www.tinc-vpn.org/goals/ http://www.tinc-vpn.org/goals/ lists it as a goal. They do have a distinct lack of CVEs, but I can't tell if that's secure code or nobody looking. Any chance you (or another commenter) can make a case that it's safe to run tinc?
  - pedrocr 9y ago
    I hadn't looked at my config in a while and you're absolutely right, running as root is a big warning flag. Just fixed it with the tincd "--user" flag. Created a new tinc user that owns all of /etc/tinc and set "--user=tinc" in /etc/default/tinc. Runs fine.
- majewsky 9y ago
  I looked at tinc yesterday, but it seems there are two options: 1. the stable release which only supports RSA-2048 keys (giving it RSA-4096 keys resulted in really bizarre errors like "read public key file failed: Operation now in progress"), and 2. the unstable release which does not compile on my system because of broken dependencies (and even if I got it to work, I have huge reservations about using unstable releases of cryptographic systems). Am I missing something?
  - pedrocr 9y ago
    It's a small open source project that works very well for a lot of people. If you need stronger keys for your use case you'll have to wait for 1.1 to be stable. For me VPNs are not about security they're about getting connectivity working between my machines in a uniform way on top of networks that have restrictions. For security I always assume the network is hostile, even if it is my own LAN or VPN.
1_player 9y ago
Either I'm dumb or the guide on https://www.wireguard.com https://www.wireguard.com is awful. I have a VPS with StrongSwan installed, through which I connect when I need to access the internet with my server's IP. Basically, a poor sysadmin's VPN. I've heard of WireGuard, why not try it out? Now, the installation page seems pretty easy to follow, and I guess (though it's implied) WireGuard has to be installed on the server. Then the Quick Start page shows a list of routing commands, where am I supposed to run them? On the client or the server? Or, quote: wg set wg0 listen-port 51820 private-key /path/to/private-key peer ABCDEF... allowed-ips 192.168.88.0/24 endpoint 209.202.254.14:8172 What are those IPs? What's that private key file? How the heck do I install and use it? Also, the side-by-side demo doesn't load on my Safari. I'm fine RTFM and man pages, but I don't see the point of a quick start guide if it's totally cryptic for anyone that has never used WireGuard. Just tell me to RTFM and I won't bother with this guide. I guess I'll keep my StrongSwan installation, has been working without a hitch for a while now.
- zx2c4 9y ago
  Thanks for the feedback. Indeed there are the wg(8) and wg-quick(8) man pages, and probably you should read the whole _front page_ of wireguard.com, namely this part -- https://www.wireguard.com/#conceptual-overview https://www.wireguard.com/#conceptual-overview -- which gives some important conceptual overviews to learn what's going on. Probably if you don't have the conceptual overview in mind, the quickstart won't make much sense; this may indeed be a fault in the writing presumptions of the quickstart. The side-by-side video puts this -- https://www.wireguard.com/talks/talk-demo-screencast.mp4 https://www.wireguard.com/talks/talk-demo-screencast.mp4 -- in a <video> tag. I'm a kernel developer, not a web developer, so if you have a suggestion on how to fix it in your browser, I'm all ears. With all that said, we probably should rewrite the quickstart page to be a little more intuitive and "quicker", so that people can get an idea of what to do without having to understand or think about anything... Maybe a better approach for that might be: "Here's what you do on one side. Here's what you do on the other side." In any case, I guarantee that learning WireGuard is faster and simpler than learning StrongSwan or any IPsec things. After the Netdev conference, which is next week, I'll allocate some time to improving documentation. Thanks for the feedback here, and sorry for the frustration.
binaryapparatus 9y ago
Mixed feelings, some of them maybe unpopular: 1. Careful with anything that Greg KH prizes. 2. Written by zx2c4 who is very high on my 'who I can trust' list. Since #2 greatly over-weights #1 can't wait to try WireGuard.
