9 ms·

TunSafe WireGuard Client for OS X

85 points by ludde 9y ago

dminor 9y ago
I've seen WireGuard recommended here pretty strongly, so I started looking into it, but I couldn't see exactly how it could replace OpenVPN for us. We have an OpenVPN bastion for access into our VPC, and each engineer has their own key. When someone leaves, we can revoke their key. But WireGuard seems to use a single key per network interface. Would we just create an interface for every engineer (I have no idea what the limits are on these - maybe they're cheap)? Or is this just not a good use case for WireGuard?
- deleted 9y ago
  [deleted]
- agnuacc 9y ago
  IIRC, the wireguard server's config file has defined peers (clients) so you could just remove the peer pubkey from the config file and they would no longer be able to connect.
- baobrien 9y ago
  With WireGuard you have one public/private key pair for that interface, and a list of public keys for trusted peers. Access management would still be about the same -- each engineer would have a key pair, and you'd have the public key on the trusted list of the host side.
- deleted 9y ago
  [deleted]
- dsacco 9y ago
  > But WireGuard seems to use a single key per network interface. Every interface is associated with a public/private key pair, but each interface need not peer with a single client. That would be inefficient. Instead, each peer (including clients and the server) generates a personal key pair when they configure their local WireGuard (e.g. wg0) interface. Afterwards they set up a local configuration file consisting of peers and respective public keys. Then in the context of a company VPN, one peer is a designated server, and every other (client) peer lists the server’s remote IP as the only peer interface in their local configuration. The server has the public key of every client as respective entries in its local config file, which is used to restrict access to whitelisted clients. Any client with the corresponding private key locally can connect to the server’s interface using their local interface. To remove a client from the white list, you simply remove their peer entry from the local config file on the server, much like how you remove an SSH public key from authorized_keys. In fact, a decent mental model for WireGuard is tuennling over SSH, but faster, leaner and with no option for a shell or password login.
- lvh 9y ago
  Each network interface has a key pair associated with it, but it can pair with any number of other interfaces (having a pubkey for each). This is similar to how OpenVPN presumably works for you: each OpenVPN network device on your developers' laptops comes with a certificate they use to authenticate to you. So yes: there's one interface per engineer laptop, but that's already the case. There's only one remote interface though. (Or several, if you want to have several VPNs -- Wireguard makes that pretty easy too!)
rumpelsepp 9y ago
Here is some discussion about tunsafe. https://lists.zx2c4.com/pipermail/wireguard/2018-March/002448.html https://lists.zx2c4.com/pipermail/wireguard/2018-March/00244...
- eps 9y ago
  That's not a "discussion", but a nasty spiteful post full of extreme, but baseless allegations.
  - marten-de-vries 9y ago
    That's not the whole story. There are further responses in that thread, including the opposing viewpoint from the TunSafe author. * https://lists.zx2c4.com/pipermail/wireguard/2018-March/002460.html https://lists.zx2c4.com/pipermail/wireguard/2018-March/00246... * https://lists.zx2c4.com/pipermail/wireguard/2018-March/002461.html https://lists.zx2c4.com/pipermail/wireguard/2018-March/00246... are the most relevant ones. (There are more, but they go slightly offtopic.)
    - eps 9y ago
      Do I read it correctly that they banned @ludde from the wireguard IRC channel because his software wasn't open source? Damn.
      - ludde 9y ago
        Yes - that's what the WireGuard author did. I didn't even discuss TunSafe.
  - rumpelsepp 9y ago
    You need to follow the thread.
miles 9y ago
Previous HN discussion on TunSafe from earlier this week: https://news.ycombinator.com/item?id=16515637 https://news.ycombinator.com/item?id=16515637
- ascorbic 9y ago
  I don't know how reasonable it is, but the attitude of the WireGuard maintainer in that thread really puts me off using it. Call it the de Raadt effect.
  - deleted 9y ago
    [deleted]
  - nirv 9y ago
    Did it put you off using openssh/openvpn/libressl/etc? Is there the Torvalds effect? Let maintainers express their discontent in the form they prefer. I see how @zx2c4 might be concerned about possible reputation risks due to the release of this closed-source implementation at the earliest WireGuard stage. Given that the author of TunSafe is not a security expert. Especially if (suddenly) TunSafe turns out to have security flaws, right before the WireGuard team releases an official open-sourced implementation. However, WG is an open protocol, and @ludde has the right to develop and sell whatever he wants on its basis.
    - namelost 9y ago
      I'd say the author comes across as immature, which is kind of a bad look if you are making security software.
      - lvh 9y ago
        How, specifically? Are they immature for suggesting against using a closed-source implementation of the WireGuard protocol? Is your concern their tone about said implementation?
    - ascorbic 9y ago
hultner 9y ago
Is there by any chance a speed comparison against IPSec (IKEv2) i.e. strongSwan with AES-NI? I haven’t used OpenVPN in many years, so such a comparison would be much more interesting.
- chrisper 9y ago
  From experience I can tell you that IPSec is much faster than OpenVPN. I have no issues getting Gbit over IPSec (Strongswan), but with OpenVPN I always maxed out around ~400Mbit. EDIT: Looks like I misunderstood your comment and it seems like you want a comparison to Wireguard... oops
  - hultner 9y ago
    Yeah that’s my experience as well. That’s why I wanted a comparison. My router at home easily handles gigabit over IPSec even though the CPU is at least 8 years old.
- nopcode 9y ago
  It's extremely fast, the benchmarks I've seen show that it's even faster than the IPSec config you describe.
  - jsjohnst 9y ago
    > the benchmarks I've seen I think GP was asking for links to that, able to share?
    - ludde 9y ago
      There are some benchmarks here https://www.wireguard.com/performance/ https://www.wireguard.com/performance/
- aaronmdjones 9y ago
  Preliminary benchmarks are available on the website. https://www.wireguard.com/performance/ https://www.wireguard.com/performance/ EDIT: Note these are obviously for the reference implementation, not TunSafe.
vbezhenar 9y ago
Is it possible with wireguard to provide public IPv6 address for clients? My server has /64 subnet assigned, and clients have only IPv4, but I'd like to provide white IPv6 address for clients.
- jbg_ 9y ago
  yes, I've done this

