15 ms·

MacOS command line version of the WireGuard VPN is now available for testing

333 points by zx2c4 8y ago

sneak 8y ago
Not to diminish this important work at all, just a question for HN: do I have a minority viewpoint in thinking key-based SSH to a bastion host and forwarding traffic via SOCKS (ssh -D) or ProxyCommands serves 99% of the use cases for a sysadmin’s need for a VPN? (Corp networks and L2 privacy needs notwithstanding.) Edit: If so, why?
- cassianoleal 8y ago
  Quite likely.
- lvh 8y ago
  It’s a fine way to get started; sure. You probably need ssh anyway and getting forwarding up for free is neat. It also had the historical advantage of existing; wireguard is new. Perf is sometimes not great, but at least you’re likely to get better crypto than most default OpenVPN installations I’ve seen. But it’s not a great long-term solution; whereas wireguard will last you for a long time :-)
  - sneak 8y ago
    Why isn’t it a great long-term solution in your view? I have been using it effectively for 10-15 years.
    - lvh 8y ago
      Sorry, I meant scale over number of boxes and services, not so much scale over time. Other people in this thread have given some rationale, but: perf, better baseline crypto (you always know what you’re getting), it’s a real network connection so you can talk to hosts with stuff like ICMP, smaller trusted codebase, more confidence in the underlying protocol...
- StavrosK 8y ago
  I think the answer is mostly that it's hard to route most traffic over SOCKS, most applications don't obey the system-wide proxy settings, you might be leaking DNS queries, things like that.
  - gcb0 8y ago
    if you are willing to let a vpn client abuse your system, you might also want to set a network interface that routes all traffic to the ssh tunnel. might be trivial to add as a module if not available already.
    - zylent 8y ago
      In most configurations, it’s trivial to use the os native VPN client, with some minor caveats. This creates a tunnel device and does what 99% of end-users working remotely need.
      - gcb0 8y ago
        the OS vpn still have the same problems. For example, you can run an application that asks the OS to not use the vpn. That is why most vpn clients will break your ability to set proxies (try to enable cisco enterprise vpn client on OSX and then open charles proxy and see how sad you will be) my point is: on all setups you have traffic that might go around the vpn tunnel, that is an application defect not that ssh tunels are worse.
  - cookiecaper 8y ago
    Still not as thorough as a full-fledged "real" VPN, but for most ad-hoc purposes, something like sshuttle [0] works well and doesn't require application-specific configuration. [0] https://github.com/sshuttle/sshuttle https://github.com/sshuttle/sshuttle
    - rsync 8y ago
      I am very excited about sshuttle (and in fact, rsync.net has sponsored work on it). The most compelling aspect of sshuttle, in my opinion, is that any host running sshd can be an endpoint - no software is required. As long as the sshd in question has python available, you can use it as an endpoint.
- deleted 8y ago
  [deleted]
- geofft 8y ago
  I used such a setup at my last job for all my work (which had the advantages that I could use a Chromebook; I definitely couldn't install some random vendor VPN client on it). It was great. We primarily had the SSH bastion box for emergencies when the $network_vendor VPN acted up, but you were allowed to use it as your day-to-day VPN if you wanted and I definitely did. The big downside in my eyes is that it's TCP-based, so your latency properties with non-TCP connections aren't what you want (e.g., you can't meaningfully use Mosh) and if the connection drops / your IP changes, your single connection goes down and you have to restart it manually. Wireguard is UDP-based and handles roaming, so even if you switch networks, your tunneled TCP connections are fine. Also, it's a real network connection, so non-TCP/UDP things like ping work, you get an actual failed connection when the remote server doesn't respond instead of a successful one that drops immediately, etc. If you have root on both sides of the connection, ssh -w will also get you a real network device. (But also if you have root on both sides, you might as well set up an actual VPN.)
  - cityroasted 8y ago
    I run both Cisco and OpenVPN VPNs on my Chromebook and it works great.
- vlan0 8y ago
  You aren't wrong. Our UNIX admins have been operating in this fashion for over 10 years.
dguido 8y ago
FYI AlgoVPN has Wireguard support in a PR right now. It should get merged within a week once it gets more testing: https://github.com/trailofbits/algo/pull/910 https://github.com/trailofbits/algo/pull/910
- mbesto 8y ago
  This is super cool. So if I understand right, I can: 1. Use Algo CLI to spin up a server on DO, AWS, etc specifically to pass through traffic. 2. Use `wg` CLI to connect to that server and pass my MacBook traffic to that new server 3. Dispose the server when I'm done using Algo.
  - zx2c4 8y ago
    Yep! Usually all you need is `wg-quick up myserver` and `wg-quick down myserver` -- the wg-quick(8) command wraps all the others for the most common trivial use cases. By the way, I believe https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand has support for WireGuard (in addition to a billion other things...).