- mediocrejoker 9y ago
  Can you elaborate on #1?
  - viraptor 9y ago
    Not OP, but I guess they meant Greg was pushing for kdbus before the idea got killed.
  - binaryapparatus 9y ago
    Exactly as other post says, kdbus and the way he tried to push it raised a few warning flags. Kernel is all about trust and I just don't trust Greg after that episode. It is all off topic since I really admire zx2c4 and this is about his product. Edit: since Greg KH got removed from the thread title any mention of him is off topic...
    - j_s 9y ago
      FWIW, it is his Google+ account in the URL. Definitely no longer obvious. Hacker News Transparency: https://hn.0x2237.club/post/15596963 https://hn.0x2237.club/post/15596963
zx2c4 9y ago
Greg KH, some others, and I had a great session stepping through every line of the codebase yesterday. Even though the codebase is quite small -- under 4k LoC -- studying some of the related topics is kind of like a fractal... Happy to answer any questions you all might have about WireGuard. We're in #wireguard on Freenode, too, if you need help with things in real-ish time. I'm also mailing out free stickers to anybody who wants some: https://lists.zx2c4.com/pipermail/wireguard/2017-May/001338.html https://lists.zx2c4.com/pipermail/wireguard/2017-May/001338.... -- just email team@wireguard.com and I'll throw them in an envelope.
- loeg 9y ago
  How strongly do you feel about the GPL2 license (edit: for the kernel pieces)? Would you be willing to dual-license it under the BSD as well?
  - zx2c4 9y ago
    The kernel code is for Linux, which is already GPLv2, so I don't think it would help you much there. The userspace implementation is also GPLv2 at the moment. What motivations do you have for desiring a BSD license? Plans to make non-free software?
    - jlgaddis 9y ago
      An in-kernel {Free,Open}BSD implementation is my first thought.
    - loeg 9y ago
      Porting to FreeBSD, where new GPL2 code in base is verboten. Whether you consider FreeBSD non-free or not is a matter of opinion. Even if the existing kernel implementation is highly tied to Linux, it is legally problematic for FreeBSD developers to reference GPL2 code while writing BSD-licensed code.
      - zx2c4 9y ago
        I think for FreeBSD kernel-land, there will have to be significant rewrites, anyway, since the Linux code is fairly Linux-specific. At some point though, I'd love to do a kernel implementation for the BSDs (in addition to the userspace one, which is coming much sooner), and I suppose you could expect for that to be BSD-licensed, appropriately.
rconti 9y ago
Context? For those of us who have never heard of Wireguard, I can click on the linked Wireguard image to at least see what it is. Cool, I guess? If it was a standalone link on HN ("hey, look what we made!") it would make a lot more sense, but since it's a G+ post, it's more about the blog-type content. I guess the main point is the discussion of merging it into the (Linux?) kernel tree, but... yeah.
- majewsky 9y ago
  Wireguard by itself has been on HN for a few times now. The newsworthy part is that one of the top kernel developers is expressing interest in bringing it into mainline, so it is appropriate to submit that post instead of the Wireguard homepage.
  - rconti 9y ago
    Thanks! I didn't realize who Greg was either, so I was missing the 2 pieces of context necessary for the post to make any sense.
- dsr_ 9y ago
  If you haven't picked it up from context: Wireguard is a VPN that provides a virtual network interface (wg0, wg1...) which can be routed, firewalled, and so forth. Notable bits: very little code, so it's easy to audit. Very few options, so it's easy to get it do what it does. Very simple config, as a result of the very few options. Basically, take all the things which drive people crazy about IPsec (all the options, all the choices, the difficulty of debugging, the multiphase negotiations, the usual policy routing rather than interface routing) and make them go away by not just choosing reasonable defaults but not even providing the capability to make different choices. Finally, it is pretty fast.
locusm 9y ago
