8 ms·

WireGuard: fast, modern, secure VPN tunnel

227 points by jermaustin1 9y ago

atonse 9y ago
I can't wait for WireGuard to take over the VPN world :-) The whole solution just seems so elegant. It's just not at the point where I can download a GUI app and press one button to just connect. Waiting for that to happen.
- vbezhenar 9y ago
  I think that it would be hard for WireGuard to take over the VPN world. IPsec works virtually everywhere without any additional software. OpenVPN is easier to setup and have many mature clients for every platform, so if you require custom software, why would anyone choose something new, when you have proven and popular OpenVPN. I'm sure that WireGuard has some advantages, but I'm still skeptical. That said, IPsec is astonishingly hard to setup and diagnose. Recently I installed strongswan on my server and Windows 10 is my client. I didn't figure out how to send intermediate letsencrypt certificate to Windows 10, it wasn't accepting connections without installing intermediate certificate as trusted and I tried very hard, I'm sure that strongswan configuration is correct (I put intermediate certificates into cacerts and it works on macOS). It's especially fun with very little and cryptic information from Windows 10. Now when connection was finally established, routes were not set properly. It turned out that configuring connection via GUI was not enough, I had to change some connection property via powershell script, so client would receive routes from server. Yes, VPN isn't very easy to setup, at least for casual use. But in the end it worked and I don't see any reason to switch.
  - atonse 9y ago
    OpenVPN is easier to setup than what exactly? I found OpenVPN to just feel VERY VERY clunky. The clients look ugly and unpolished. Before anyone says that's superficial, I do think it shows a lack of attention to detail. Setting up the server also wasn't terribly easy (it wasn't too hard either for someone like me who's used Linux for many years). I think most of OpenVPN's value has come from the fact that it's the last difficult of solutions to implement. For the record, I wasn't claiming that WireGuard was this easy to setup. But I think the mentality of WireGuard is simplicity. I think it's only a matter of time before someone DOES implement a single click client/server with it. Right now I use Algo, which is just an excellent set of scripts used to setup VPN servers. This way I don't have to use OpenVPN, and I can actually use IPSec with built-in OS clients. Update: Also I'd like to add that WireGuard just feels like the kind of thing Apple would've implemented in their OS 10 years ago. But Apple today wouldn't. They just seem to be barely treading water in their MacOS group.
    - cdancette 9y ago
      Some openvpn providers just give you a conf file that you import in your client, and that's all you need
      - iamnotlarry 9y ago
        You could do the same with wireguard, only the conf file would be about 6 lines of text. And you can understand the obvious purpose of each line.
    - vbezhenar 9y ago
      > OpenVPN is easier to setup than what exactly? Definitely it was easier than strongswan for me. Documentation is clear, a lot of guides, AFAIK there's a single implementation, so no interoperation quirks, logging is actually useful. Client setup is a single .ovpn file which contains everything and installed using double-click or similar method. I guess that setting up a custom CA is the hardest part of setup and I just happen to work a lot with certificates, so it wasn't hard for me, everything else is as easy as any server software. > I found OpenVPN to just feel VERY VERY clunky. The clients look ugly and unpolished. I used paid software (Viscosity) for macOS, it was quite good IMO. I used official software for iOS, it worked without any problems. I'm not really sure what's ugly about VPN client, it's systems software, it should display icon in tray and allow to connect/disconnect, that's all. I remember that my friend had issues with OpenVPN official client on Windows laptop with hibernate, but I think he just had to restart connection, not that big of an issue. > For the record, I wasn't claiming that WireGuard was this easy to setup. But I think the mentality of WireGuard is simplicity. I