    - mbesto 8y ago
      Just set up, this is amazing. Thanks for sharing.
StavrosK 8y ago
Does anyone have detailed instructions/guide on how to set Wireguard up to allow my laptop to VPN back to my house through an always-on host there (basically two Ubuntu machines)? I'm not great at networking and I'd rather not spend hours breaking my entire network trying to set this up. The "getting started" guide on the website already assumes you can set up your own routing across the different subnets.
- number6 8y ago
  Just follow the instruction on the video. That's all there is to get it running. The archlinux wiki also give some tips but it is really simple
  - StavrosK 8y ago
    Ah, I skipped the video in favor of the text guide but I'll watch it, thank you.
    - jessaustin 8y ago
      ISTM that enough people always "skip the video" that no information should be confined strictly to video.
  - hamandcheese 8y ago
    The video merely connects two hosts (IIRC). If you want what you expect from a normal client-server VPN acting as a gateway to a private network, you'll need to enable IP forwarding on the "server" and ensure routes are correctly configured on the "client".
    - number6 8y ago
      Here is a blog post on this topic: https://vincent.bernat.im/en/blog/2018-route-based-vpn-wireguard https://vincent.bernat.im/en/blog/2018-route-based-vpn-wireg... Didn't tried it myself but it looks solid
- 8y ago
geofft 8y ago
What's the worry about SSH over the public internet? Possibly influenced by my college's network setup, I've always been on team BeyondCorp even before BeyondCorp was a thing. Just use some auth mechanism like SSH keys that prevents brute-force attacks, and disable password auth. Do pre-authentication OpenSSH vulnerabilities happen a lot, or something?
- lvh 8y ago
  Public internet SSH isn’t the worst thing in the world; but for some people that doesn’t mean a reasonable bastion story but rather “every host has a public IP” — and that’s just just an extra opportunity to put an unauthenticated Redis or Elasticsearch on the Internet by accident. I don’t think Tom’s death to public internet ssh was a reference to preauth ssh vulns or whatever. (But there’s a ton less code to trust in wireguard, so it’s still better :))
  - geofft 8y ago
    That's fair! I've still been on team BeyondCorp there - every host should either be configured correctly or have a local firewall, to the point where a public IP is safe, because an unauthenticated Elasticsearch on a VPN is still exposed to CSRF attacks against someone on the VPN, malware, etc. But I can buy that not giving them public IPs is an important defense-in-depth mechanism.
    - lvh 8y ago
      Yeah, I think we’re in violent agreement. (I worked at one of the impacted organizations during Project Aurora.) Having a VPN is a pretty great control for the vast majority of organizations that don’t have the operational maturity to pull the public IP apart of BeyondCorp off. FWIW: we are helping customers with differential access controls (and I love Chromebooks despite the license purchasing experience). But even if you go full public-IP BeyondCorp you’re going to have some machines you’re not exposing (though it should be fine to expose them, as you mention), and occasionally you need to reach them, and VPNs remain great for that. VPNs being unnecessary (and giving a false sense of security) for human-facing endpoints in a company with a multi billion dollar security org? Sure, it’s hard to disagree: to your point Google is working on the proof by construction :-D
gepeto42 8y ago
I have not tried WireGuard yet. Is it more reliable than existing methods over "bad Wi-Fi"? I find that one of the best ways to make bad hotel or plane Wi-Fi completely unusable is to use a VPN, and having something more reliable on bad links would be great.
- hamandcheese 8y ago
  WireGuard uses UDP and is effectively "connectionless" meaning there is no persistent connection to be maintained. It also allows for seamless IP address roaming (your peer doesn't care if two messages come from two different IPs so long as they are signed with the right key). In short, I expect it to have no meaningful degradation when on a bad network (so long as they don't block the traffic or have overly hostile NAT).
  - gepeto42 8y ago
    That is exactly what I was hoping for. Too bad it'll take forever before iOS can use it, because the current state of VPN on Wi-Fi is terrible (I understand that is not the first thing WireGuard is looking to solve, but it'll be great when it gets there).
    - xena 8y ago
      The way WireGuard is designed should actually result in a more stable connection for the end user when the device is hopping between LTE and WiFi constantly.
    - atonse 8y ago
      There apps that can run as third party VPN providers on iOS. It's often used by corporate networks that use non-standard VPN protocols. So there is hope. :-)
    - benjaminl 8y ago
      ZeoTier, which also uses UDP, has an iOS app. So it is possible if the dev team wants to prioritize it.
ekianjo 8y ago
Why death to SSH though?
- CiPHPerCoder 8y ago
  It's not "death to SSH", it's "death to SSH over public Internet". Instead, what you'll want to be doing is SSH over WireGuard.
  - ekianjo 8y ago
    how is that a security issue if you use your own computer with its own ssh keys?