Ive been using Wireguard on Ubiquiti routers recently - its simplicity and perf make it very attractive. Well done to the WG team.
phragma 9y ago
I did a vuejs/html5 web interface for wireguard recently and found it delightful to work with. There was a few pain points on the way, if anyone is interested in learning from my mistakes. - there is no option to specify listener ip+port tuples - logical sub-interfaces work fine, unless they happen to emit a vlan tag, then wireguard drops the traffic: ping: sendmsg: Protocol not supported - almost every virtual ethernet device in the kernel calls eth_hw_addr_random(dev); to ensure a proper link-layer address, seems to be missing in wg - "allowed-ips" cannot be turned off; when a routing table entry with a gateway address is used to specify exactly which peer some subnet should be routed to, then one has to also manually maintain an "allowed-ips" setting that contains a duplicate of the information in the routing table - when one "allowed-ips" setting is added to a peer, wg may silently remove "allowed-ips" on another, unrelated peer. this caught me by surprise while trying to connect 2 VRFs from site A to site B and C over a common tunnel infrastructure, which may have been stretching things a bit Enjoy wireguard!
- zx2c4 9y ago
  > I did a vuejs/html5 web interface for wireguard recently and found it delightful to work with. Sounds cool. Care to share? I'd love to see people's usage. > - there is no option to specify listener ip+port tuples WireGuard listens on all interfaces, because packets themselves are authenticated cryptographically. If a packet makes it to your system and the authtag is validated, it doesn't matter through what interface it arrived; it's legit. WireGuard also is able to reply using the destination address and interface of the incoming packet as the source address and interface of the outgoing packet, which is the other common usage of binding to particular IP addresses. > - logical sub-interfaces work fine, unless they happen to emit a vlan tag WireGuard is layer 3 -- IP -- not Ethernet, which is how I believe tunnels should be made. Instead of vlans, just add more tunnels if you need. > - almost every virtual ethernet device in the kernel calls eth_hw_addr_random(dev); WireGuard isn't Ethernet; it's IP. It doesn't use MAC addresses. It has public keys instead. > - "allowed-ips" cannot be turned off; Yes: the crypto key routing is the central idea of WireGuard. You establish a strong binding between public key and internal tunneled IP address, and then all your rules and policies on top of that suddenly become quite simple. > - when one "allowed-ips" setting is added to a peer, wg may silently remove "allowed-ips" on another, unrelated peer Peers can't share internal tunneled IP addresses; otherwise, there wouldn't be strong binding to public keys, nor efficiency of sending outbound packets. So if you assign an already assigned one to another peer, the presumption is that you want to _move_ the allowed IP. By always going with the newer future demand, and not erroring and staying with the old one, we ensure forward progress on your overall changes to policy. IOW, if you're changing things, we want the state to look like what you're changing it to. If you have any additional questions at this level (a great level, thanks for those), a better place to discuss is probably #wireguard on Freenode, or the mailing list -- https://lists.zx2c4.com/mailman/listinfo/wireguard https://lists.zx2c4.com/mailman/listinfo/wireguard
j_s 9y ago
What are the pros/cons comparing Wireguard and ZeroTier? Wireguard was recently mentioned as supported by the Mullvad and IVPN VPN providers. https://news.ycombinator.com/item?id=15588040 https://news.ycombinator.com/item?id=15588040 ZeroTier was part of a discussion migrating between cloud providers. https://news.ycombinator.com/item?id=15548642 https://news.ycombinator.com/item?id=15548642 Choice is great but when would either option be best? My personal use is just as a connect-back-through home VPN; I have to support mobile devices so will probably also have to use something else. Both tools seem to be finding new life as they simplify container networking setups.