think it's only a matter of time before someone DOES implement a single click client/server with it. Right now I use Algo, which is just an excellent set of scripts used to setup VPN servers. This way I don't have to use OpenVPN, and I can actually use IPSec with built-in OS clients. While I won't use any "single click" solutions unless I made them personally, I saw scripts which claim to install OpenVPN or IPsec automatically with absolutely minimal interaction. They had a lot of stars, so I guess they works. But if there's something that Wireguard could do better, that's good. It's still too hard for non-technical user to buy cheap VPS and setup his personal VPN with adequate security.
    - 9y ago
  - arghwhat 9y ago
    Having relied on both OpenVPN and IPSEC in the past, I can tell you that configuring WireGuard is several orders of magnitude simpler. It's outright easy (OpenVPN is difficult, IPSEC is a smoking pile of horsedung). Furthermore, with the intention of being mainlined (it is currently available as a DKMS-powered package), wireguard will end up being universally available in the Linux world (other platforms will for now rely on user-space implementations). The availability of ipsec, much easier to configure than openvpn, better crypto, and flexibility that none of the existing options can match, such as full IP change resilience (as long as only one end change at a time) and connection persistence. It makes you wonder why VPN's have been so bad for so long.
  - blacksmith_tb 9y ago
    There are some useful tools for setting up your own VPN server - I like Streisand[1] (which includes Wireguard), and I have heard good things about Algo[2], though I haven't used it. 1: https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand 2: https://github.com/trailofbits/algo https://github.com/trailofbits/algo
    - atonse 9y ago
      I've used Algo and it's worked flawlessly for me.
  - api 9y ago
    > IPsec is astonishingly hard to setup and diagnose It often seems to me that networking people like things to be hard and obtuse. Almost everything in networking seems more complex than it needs to be.
    - deleted 9y ago
      [deleted]
  - cm2187 9y ago
    Agree on IPsec being hard to setup. I would add to that that OpenVPN on windows has serious performance issues. It is hard to exceed 5 MB/s. I believe that issues only affects the windows implementation.
- craftyguy 9y ago
  IMHO, it needs to be merged into the Linux kernel before it will have a chance. (yes, I know this doesn't apply to users of other OSes)
pvg 9y ago
Previously: https://hn.algolia.com/?query=wireguard&sort=byDate&prefix=false&page=0&dateRange=all&type=story https://hn.algolia.com/?query=wireguard&sort=byDate&prefix=f...
- emmelaich 9y ago
  In particular, the first, which seems to have the most comments. https://news.ycombinator.com/item?id=11994265 https://news.ycombinator.com/item?id=11994265
DyslexicAtheist 9y ago
the WireGuard protocol has recently been formerly verified and findings are worth checking: - https://www.reddit.com/r/linux/comments/7sh3k7/analysis_of_the_wireguard_vpn_protocol_is_now/ https://www.reddit.com/r/linux/comments/7sh3k7/analysis_of_t... has anyone done MFA with it yet?
- yjftsjthsd-h 9y ago
  Multi-factor Authentication? How would you do that with a system that is explicitly designed to use asymmetric keys?
  - DyslexicAtheist 9y ago
    see discussion https://lists.zx2c4.com/pipermail/wireguard/2017-September/001753.html https://lists.zx2c4.com/pipermail/wireguard/2017-September/0...
    - yjftsjthsd-h 9y ago
      Ah, clever. Thanks for link
cocacola1 9y ago
There was a recent FLOSS Weekly episode with the developer. I thought it was an interesting listen. https://twit.tv/shows/floss-weekly/episodes/468 https://twit.tv/shows/floss-weekly/episodes/468
tptacek 9y ago
Also discussed here: https://news.ycombinator.com/item?id=16326236 https://news.ycombinator.com/item?id=16326236 (presumably that's why it's on the front page today)
OrwellianChild 9y ago
At risk of thread-jacking, may I ask: Why, when, and where should I be using a VPN to practice good, secure use of online content/resources? I learned a lot from running through 2FA and security practices as explained at Tech Solidarity [1], but I'm still not clear on where VPNs should fit into my workflow on desktop, laptop, and mobile. [1] https://techsolidarity.org/resources/basic_security.htm https://techsolidarity.org/resources/basic_security.htm