    - CiPHPerCoder 8y ago
      I think lvh's comment here is more appropriate for mature sysadmins who actually use key auth: https://news.ycombinator.com/item?id=17091990 https://news.ycombinator.com/item?id=17091990
  - spacenick88 8y ago
    But my SSH already uses Public Keys and ChaCha20/Poly1305 so that's really the last protocol I worry about sending through hostile territory
    - atonse 8y ago
      With Wireguard I believe you can go further and your servers can have only private IPs. And it's all seamless.
      - pritambaral 8y ago
        But the servers have to have a public IP to terminate the wireguard link, or be connectable from a machine that does. Exactly like SSH, be it via a bastion host or direct.
euroclydon 8y ago
Elsewhere in the Latacora blog, Threat Modeling is said to be bad. I'm interested in a succinct explanation why it's not a useful activity.
pdxpatzer 8y ago
If WireGuard is so great (rethorical position, not actually doubting it is) why isn't there a Kickstart effort or some angel funding to speed up its development to all platforms ?
- zx2c4 8y ago
  Development of security software is slow and careful, so we're not trying to rush anything. But, you can indeed donate to the efforts, which makes a big difference: https://www.wireguard.com/donations/ https://www.wireguard.com/donations/ https://www.patreon.com/bePatron?c=1100957 https://www.patreon.com/bePatron?c=1100957
- lvh 8y ago
  Wireguard has taken third party funds to expedite development, but as far as I know the author is pretty adamant all the implementations are freely available and open source, so maybe angel funds aren’t the best direct way forward. Disclaimer: I’m a principal at Latacora and we paid the author some money to make native Mac clients happen. There’s also a VPN provider who paid money toward development. I’d rather they did it right than rush it to meet a kickstarter date.
  - codezero 8y ago
    Private Internet Access was one of the vpn providers. https://www.privateinternetaccess.com/blog/2018/01/private-internet-access-proud-supporting-wireguard-project/ https://www.privateinternetaccess.com/blog/2018/01/private-i...
  - throw2465723 8y ago
    Also seems to have received 1BTC from controversial Mircea Popescu. (http://btcbase.org/log/2018-04-11#1796067 http://btcbase.org/log/2018-04-11#1796067)
jolmg 8y ago
> It’s a little hard to overstate how big a deal this is. [...] Nobody trusts either codebase, or, for that matter, either crypto protocol. Both are nightmares to configure and manage. Those seem quite the overstatements. I don't remember having any particular distrust in OpenVPN's codebase or protocol. I also didn't have that much trouble configuring neither the server nor the clients. I particularly liked how OpenVPN's configuration is basically putting command line arguments in a file. I could test configurations by simply changing invocations of openvpn, and when I found something I liked, I just put the options in a file and enabled the service to use that configuration file. Compared to the configuration of other kinds of services, OpenVPN is pretty simple. EDIT: This is my first time hearing of WireGuard. I can't say how it compares, but the way this reads like a sales pitch and is so dismissive of SSH and OpenVPN, both of which I've had nothing but good experiences from, doesn't leave a good impression on me. I mean: > Death to SSH over the public Internet. Death to OpenVPN. Death to IPSEC. Long live WireGuard! Really? This page would've been more effective on me if it objectively described how WireGuard was better than these technologies.
- dewyatt 8y ago
  It's just pure marketing - create a problem where it doesn't exist, and sell the solution.
  - lvh 8y ago
    Would you care to rebut the arguments the blog post puts forth, such as argue that wireguard is actually harder to configure than IPSec or that the protocol is actually less trustworthy? IPsec’s design era, implementation size... really nothing about the thing is even vaguely comparable. Also: wireguard is free and open source software. So what precisely are we (people advocating for it) selling? We paid a hell of a lot more than the cost of an OpenVPN AS license so that everyone could get a macOS client, for free. I don’t make a dime off of you using wireguard. So far 100% of the deployed OpenVPN I’ve seen has had bad crypto. Wireguard just categorically doesn’t have that problem.
  - atonse 8y ago
    Oh the problem definitely exists. And it shows in the fact that only more sophisticated teams use VPN. And when they have to use VPN, too many teams use OpenVPN because it's seemingly the easiest to use. Also there are scripts like the amazing Algo that make it easier to run your own VPN server. But this has historically been a totally unsolved problem from the perspective of usability. I look at it as the difference between PGP and keybase. PGP was always too complex to use, and that's a bad security design. Keybase is a lot easier to use (and Signal even easier). Wireguard is like that. Although I haven't used it yet, the configurations seem like "really? that's it? there's got to be more to it"
craftyguy 8y ago
Is support for this in the Linux kernel yet? The lack of acceptance there is a major reason why I haven't tried this out yet.
- zx2c4 8y ago
  Not yet, but I'm working on readying the v1 [PATCH] submission.