86 points by zx2c4 9y ago

Seems more similar to tinc[1] than to OpenVPN. How well does it overcome firewalls? I've gotten used to just setup tinc on all my machines automatically with puppet and it's really nice to have an overlay VPN over the internet that is peer-to-peer instead of having to route everything through a central server. The only thing I miss is better firewall piercing. The easiest way is to just move tinc to 443 but that won't work for servers where I actually want to serve HTTPS. [1] http://www.tinc-vpn.org/ http://www.tinc-vpn.org/

viraptor 9y ago
> How well does it overcome firewalls? I don't believe this is something wireguard cares about. It looks like they're aiming for doing in-kernel build-your-own routing VPN solution for servers where the networking is completely within your control. If you need a solution for privacy / working around provider limitations, then other software may be better.
- hamandcheese 9y ago
  There is a brief section dedicated to this: https://www.wireguard.com/quickstart/#nat-and-firewall-traversal-persistence https://www.wireguard.com/quickstart/#nat-and-firewall-trave... tl;dr keepalives and the expectation of a statefull firewall keeping things open. Combined with touting IP roaming as a feature, I think it is something wireguard cares about.
proctor 9y ago
Have you tried ipop/social-vpn[0]? It uses libjingle (stun, turn, etc) to get through firewalls. I don't know much about it's security though, or if it has been audited. [0] http://ipop-project.org/ http://ipop-project.org/
trizic 9y ago
With sslh you can use port 443 for both tinc and https. https://github.com/yrutschle/sslh https://github.com/yrutschle/sslh Also you can configure haproxy to do the same.
yjftsjthsd-h 9y ago
Question: I've looked at tinc and really want to use it, but I have reservations about running a daemon as root on publicly accessible ports without being very confident in its security. I couldn't seem to find any mention of them ever being audited, although http://www.tinc-vpn.org/goals/ http://www.tinc-vpn.org/goals/ lists it as a goal. They do have a distinct lack of CVEs, but I can't tell if that's secure code or nobody looking. Any chance you (or another commenter) can make a case that it's safe to run tinc?
- pedrocr 9y ago
  I hadn't looked at my config in a while and you're absolutely right, running as root is a big warning flag. Just fixed it with the tincd "--user" flag. Created a new tinc user that owns all of /etc/tinc and set "--user=tinc" in /etc/default/tinc. Runs fine.
majewsky 9y ago
I looked at tinc yesterday, but it seems there are two options: 1. the stable release which only supports RSA-2048 keys (giving it RSA-4096 keys resulted in really bizarre errors like "read public key file failed: Operation now in progress"), and 2. the unstable release which does not compile on my system because of broken dependencies (and even if I got it to work, I have huge reservations about using unstable releases of cryptographic systems). Am I missing something?
- pedrocr 9y ago
  It's a small open source project that works very well for a lot of people. If you need stronger keys for your use case you'll have to wait for 1.1 to be stable. For me VPNs are not about security they're about getting connectivity working between my machines in a uniform way on top of networks that have restrictions. For security I always assume the network is hostile, even if it is my own LAN or VPN.

1_player 9y ago

Either I'm dumb or the guide on https://www.wireguard.com https://www.wireguard.com is awful. I have a VPS with StrongSwan installed, through which I connect when I need to access the internet with my server's IP. Basically, a poor sysadmin's VPN. I've heard of WireGuard, why not try it out? Now, the installation page seems pretty easy to follow, and I guess (though it's implied) WireGuard has to be installed on the server. Then the Quick Start page shows a list of routing commands, where am I supposed to run them? On the client or the server? Or, quote: wg set wg0 listen-port 51820 private-key /path/to/private-key peer ABCDEF... allowed-ips 192.168.88.0/24 endpoint 209.202.254.14:8172 What are those IPs? What's that private key file? How the heck do I install and use it? Also, the side-by-side demo doesn't load on my Safari. I'm fine RTFM and man pages, but I don't see the point of a quick start guide if it's totally cryptic for anyone that has never used WireGuard. Just tell me to RTFM and I won't bother with this guide. I guess I'll keep my StrongSwan installation, has been working without a hitch for a while now.

zx2c4 9y ago
Thanks for the feedback. Indeed there are the wg(8) and wg-quick(8) man pages, and probably you should read the whole _front page_ of wireguard.com, namely this part -- https://www.wireguard.com/#conceptual-overview https://www.wireguard.com/#conceptual-overview -- which gives some important conceptual overviews to learn what's going on. Probably if you don't have the conceptual overview in mind, the quickstart won't make much sense; this may indeed be a fault in the writing presumptions of the quickstart. The side-by-side video puts this -- https://www.wireguard.com/talks/talk-demo-screencast.mp4 https://www.wireguard.com/talks/talk-demo-screencast.mp4 -- in a <video> tag. I'm a kernel developer, not a web developer, so if you have a suggestion on how to fix it in your browser, I'm all ears. With all that said, we probably should rewrite the quickstart page to be a little more intuitive and "quicker", so that people can get an idea of what to do without having to understand or think about anything... Maybe a better approach for that might be: "Here's what you do on one side. Here's what you do on the other side." In any case, I guarantee that learning WireGuard is faster and simpler than learning StrongSwan or any IPsec things. After the Netdev conference, which is next week, I'll allocate some time to improving documentation. Thanks for the feedback here, and sorry for the frustration.