- zcid 9y ago
  I generally use a VPN 100% of the time on my laptop. It doesn't provide a ton of extra privacy by itself, but it combines my traffic with that of a large numbers of others. And by using browser extensions such as ublock, umatrix, and privacy badger, I can feel a little more peace of mind about being constantly watched. On mobile, it's a different story. I'm not sure about iOS, but on unrooted Android phones, I don't believe there is a way to route IPv6 traffic over a VPN so you are a bit more limited from information gathering via that route. Also, VPN clients eat a lot of battery so useability goes down. My solution for that is to limit my use of mobile devices. Edit: clarified a statement
  - BatFastard 9y ago
    Could always use a burner too.
- tptacek 9y ago
  I would be careful about using VPNs ever. For the most part, the truism about VPN services is accurate: VPN services give you all the security of coffee shop wifi, but in the cloud. If you're going to use a VPN, you need to set up your own server. This will probably mean picking a cloud provider to trust, which isn't a fun problem (although it has a simple answer: use AWS). You'll need to set up the serverside to whatever VPN you choose to use on that cloud server. For this problem, the gold standard is still Trail of Bits's Algo. Hopefully sometime this year we'll get to the point where Algo sets up WireGuard for people on Macbooks and Windows machines. In the meantime, if you don't know what you're doing or how to set up a VPN, I'd use Algo's strongSwan rather than a shared WireGuard provider.
balnaphone 9y ago
Note for users in China: you'll still need Shadowsocks in your stack (e.g. shadowsocks + CN2 + dns crypt/mask + IPv6 tunneling), since WireGuard is vulnerable to "deep packet inspection" and this is not a priority for WireGuard, as the author makes clear here: https://lists.zx2c4.com/pipermail/wireguard/2016-July/000184.html https://lists.zx2c4.com/pipermail/wireguard/2016-July/000184... If anyone has more recent information on dealing with the Great Firewall, I'd love to hear it.
- Godel_unicode 9y ago
  I can't imagine shadowsocks will continue to work for long. There's not much traffic like that on the Internet, meaning it is extremely susceptible to identification via machine learning. Add on all the opsec problems associated with point-to-point VPN tunnels and you're going to have a bad time. See also: https://github.com/madeye/sssniff https://github.com/madeye/sssniff
  - yjftsjthsd-h 9y ago
    It looks like sssniff just checks whether a handful of packets are smaller size than expected; isn't that completely trivial to fix? Granted, it's one step in a long game of cat-and-mouse.
    - Godel_unicode 9y ago
      Not really, it's actually measuring entropy of the first few payloads. This is one example of the larger problem; typical wire protocols, even privacy focused ones like TLS/IPsec, tend to have some red content before the black starts. If your goal is to hide in the noise, the best way is to find a source of noise and sound like it. Just being quiet doesn't do it. Edit: nvm, can't get the code to paste. Look at the if elif elif elif block at the end.
locusm 9y ago
If you're using Ubiquiti Edgemax routers there are Wireguard packages that work very well for site to site VPN's.
- zx2c4 9y ago
  Found here: https://github.com/Lochnair/vyatta-wireguard#vyatta-wireguard https://github.com/Lochnair/vyatta-wireguard#vyatta-wireguar... and https://community.ubnt.com/t5/EdgeMAX/Release-WireGuard-for-EdgeRouter/td-p/1904764 https://community.ubnt.com/t5/EdgeMAX/Release-WireGuard-for-...
  - atmosx 9y ago
    This should work with USG routers too right?
- mmarquezs 9y ago
  Nice. I recently bought an edgerouter X and I set it up with openvpn. I have to try this.
johnklos 9y ago
...for one specific OS... Or a userspace implementation written in difficult to bootstrap languages...
minicoolva 9y ago
Softether can use in China
arcaster 9y ago
Is there an equivalent to WireGaurd that can be used on Android or IOS?
- solnyshok 9y ago
  kernel module needs to be integrated into custom Android ROM