- hamandcheese 8y ago
  But why? Its still very easy to install. Is it just a matter of not trusting kernel extensions?
  - craftyguy 8y ago
    > But why? Principle. I strongly believe that software which runs in kernel space must adhere to the same standards (for better or worse) as the kernel. For Linux kernel modules, this means being accepted into the upstream kernel, and demonstrating a history of maintaining compatibility with the mainline kernel. I've been burned a lot in the past by companies releasing their own modules, and quickly failing to keep up compatibility with the mainline kernel versions. Not going to make that mistake again.
    - zx2c4 8y ago
      That's a fine and fair principle. I understand where you're coming from, and getting this mainlined is important to me too. But for the record, we're maintaining meticulous compatibility with all kernel.org kernels back to 3.10 and up to whatever the most recent RCs are (at the moment, 4.17-rc5). We also support the frankenkernels from ubuntu, redhat, and suse. We have a build and run-in-a-vm CI box testing all these kernels for every commit and on a bunch of architectures: https://www.wireguard.com/build-status/ https://www.wireguard.com/build-status/ And because we're actively working on upstreaming this, you can be sure that this is going to continue working with upstream. Also, this isn't a "company releasing their own modules" situation, providing some kind of throw-it-over-the-fence corporate crap code. I'm a kernel developer with a decent amount of upstream code, and the work I do is nearly always for upstream kernels.
ollybee 8y ago
A benefit unmentioned in this article is full IP roaming on both ends. That is good on its own but combined with the Android support has some very interesting possibilities.
- aorth 8y ago
  Yes! Like `mosh` for your VPN. Pretty cool.
joshbaptiste 8y ago
Most of the time I do not need my whole ip stack to be forwarded over a secure channel but simply HTTP/s .. here is where SSH/socks proxying suits well for me in hotels etc..
- lvh 8y ago
  Have you tried both? Particularly on bad hotel WiFi and roaming, wireguard perf is not comparable to SSH proxying.
  - joshbaptiste 8y ago
    ah gotcha.. ok I'll setup wreguard tonight as there is really no need to route everything via a "tun0" if I don't need to anyway, when I think about it.
jedisct1 8y ago
And for a VPN with multipath support, check out Glorytun: https://github.com/angt/glorytun https://github.com/angt/glorytun Used by OVH routers to efficiently aggregate multiple physical links.
oedmarap 8y ago
> Death to OpenVPN. > ...nightmares to configure and manage. This opinion seems a bit overdone. OpenVPN is one of the simplest and robust VPN protocols to setup and manage in my experience. If you've had issues with OpenVPN, there are simpler options like Angristan's OpenVPN script [0] on GitHub to get you started. I'm not arguing against WireGuard's use case as it's a nifty tool and viable option. While it's codebase is indeed smaller in size, denigrating a proven tool like OpenVPN or assuming that everyone is incapable of managing it because it's "complex" is both unnecessary and incorrect. [0] https://github.com/Angristan/OpenVPN-install https://github.com/Angristan/OpenVPN-install
- foobarbazetc 8y ago
  The performance of OpenVPN is atrocious though. Good enough to load some jira/confluence but that’s pretty much it.
- lvh 8y ago
  Yes: OpenVPN was one of the most robust and easy to set up protocols. Because the alternative was IPSec. Now we have wireguard, and it’s better on basically every metric. 100% of OpenVPNs we have seen deployed at startups had BFCBC as the default protocol. 100% (I think?) of IPsecs had aggressive mode IKE. Wireguard doesn’t have bad modes. It benefits from decades extra of r&d in usable, secure cryptography.
- CiPHPerCoder 8y ago
  > This opinion seems a bit overdone. OpenVPN is one of the simplest and robust VPN protocols to setup and manage in my experience. I burnt 2 days earlier this month because `comp-lzo` is apparently distinct from `compress lz4` and fixing that required an OS upgrade (because it didn't exist before 2.4 and this VM isn't on the bleeding edge), which killed my VM's desktop environment, so I ended up needing to rebuild the entire environment. Even after that, the GNOME network manager doesn't respect the existence of this flag, so I have to work around the OS. Changing the VPN server's configuration to disable compression wasn't an option either. (Compression oracles are bad, m'kay?) If they were using WireGuard, this problem wouldn't have existed in the first place. Maybe compare/contrast them for yourself? You may find WireGuard even easier to get running. I for one welcome our modern crypto overlords.
guy98238710 8y ago
In my experience, people use VPNs as an excuse to push weak host security through review. Eventually, everyone dismisses all security concerns with "it's behind VPN". And then they connect to the VPN with their malware-ridden computers. People are also surprised that whatever they run inside supposedly sandboxed VM actually gets full access to the VPN. And then there are configuration errors that can lead to surprising effects like forwarding all traffic from one's home computer through company's network filter/sniffer. For these reasons, I always recommend running everything with public IP address. No more excuses. It's public, so security is a must. No more surprising network flows. Cloud-based monitoring tools can access the servers. Limited access can be granted to non-core team members and computer-illiterate staff.