binaryapparatus 9y ago

Mixed feelings, some of them maybe unpopular: 1. Careful with anything that Greg KH prizes. 2. Written by zx2c4 who is very high on my 'who I can trust' list. Since #2 greatly over-weights #1 can't wait to try WireGuard.

mediocrejoker 9y ago
Can you elaborate on #1?
- viraptor 9y ago
  Not OP, but I guess they meant Greg was pushing for kdbus before the idea got killed.
- binaryapparatus 9y ago
  Exactly as other post says, kdbus and the way he tried to push it raised a few warning flags. Kernel is all about trust and I just don't trust Greg after that episode. It is all off topic since I really admire zx2c4 and this is about his product. Edit: since Greg KH got removed from the thread title any mention of him is off topic...
  - j_s 9y ago
    FWIW, it is his Google+ account in the URL. Definitely no longer obvious. Hacker News Transparency: https://hn.0x2237.club/post/15596963 https://hn.0x2237.club/post/15596963

zx2c4 9y ago

Greg KH, some others, and I had a great session stepping through every line of the codebase yesterday. Even though the codebase is quite small -- under 4k LoC -- studying some of the related topics is kind of like a fractal... Happy to answer any questions you all might have about WireGuard. We're in #wireguard on Freenode, too, if you need help with things in real-ish time. I'm also mailing out free stickers to anybody who wants some: https://lists.zx2c4.com/pipermail/wireguard/2017-May/001338.html https://lists.zx2c4.com/pipermail/wireguard/2017-May/001338.... -- just email team@wireguard.com and I'll throw them in an envelope.

loeg 9y ago
How strongly do you feel about the GPL2 license (edit: for the kernel pieces)? Would you be willing to dual-license it under the BSD as well?
- zx2c4 9y ago
  The kernel code is for Linux, which is already GPLv2, so I don't think it would help you much there. The userspace implementation is also GPLv2 at the moment. What motivations do you have for desiring a BSD license? Plans to make non-free software?
  - jlgaddis 9y ago
    An in-kernel {Free,Open}BSD implementation is my first thought.
  - loeg 9y ago
    Porting to FreeBSD, where new GPL2 code in base is verboten. Whether you consider FreeBSD non-free or not is a matter of opinion. Even if the existing kernel implementation is highly tied to Linux, it is legally problematic for FreeBSD developers to reference GPL2 code while writing BSD-licensed code.
    - zx2c4 9y ago
      I think for FreeBSD kernel-land, there will have to be significant rewrites, anyway, since the Linux code is fairly Linux-specific. At some point though, I'd love to do a kernel implementation for the BSDs (in addition to the userspace one, which is coming much sooner), and I suppose you could expect for that to be BSD-licensed, appropriately.

rconti 9y ago

Context? For those of us who have never heard of Wireguard, I can click on the linked Wireguard image to at least see what it is. Cool, I guess? If it was a standalone link on HN ("hey, look what we made!") it would make a lot more sense, but since it's a G+ post, it's more about the blog-type content. I guess the main point is the discussion of merging it into the (Linux?) kernel tree, but... yeah.

majewsky 9y ago
Wireguard by itself has been on HN for a few times now. The newsworthy part is that one of the top kernel developers is expressing interest in bringing it into mainline, so it is appropriate to submit that post instead of the Wireguard homepage.
- rconti 9y ago
  Thanks! I didn't realize who Greg was either, so I was missing the 2 pieces of context necessary for the post to make any sense.
dsr_ 9y ago
If you haven't picked it up from context: Wireguard is a VPN that provides a virtual network interface (wg0, wg1...) which can be routed, firewalled, and so forth. Notable bits: very little code, so it's easy to audit. Very few options, so it's easy to get it do what it does. Very simple config, as a result of the very few options. Basically, take all the things which drive people crazy about IPsec (all the options, all the choices, the difficulty of debugging, the multiphase negotiations, the usual policy routing rather than interface routing) and make them go away by not just choosing reasonable defaults but not even providing the capability to make different choices. Finally, it is pretty fast.