227 points by jermaustin1 9y ago

I can't wait for WireGuard to take over the VPN world :-) The whole solution just seems so elegant. It's just not at the point where I can download a GUI app and press one button to just connect. Waiting for that to happen.

vbezhenar 9y ago
I think that it would be hard for WireGuard to take over the VPN world. IPsec works virtually everywhere without any additional software. OpenVPN is easier to setup and have many mature clients for every platform, so if you require custom software, why would anyone choose something new, when you have proven and popular OpenVPN. I'm sure that WireGuard has some advantages, but I'm still skeptical. That said, IPsec is astonishingly hard to setup and diagnose. Recently I installed strongswan on my server and Windows 10 is my client. I didn't figure out how to send intermediate letsencrypt certificate to Windows 10, it wasn't accepting connections without installing intermediate certificate as trusted and I tried very hard, I'm sure that strongswan configuration is correct (I put intermediate certificates into cacerts and it works on macOS). It's especially fun with very little and cryptic information from Windows 10. Now when connection was finally established, routes were not set properly. It turned out that configuring connection via GUI was not enough, I had to change some connection property via powershell script, so client would receive routes from server. Yes, VPN isn't very easy to setup, at least for casual use. But in the end it worked and I don't see any reason to switch.
- atonse 9y ago
  OpenVPN is easier to setup than what exactly? I found OpenVPN to just feel VERY VERY clunky. The clients look ugly and unpolished. Before anyone says that's superficial, I do think it shows a lack of attention to detail. Setting up the server also wasn't terribly easy (it wasn't too hard either for someone like me who's used Linux for many years). I think most of OpenVPN's value has come from the fact that it's the last difficult of solutions to implement. For the record, I wasn't claiming that WireGuard was this easy to setup. But I think the mentality of WireGuard is simplicity. I think it's only a matter of time before someone DOES implement a single click client/server with it. Right now I use Algo, which is just an excellent set of scripts used to setup VPN servers. This way I don't have to use OpenVPN, and I can actually use IPSec with built-in OS clients. Update: Also I'd like to add that WireGuard just feels like the kind of thing Apple would've implemented in their OS 10 years ago. But Apple today wouldn't. They just seem to be barely treading water in their MacOS group.
  - cdancette 9y ago
    Some openvpn providers just give you a conf file that you import in your client, and that's all you need
    - iamnotlarry 9y ago
      You could do the same with wireguard, only the conf file would be about 6 lines of text. And you can understand the obvious purpose of each line.
  - vbezhenar 9y ago
    > OpenVPN is easier to setup than what exactly? Definitely it was easier than strongswan for me. Documentation is clear, a lot of guides, AFAIK there's a single implementation, so no interoperation quirks, logging is actually useful. Client setup is a single .ovpn file which contains everything and installed using double-click or similar method. I guess that setting up a custom CA is the hardest part of setup and I just happen to work a lot with certificates, so it wasn't hard for me, everything else is as easy as any server software. > I found OpenVPN to just feel VERY VERY clunky. The clients look ugly and unpolished. I used paid software (Viscosity) for macOS, it was quite good IMO. I used official software for iOS, it worked without any problems. I'm not really sure what's ugly about VPN client, it's systems software, it should display icon in tray and allow to connect/disconnect, that's all. I remember that my friend had issues with OpenVPN official client on Windows laptop with hibernate, but I think he just had to restart connection, not that big of an issue. > For the record, I wasn't claiming that WireGuard was this easy to setup. But I think the mentality of WireGuard is simplicity. I think it's only a matter of time before someone DOES implement a single click client/server with it. Right now I use Algo, which is just an excellent set of scripts used to setup VPN servers. This way I don't have to use OpenVPN, and I can actually use IPSec with built-in OS clients. While I won't use any "single click" solutions unless I made them personally, I saw scripts which claim to install OpenVPN or IPsec automatically with absolutely minimal interaction. They had a lot of stars, so I guess they works. But if there's something that Wireguard could do better, that's good. It's still too hard for non-technical user to buy cheap VPS and setup his personal VPN with adequate security.
  - 9y ago
- arghwhat 9y ago
  Having relied on both OpenVPN and IPSEC in the past, I can tell you that configuring WireGuard is several orders of magnitude simpler. It's outright easy (OpenVPN is difficult, IPSEC is a smoking pile of horsedung). Furthermore, with the intention of being mainlined (it is currently available as a DKMS-powered package), wireguard will end up being universally available in the Linux world (other platforms will for now rely on user-space implementations). The availability of ipsec, much easier to configure than openvpn, better crypto, and flexibility that none of the existing options can match, such as full IP change resilience (as long as only one end change at a time) and connection persistence. It makes you wonder why VPN's have been so bad for so long.
- blacksmith_tb 9y ago
  There are some useful tools for setting up your own VPN server - I like Streisand[1] (which includes Wireguard), and I have heard good things about Algo[2], though I haven't used it. 1: https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand 2: https://github.com/trailofbits/algo https://github.com/trailofbits/algo
  - atonse 9y ago
    I've used Algo and it's worked flawlessly for me.
- api 9y ago
  > IPsec is astonishingly hard to setup and diagnose It often seems to me that networking people like things to be hard and obtuse. Almost everything in networking seems more complex than it needs to be.
  - deleted 9y ago
    [deleted]
- cm2187 9y ago
  Agree on IPsec being hard to setup. I would add to that that OpenVPN on windows has serious performance issues. It is hard to exceed 5 MB/s. I believe that issues only affects the windows implementation.
craftyguy 9y ago
IMHO, it needs to be merged into the Linux kernel before it will have a chance. (yes, I know this doesn't apply to users of other OSes)