- tptacek 8y ago
  For organizations with extremely sophisticated security teams, pretty far beyond the industry norm for "unicorn" startups (which themselves tend to have security teams with 10+ people on them, meaning millions of dollars of annual spend on security), this makes sense. But for other companies, when they haven't been architected from the beginning to carefully support this access model, this is terrible advice. Just awful. Converting a company with a VPN/private deployment environment model directly to a "YOLO BeyondCorp" model will get that company owned up. Further: if the primary things people need to get into private IP space for are (1) developer access and (2) access for non-technical staff to admin interfaces, the win just isn't there, even if done correctly, for most companies with the BeyondCorp model. It costs more to keep that model secure than it does to set up a system of VPNs for private access.
  - joshbaptiste 8y ago
    Indeed.. There's no way at "OlderCorp" where I work would be able to move to this "YOLO BeyondCorp" public ip everything, we would be owned in seconds.
  - kdv 8y ago
    I'm certainly comfortable with WireGuard for machine to machine connections, but I don't see how it would replace traditional VPN w/ 2FA (e.g OVPN w/ Duo) for non-technical staff to access internal apps (at least without something similar to PAM)
baobrien 8y ago
Is this a kernel implementation of WireGuard for MacOS, or is it one of the two ongoing userspace implementations? I probably missed it, but I didn't see a separate repo for it at https://git.zx2c4.com/ https://git.zx2c4.com/ . On that note, can anybody say how far along the userspace rust implementation is? How hard it'd be to port the MacOS version to FreeBSD?
- zx2c4 8y ago
  The macOS client mentioned in the article uses the Go implementation: https://git.zx2c4.com/wireguard-go/about/ https://git.zx2c4.com/wireguard-go/about/ It should be very easy to port to FreeBSD, and I'd like to make this happen. Care to help?
  - e12e 8y ago
    Hey! I was just sitting here grumbling to myself:"I whish they'd prioritise a solid portable user-space version" - and it turns out you did! How realistic is it to get this running on Windows 10?
    - kim0 8y ago
      Maybe try running it under subsystem for Linux!
mmebane 8y ago
Is there any hope for an implementation that can be run on a Windows/macOS machine as an unprivileged user, and exposed as a SOCKS5 proxy? I often find myself wishing for an isolated VPN experience which applies only to a particular browser, but to all traffic in that browser. Something like Tor browser, but with my VPN instead of Tor.
kevin_nisbet 8y ago
@lvh What are your thoughts on the wireguard homepage effectively saying it's not ready for production use? I've looked at using wireguard on a few occasions, but it's always sounded not ready for production usage reading through it. Looking forward to the point where I can though.
- zx2c4 8y ago
  We're just conservative. At some point we'll change the webpage.
  - lvh 8y ago
    (Since GP asked me specifically: I completely agree with Jason here.)
hapnin 8y ago
I'm not as well versed as many here (I'm an advanced amateur) but have some understanding of networks and crypto and am trying to wrap my head around this. Can Wireguard be described as an encrypted, stateless, roaming, keypair based UDP tunnel?
- tptacek 8y ago
  It's a routed tunnel, which is what distinguishes VPNs from encrypted tunnels.
rauhl 8y ago
> But the most important use case for VPNs for startups is to get developers access to cloud deployment environments, and developers use MacOS, which made it hard to recommend. What’s that? > … developers use MacOS … Not all developers! I’ll believe that many developers use macOS. It’s even possible that most developers conducting certain kinds of development use macOS. But not all developers do. I don’t. Noöne on my last team did (we were Linux-only). Several folks on my current team don’t.
- tptacek 8y ago
  If your developers use Linux, they've already had a mature WireGuard implementation for months. It may even land in the mainline Linux kernel (I hope it does). I don't have advice for developers on Windows right now, but we haven't run into any of those at Latacora; you can assume we're broadly writing for an audience of the kinds of startups we serve.
  - zx2c4 8y ago
    We'll have a Windows client in due time.
gok 8y ago
> TODO: this should use scutil and be slightly more clever. But for now we simply overwrite any _manually set_ DNS servers for all network services. This means we get into trouble if the user doesn't actually want DNS via DHCP when setting this back to "empty". Because macOS is so horrible to deal with here, we'll simply wait for irate users to provide a patch themselves. [1] So the setup script completely deletes all your manual DNS settings without warning you. [1] https://git.zx2c4.com/WireGuard/tree/src/tools/wg-quick/darwin.bash?id=a0d5736e11e1e70189393fc8803c2c1500c87d3e https://git.zx2c4.com/WireGuard/tree/src/tools/wg-quick/darw...
- chatmasta 8y ago