locusm 9y ago

Ive been using Wireguard on Ubiquiti routers recently - its simplicity and perf make it very attractive. Well done to the WG team.

phragma 9y ago

I did a vuejs/html5 web interface for wireguard recently and found it delightful to work with. There was a few pain points on the way, if anyone is interested in learning from my mistakes. - there is no option to specify listener ip+port tuples - logical sub-interfaces work fine, unless they happen to emit a vlan tag, then wireguard drops the traffic: ping: sendmsg: Protocol not supported - almost every virtual ethernet device in the kernel calls eth_hw_addr_random(dev); to ensure a proper link-layer address, seems to be missing in wg - "allowed-ips" cannot be turned off; when a routing table entry with a gateway address is used to specify exactly which peer some subnet should be routed to, then one has to also manually maintain an "allowed-ips" setting that contains a duplicate of the information in the routing table - when one "allowed-ips" setting is added to a peer, wg may silently remove "allowed-ips" on another, unrelated peer. this caught me by surprise while trying to connect 2 VRFs from site A to site B and C over a common tunnel infrastructure, which may have been stretching things a bit Enjoy wireguard!

zx2c4 9y ago
> I did a vuejs/html5 web interface for wireguard recently and found it delightful to work with. Sounds cool. Care to share? I'd love to see people's usage. > - there is no option to specify listener ip+port tuples WireGuard listens on all interfaces, because packets themselves are authenticated cryptographically. If a packet makes it to your system and the authtag is validated, it doesn't matter through what interface it arrived; it's legit. WireGuard also is able to reply using the destination address and interface of the incoming packet as the source address and interface of the outgoing packet, which is the other common usage of binding to particular IP addresses. > - logical sub-interfaces work fine, unless they happen to emit a vlan tag WireGuard is layer 3 -- IP -- not Ethernet, which is how I believe tunnels should be made. Instead of vlans, just add more tunnels if you need. > - almost every virtual ethernet device in the kernel calls eth_hw_addr_random(dev); WireGuard isn't Ethernet; it's IP. It doesn't use MAC addresses. It has public keys instead. > - "allowed-ips" cannot be turned off; Yes: the crypto key routing is the central idea of WireGuard. You establish a strong binding between public key and internal tunneled IP address, and then all your rules and policies on top of that suddenly become quite simple. > - when one "allowed-ips" setting is added to a peer, wg may silently remove "allowed-ips" on another, unrelated peer Peers can't share internal tunneled IP addresses; otherwise, there wouldn't be strong binding to public keys, nor efficiency of sending outbound packets. So if you assign an already assigned one to another peer, the presumption is that you want to _move_ the allowed IP. By always going with the newer future demand, and not erroring and staying with the old one, we ensure forward progress on your overall changes to policy. IOW, if you're changing things, we want the state to look like what you're changing it to. If you have any additional questions at this level (a great level, thanks for those), a better place to discuss is probably #wireguard on Freenode, or the mailing list -- https://lists.zx2c4.com/mailman/listinfo/wireguard https://lists.zx2c4.com/mailman/listinfo/wireguard

j_s 9y ago

What are the pros/cons comparing Wireguard and ZeroTier? Wireguard was recently mentioned as supported by the Mullvad and IVPN VPN providers. https://news.ycombinator.com/item?id=15588040 https://news.ycombinator.com/item?id=15588040 ZeroTier was part of a discussion migrating between cloud providers. https://news.ycombinator.com/item?id=15548642 https://news.ycombinator.com/item?id=15548642 Choice is great but when would either option be best? My personal use is just as a connect-back-through home VPN; I have to support mobile devices so will probably also have to use something else. Both tools seem to be finding new life as they simplify container networking setups.