pvg 9y ago

Previously: https://hn.algolia.com/?query=wireguard&sort=byDate&prefix=false&page=0&dateRange=all&type=story https://hn.algolia.com/?query=wireguard&sort=byDate&prefix=f...

emmelaich 9y ago
In particular, the first, which seems to have the most comments. https://news.ycombinator.com/item?id=11994265 https://news.ycombinator.com/item?id=11994265

DyslexicAtheist 9y ago

the WireGuard protocol has recently been formerly verified and findings are worth checking: - https://www.reddit.com/r/linux/comments/7sh3k7/analysis_of_the_wireguard_vpn_protocol_is_now/ https://www.reddit.com/r/linux/comments/7sh3k7/analysis_of_t... has anyone done MFA with it yet?

yjftsjthsd-h 9y ago
Multi-factor Authentication? How would you do that with a system that is explicitly designed to use asymmetric keys?
- DyslexicAtheist 9y ago
  see discussion https://lists.zx2c4.com/pipermail/wireguard/2017-September/001753.html https://lists.zx2c4.com/pipermail/wireguard/2017-September/0...
  - yjftsjthsd-h 9y ago
    Ah, clever. Thanks for link

cocacola1 9y ago

There was a recent FLOSS Weekly episode with the developer. I thought it was an interesting listen. https://twit.tv/shows/floss-weekly/episodes/468 https://twit.tv/shows/floss-weekly/episodes/468

tptacek 9y ago

Also discussed here: https://news.ycombinator.com/item?id=16326236 https://news.ycombinator.com/item?id=16326236 (presumably that's why it's on the front page today)