  > “now available for testing” Aka it’s alpha software, use at your own risk. Thus, yours seems like an unreasonable criticism. Definitely good to know though.
  - gok 8y ago
    Destroying user data without warning is acceptable as long as you say "this is for testing"?
    - chatmasta 8y ago
      Maybe I’m misreading it but I think it only deletes the DNS data while the wireguard connection is active?
      - zx2c4 8y ago
        Before I fixed it, it wouldn't restore the previous non-DHCP-set DNS servers when you took the interface down. Now this bug is fixed.
- zx2c4 8y ago
  Pointed out on the mailing list, too. Did you make a concerted effort to link to the file revision that doesn't contain the fix for that? Anyway, this is taken care of now, and will be released with the next snapshot. https://git.zx2c4.com/WireGuard/commit/?id=b39298dfb540ad9c751e15585f4b95acb071ca84 https://git.zx2c4.com/WireGuard/commit/?id=b39298dfb540ad9c7...
kdv 8y ago
Is there any info on how many concurrent clients the WireGuard server can handle? I'd be interested in hearing if anyone has used this for management traffic to a large (>100) number of devices Edit: ..and if so, how they handled IP assignment and key distribution.
- zx2c4 8y ago
  Linux kernel module supports 2^20 (1048576) peers per interface. Go userspace version supports 2^16 (65536) peers per interface. Both limits can quite easily be raised if necessary.
  - kdv 8y ago
    Edited my question above for clarity. Any info on performance, key management, and managing peer address assignment in larger deployments?
deleted 8y ago
[deleted]
sandGorgon 8y ago
it'll be very useful if they build user-facing enterprise security from the get-go. How do you build SAML, Oauth/Google-Auth, 2-factor support into a VPN from the ground up ?
zimbatm 8y ago
The real competitor, which the article doesn't talk about is https://www.zerotier.com/ https://www.zerotier.com/ . Is is also open-source and have been available on macOS, iPhone, Android, Windows on top of Linux for many months now. It is easy to install and use. Deals with punching NAT and does smart routing when both devices are on the same network. I don't know how well it compares in terms of performance and crypto, it would be nice to know.
- tptacek 8y ago
  Where is ZeroTier's protocol documented? All I could find was a document that said it was custom, and "like IPSEC". What could ZeroTier do as a VPN protocol that would make it better than WireGuard, which has a pedigreed protocol that, in its WireGuard incarnation, has had multiple rounds of formal validation? I wrote the article we're commenting on. Why would I take the time to talk about something like ZeroTier? WireGuard solves the problem I'm talking about decisively. I'm prepared to hear something about ZeroTier that makes it interesting in the WireGuard setting, but I am not interested in a long list of non-VPN non-access-tunnel features that ZeroTier might have that WireGuard lacks, because lacking random features is exactly the point of WireGuard.
  - comex 8y ago
    It may not be interesting to you. To me, and probably a lot of people, the ability to communicate directly between two hosts each behind a NAT (using UDP hole punching) is a big advantage for a VPN, since, compared to forwarding through a central server, it can be faster and lower latency, and it also means you don’t have to pay for that server. Edit: As to why it’s relevant to the “WireGuard setting”, that depends on your definition of the WireGuard setting, but: (1) it’s easy to find examples of people trying to use WireGuard for peer-to-peer communication, the use case ZeroTier solves better; and (2) ZeroTier shares WireGuard’s property of being stateless/connectionless, a significant convenience advantage over traditional VPN protocols.
    - tptacek 8y ago
      I think I could have worded that better. By "in the WireGuard setting" I mean "doing the job most startups will use WireGuard to do", which is, manage remote access to internal resources in the cloud. I don't think overlay networks are pointless; I am enthusiastic about them. But for the remote access problem, what I want and what I'm writing about is streamlined VPN software, not a new overlay.
textmode 8y ago
https://en.wikipedia.org/wiki/Back_to_My_Mac https://en.wikipedia.org/wiki/Back_to_My_Mac For comment/discussion. Not a "recommendation", nor a positive/negative opinion. Believe it has never been discussed on HN before.
Bud 8y ago
So can we get WireGuard as a commercial service? Will anyone roll it out that way?
- zx2c4 8y ago
  Yes. https://mullvad.net/en/blog/2017/9/27/wireguard-future/ https://mullvad.net/en/blog/2017/9/27/wireguard-future/ https://www.azirevpn.com/wireguard https://www.azirevpn.com/wireguard https://www.privateinternetaccess.com/blog/2018/01/private-internet-access-proud-supporting-wireguard-project/ https://www.privateinternetaccess.com/blog/2018/01/private-i... http://blackholecloud.com http://blackholecloud.com And more on their way.
tzakrajs 8y ago
macOS
deleted 8y ago
[deleted]
locusm 8y ago
Hopefully this means its coming to FreeBSD/pfSense also.
rdtsc 8y ago
Any experience with this in an enterprise / DoD domain? ChaCha-Poly algorithm is not FIPS-140-2 validated from what I understand.
kim0 8y ago
Great news! I wish more smart people would put more effort to technically stop repressive regimes from blocking VPNs like WG.