85 points by ludde 9y ago

I've seen WireGuard recommended here pretty strongly, so I started looking into it, but I couldn't see exactly how it could replace OpenVPN for us. We have an OpenVPN bastion for access into our VPC, and each engineer has their own key. When someone leaves, we can revoke their key. But WireGuard seems to use a single key per network interface. Would we just create an interface for every engineer (I have no idea what the limits are on these - maybe they're cheap)? Or is this just not a good use case for WireGuard?

deleted 9y ago
[deleted]
agnuacc 9y ago
IIRC, the wireguard server's config file has defined peers (clients) so you could just remove the peer pubkey from the config file and they would no longer be able to connect.
baobrien 9y ago
With WireGuard you have one public/private key pair for that interface, and a list of public keys for trusted peers. Access management would still be about the same -- each engineer would have a key pair, and you'd have the public key on the trusted list of the host side.
deleted 9y ago
[deleted]
dsacco 9y ago
> But WireGuard seems to use a single key per network interface. Every interface is associated with a public/private key pair, but each interface need not peer with a single client. That would be inefficient. Instead, each peer (including clients and the server) generates a personal key pair when they configure their local WireGuard (e.g. wg0) interface. Afterwards they set up a local configuration file consisting of peers and respective public keys. Then in the context of a company VPN, one peer is a designated server, and every other (client) peer lists the server’s remote IP as the only peer interface in their local configuration. The server has the public key of every client as respective entries in its local config file, which is used to restrict access to whitelisted clients. Any client with the corresponding private key locally can connect to the server’s interface using their local interface. To remove a client from the white list, you simply remove their peer entry from the local config file on the server, much like how you remove an SSH public key from authorized_keys. In fact, a decent mental model for WireGuard is tuennling over SSH, but faster, leaner and with no option for a shell or password login.
lvh 9y ago
Each network interface has a key pair associated with it, but it can pair with any number of other interfaces (having a pubkey for each). This is similar to how OpenVPN presumably works for you: each OpenVPN network device on your developers' laptops comes with a certificate they use to authenticate to you. So yes: there's one interface per engineer laptop, but that's already the case. There's only one remote interface though. (Or several, if you want to have several VPNs -- Wireguard makes that pretty easy too!)