OrwellianChild 9y ago

At risk of thread-jacking, may I ask: Why, when, and where should I be using a VPN to practice good, secure use of online content/resources? I learned a lot from running through 2FA and security practices as explained at Tech Solidarity [1], but I'm still not clear on where VPNs should fit into my workflow on desktop, laptop, and mobile. [1] https://techsolidarity.org/resources/basic_security.htm https://techsolidarity.org/resources/basic_security.htm

zcid 9y ago
I generally use a VPN 100% of the time on my laptop. It doesn't provide a ton of extra privacy by itself, but it combines my traffic with that of a large numbers of others. And by using browser extensions such as ublock, umatrix, and privacy badger, I can feel a little more peace of mind about being constantly watched. On mobile, it's a different story. I'm not sure about iOS, but on unrooted Android phones, I don't believe there is a way to route IPv6 traffic over a VPN so you are a bit more limited from information gathering via that route. Also, VPN clients eat a lot of battery so useability goes down. My solution for that is to limit my use of mobile devices. Edit: clarified a statement
- BatFastard 9y ago
  Could always use a burner too.
tptacek 9y ago
I would be careful about using VPNs ever. For the most part, the truism about VPN services is accurate: VPN services give you all the security of coffee shop wifi, but in the cloud. If you're going to use a VPN, you need to set up your own server. This will probably mean picking a cloud provider to trust, which isn't a fun problem (although it has a simple answer: use AWS). You'll need to set up the serverside to whatever VPN you choose to use on that cloud server. For this problem, the gold standard is still Trail of Bits's Algo. Hopefully sometime this year we'll get to the point where Algo sets up WireGuard for people on Macbooks and Windows machines. In the meantime, if you don't know what you're doing or how to set up a VPN, I'd use Algo's strongSwan rather than a shared WireGuard provider.

balnaphone 9y ago

Note for users in China: you'll still need Shadowsocks in your stack (e.g. shadowsocks + CN2 + dns crypt/mask + IPv6 tunneling), since WireGuard is vulnerable to "deep packet inspection" and this is not a priority for WireGuard, as the author makes clear here: https://lists.zx2c4.com/pipermail/wireguard/2016-July/000184.html https://lists.zx2c4.com/pipermail/wireguard/2016-July/000184... If anyone has more recent information on dealing with the Great Firewall, I'd love to hear it.

Godel_unicode 9y ago
I can't imagine shadowsocks will continue to work for long. There's not much traffic like that on the Internet, meaning it is extremely susceptible to identification via machine learning. Add on all the opsec problems associated with point-to-point VPN tunnels and you're going to have a bad time. See also: https://github.com/madeye/sssniff https://github.com/madeye/sssniff
- yjftsjthsd-h 9y ago
  It looks like sssniff just checks whether a handful of packets are smaller size than expected; isn't that completely trivial to fix? Granted, it's one step in a long game of cat-and-mouse.
  - Godel_unicode 9y ago
    Not really, it's actually measuring entropy of the first few payloads. This is one example of the larger problem; typical wire protocols, even privacy focused ones like TLS/IPsec, tend to have some red content before the black starts. If your goal is to hide in the noise, the best way is to find a source of noise and sound like it. Just being quiet doesn't do it. Edit: nvm, can't get the code to paste. Look at the if elif elif elif block at the end.

locusm 9y ago

If you're using Ubiquiti Edgemax routers there are Wireguard packages that work very well for site to site VPN's.

zx2c4 9y ago
Found here: https://github.com/Lochnair/vyatta-wireguard#vyatta-wireguard https://github.com/Lochnair/vyatta-wireguard#vyatta-wireguar... and https://community.ubnt.com/t5/EdgeMAX/Release-WireGuard-for-EdgeRouter/td-p/1904764 https://community.ubnt.com/t5/EdgeMAX/Release-WireGuard-for-...
- atmosx 9y ago
  This should work with USG routers too right?
mmarquezs 9y ago
Nice. I recently bought an edgerouter X and I set it up with openvpn. I have to try this.

johnklos 9y ago

...for one specific OS... Or a userspace implementation written in difficult to bootstrap languages...

minicoolva 9y ago

Softether can use in China

arcaster 9y ago

Is there an equivalent to WireGaurd that can be used on Android or IOS?

solnyshok 9y ago
kernel module needs to be integrated into custom Android ROM