333 points by zx2c4 8y ago

Not to diminish this important work at all, just a question for HN: do I have a minority viewpoint in thinking key-based SSH to a bastion host and forwarding traffic via SOCKS (ssh -D) or ProxyCommands serves 99% of the use cases for a sysadmin’s need for a VPN? (Corp networks and L2 privacy needs notwithstanding.) Edit: If so, why?

cassianoleal 8y ago
Quite likely.
lvh 8y ago
It’s a fine way to get started; sure. You probably need ssh anyway and getting forwarding up for free is neat. It also had the historical advantage of existing; wireguard is new. Perf is sometimes not great, but at least you’re likely to get better crypto than most default OpenVPN installations I’ve seen. But it’s not a great long-term solution; whereas wireguard will last you for a long time :-)
- sneak 8y ago
  Why isn’t it a great long-term solution in your view? I have been using it effectively for 10-15 years.
  - lvh 8y ago
    Sorry, I meant scale over number of boxes and services, not so much scale over time. Other people in this thread have given some rationale, but: perf, better baseline crypto (you always know what you’re getting), it’s a real network connection so you can talk to hosts with stuff like ICMP, smaller trusted codebase, more confidence in the underlying protocol...
StavrosK 8y ago
I think the answer is mostly that it's hard to route most traffic over SOCKS, most applications don't obey the system-wide proxy settings, you might be leaking DNS queries, things like that.
- gcb0 8y ago
  if you are willing to let a vpn client abuse your system, you might also want to set a network interface that routes all traffic to the ssh tunnel. might be trivial to add as a module if not available already.
  - zylent 8y ago
    In most configurations, it’s trivial to use the os native VPN client, with some minor caveats. This creates a tunnel device and does what 99% of end-users working remotely need.
    - gcb0 8y ago
      the OS vpn still have the same problems. For example, you can run an application that asks the OS to not use the vpn. That is why most vpn clients will break your ability to set proxies (try to enable cisco enterprise vpn client on OSX and then open charles proxy and see how sad you will be) my point is: on all setups you have traffic that might go around the vpn tunnel, that is an application defect not that ssh tunels are worse.
- cookiecaper 8y ago
  Still not as thorough as a full-fledged "real" VPN, but for most ad-hoc purposes, something like sshuttle [0] works well and doesn't require application-specific configuration. [0] https://github.com/sshuttle/sshuttle https://github.com/sshuttle/sshuttle
  - rsync 8y ago
    I am very excited about sshuttle (and in fact, rsync.net has sponsored work on it). The most compelling aspect of sshuttle, in my opinion, is that any host running sshd can be an endpoint - no software is required. As long as the sshd in question has python available, you can use it as an endpoint.
deleted 8y ago
[deleted]
geofft 8y ago
I used such a setup at my last job for all my work (which had the advantages that I could use a Chromebook; I definitely couldn't install some random vendor VPN client on it). It was great. We primarily had the SSH bastion box for emergencies when the $network_vendor VPN acted up, but you were allowed to use it as your day-to-day VPN if you wanted and I definitely did. The big downside in my eyes is that it's TCP-based, so your latency properties with non-TCP connections aren't what you want (e.g., you can't meaningfully use Mosh) and if the connection drops / your IP changes, your single connection goes down and you have to restart it manually. Wireguard is UDP-based and handles roaming, so even if you switch networks, your tunneled TCP connections are fine. Also, it's a real network connection, so non-TCP/UDP things like ping work, you get an actual failed connection when the remote server doesn't respond instead of a successful one that drops immediately, etc. If you have root on both sides of the connection, ssh -w will also get you a real network device. (But also if you have root on both sides, you might as well set up an actual VPN.)
- cityroasted 8y ago
  I run both Cisco and OpenVPN VPNs on my Chromebook and it works great.
vlan0 8y ago
You aren't wrong. Our UNIX admins have been operating in this fashion for over 10 years.

dguido 8y ago

FYI AlgoVPN has Wireguard support in a PR right now. It should get merged within a week once it gets more testing: https://github.com/trailofbits/algo/pull/910 https://github.com/trailofbits/algo/pull/910

mbesto 8y ago
This is super cool. So if I understand right, I can: 1. Use Algo CLI to spin up a server on DO, AWS, etc specifically to pass through traffic. 2. Use `wg` CLI to connect to that server and pass my MacBook traffic to that new server 3. Dispose the server when I'm done using Algo.
- zx2c4 8y ago
  Yep! Usually all you need is `wg-quick up myserver` and `wg-quick down myserver` -- the wg-quick(8) command wraps all the others for the most common trivial use cases. By the way, I believe https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand has support for WireGuard (in addition to a billion other things...).
  - mbesto 8y ago
    Just set up, this is amazing. Thanks for sharing.

StavrosK 8y ago

Does anyone have detailed instructions/guide on how to set Wireguard up to allow my laptop to VPN back to my house through an always-on host there (basically two Ubuntu machines)? I'm not great at networking and I'd rather not spend hours breaking my entire network trying to set this up. The "getting started" guide on the website already assumes you can set up your own routing across the different subnets.