rumpelsepp 9y ago

Here is some discussion about tunsafe. https://lists.zx2c4.com/pipermail/wireguard/2018-March/002448.html https://lists.zx2c4.com/pipermail/wireguard/2018-March/00244...

eps 9y ago
That's not a "discussion", but a nasty spiteful post full of extreme, but baseless allegations.
- marten-de-vries 9y ago
  That's not the whole story. There are further responses in that thread, including the opposing viewpoint from the TunSafe author. * https://lists.zx2c4.com/pipermail/wireguard/2018-March/002460.html https://lists.zx2c4.com/pipermail/wireguard/2018-March/00246... * https://lists.zx2c4.com/pipermail/wireguard/2018-March/002461.html https://lists.zx2c4.com/pipermail/wireguard/2018-March/00246... are the most relevant ones. (There are more, but they go slightly offtopic.)
  - eps 9y ago
    Do I read it correctly that they banned @ludde from the wireguard IRC channel because his software wasn't open source? Damn.
    - ludde 9y ago
      Yes - that's what the WireGuard author did. I didn't even discuss TunSafe.
- rumpelsepp 9y ago
  You need to follow the thread.

miles 9y ago

Previous HN discussion on TunSafe from earlier this week: https://news.ycombinator.com/item?id=16515637 https://news.ycombinator.com/item?id=16515637

ascorbic 9y ago
I don't know how reasonable it is, but the attitude of the WireGuard maintainer in that thread really puts me off using it. Call it the de Raadt effect.
- deleted 9y ago
  [deleted]
- nirv 9y ago
  Did it put you off using openssh/openvpn/libressl/etc? Is there the Torvalds effect? Let maintainers express their discontent in the form they prefer. I see how @zx2c4 might be concerned about possible reputation risks due to the release of this closed-source implementation at the earliest WireGuard stage. Given that the author of TunSafe is not a security expert. Especially if (suddenly) TunSafe turns out to have security flaws, right before the WireGuard team releases an official open-sourced implementation. However, WG is an open protocol, and @ludde has the right to develop and sell whatever he wants on its basis.
  - namelost 9y ago
    I'd say the author comes across as immature, which is kind of a bad look if you are making security software.
    - lvh 9y ago
      How, specifically? Are they immature for suggesting against using a closed-source implementation of the WireGuard protocol? Is your concern their tone about said implementation?
  - ascorbic 9y ago

hultner 9y ago

Is there by any chance a speed comparison against IPSec (IKEv2) i.e. strongSwan with AES-NI? I haven’t used OpenVPN in many years, so such a comparison would be much more interesting.

chrisper 9y ago
From experience I can tell you that IPSec is much faster than OpenVPN. I have no issues getting Gbit over IPSec (Strongswan), but with OpenVPN I always maxed out around ~400Mbit. EDIT: Looks like I misunderstood your comment and it seems like you want a comparison to Wireguard... oops
- hultner 9y ago
  Yeah that’s my experience as well. That’s why I wanted a comparison. My router at home easily handles gigabit over IPSec even though the CPU is at least 8 years old.
nopcode 9y ago
It's extremely fast, the benchmarks I've seen show that it's even faster than the IPSec config you describe.
- jsjohnst 9y ago
  > the benchmarks I've seen I think GP was asking for links to that, able to share?
  - ludde 9y ago
    There are some benchmarks here https://www.wireguard.com/performance/ https://www.wireguard.com/performance/
aaronmdjones 9y ago
Preliminary benchmarks are available on the website. https://www.wireguard.com/performance/ https://www.wireguard.com/performance/ EDIT: Note these are obviously for the reference implementation, not TunSafe.

vbezhenar 9y ago

Is it possible with wireguard to provide public IPv6 address for clients? My server has /64 subnet assigned, and clients have only IPv4, but I'd like to provide white IPv6 address for clients.

jbg_ 9y ago
yes, I've done this