number6 8y ago
Just follow the instruction on the video. That's all there is to get it running. The archlinux wiki also give some tips but it is really simple
- StavrosK 8y ago
  Ah, I skipped the video in favor of the text guide but I'll watch it, thank you.
  - jessaustin 8y ago
    ISTM that enough people always "skip the video" that no information should be confined strictly to video.
- hamandcheese 8y ago
  The video merely connects two hosts (IIRC). If you want what you expect from a normal client-server VPN acting as a gateway to a private network, you'll need to enable IP forwarding on the "server" and ensure routes are correctly configured on the "client".
  - number6 8y ago
    Here is a blog post on this topic: https://vincent.bernat.im/en/blog/2018-route-based-vpn-wireguard https://vincent.bernat.im/en/blog/2018-route-based-vpn-wireg... Didn't tried it myself but it looks solid
8y ago

geofft 8y ago

What's the worry about SSH over the public internet? Possibly influenced by my college's network setup, I've always been on team BeyondCorp even before BeyondCorp was a thing. Just use some auth mechanism like SSH keys that prevents brute-force attacks, and disable password auth. Do pre-authentication OpenSSH vulnerabilities happen a lot, or something?

lvh 8y ago
Public internet SSH isn’t the worst thing in the world; but for some people that doesn’t mean a reasonable bastion story but rather “every host has a public IP” — and that’s just just an extra opportunity to put an unauthenticated Redis or Elasticsearch on the Internet by accident. I don’t think Tom’s death to public internet ssh was a reference to preauth ssh vulns or whatever. (But there’s a ton less code to trust in wireguard, so it’s still better :))
- geofft 8y ago
  That's fair! I've still been on team BeyondCorp there - every host should either be configured correctly or have a local firewall, to the point where a public IP is safe, because an unauthenticated Elasticsearch on a VPN is still exposed to CSRF attacks against someone on the VPN, malware, etc. But I can buy that not giving them public IPs is an important defense-in-depth mechanism.
  - lvh 8y ago
    Yeah, I think we’re in violent agreement. (I worked at one of the impacted organizations during Project Aurora.) Having a VPN is a pretty great control for the vast majority of organizations that don’t have the operational maturity to pull the public IP apart of BeyondCorp off. FWIW: we are helping customers with differential access controls (and I love Chromebooks despite the license purchasing experience). But even if you go full public-IP BeyondCorp you’re going to have some machines you’re not exposing (though it should be fine to expose them, as you mention), and occasionally you need to reach them, and VPNs remain great for that. VPNs being unnecessary (and giving a false sense of security) for human-facing endpoints in a company with a multi billion dollar security org? Sure, it’s hard to disagree: to your point Google is working on the proof by construction :-D

gepeto42 8y ago

I have not tried WireGuard yet. Is it more reliable than existing methods over "bad Wi-Fi"? I find that one of the best ways to make bad hotel or plane Wi-Fi completely unusable is to use a VPN, and having something more reliable on bad links would be great.

hamandcheese 8y ago
WireGuard uses UDP and is effectively "connectionless" meaning there is no persistent connection to be maintained. It also allows for seamless IP address roaming (your peer doesn't care if two messages come from two different IPs so long as they are signed with the right key). In short, I expect it to have no meaningful degradation when on a bad network (so long as they don't block the traffic or have overly hostile NAT).
- gepeto42 8y ago
  That is exactly what I was hoping for. Too bad it'll take forever before iOS can use it, because the current state of VPN on Wi-Fi is terrible (I understand that is not the first thing WireGuard is looking to solve, but it'll be great when it gets there).
  - xena 8y ago
    The way WireGuard is designed should actually result in a more stable connection for the end user when the device is hopping between LTE and WiFi constantly.
  - atonse 8y ago
    There apps that can run as third party VPN providers on iOS. It's often used by corporate networks that use non-standard VPN protocols. So there is hope. :-)
  - benjaminl 8y ago
    ZeoTier, which also uses UDP, has an iOS app. So it is possible if the dev team wants to prioritize it.

ekianjo 8y ago

Why death to SSH though?

CiPHPerCoder 8y ago
It's not "death to SSH", it's "death to SSH over public Internet". Instead, what you'll want to be doing is SSH over WireGuard.
- ekianjo 8y ago
  how is that a security issue if you use your own computer with its own ssh keys?
  - CiPHPerCoder 8y ago
    I think lvh's comment here is more appropriate for mature sysadmins who actually use key auth: https://news.ycombinator.com/item?id=17091990 https://news.ycombinator.com/item?id=17091990
- spacenick88 8y ago
  But my SSH already uses Public Keys and ChaCha20/Poly1305 so that's really the last protocol I worry about sending through hostile territory
  - atonse 8y ago
    With Wireguard I believe you can go further and your servers can have only private IPs. And it's all seamless.
    - pritambaral 8y ago
      But the servers have to have a public IP to terminate the wireguard link, or be connectable from a machine that does. Exactly like SSH, be it via a bastion host or direct.

euroclydon 8y ago

Elsewhere in the Latacora blog, Threat Modeling is said to be bad. I'm interested in a succinct explanation why it's not a useful activity.

pdxpatzer 8y ago

If WireGuard is so great (rethorical position, not actually doubting it is) why isn't there a Kickstart effort or some angel funding to speed up its development to all platforms ?

zx2c4 8y ago
Development of security software is slow and careful, so we're not trying to rush anything. But, you can indeed donate to the efforts, which makes a big difference: https://www.wireguard.com/donations/ https://www.wireguard.com/donations/ https://www.patreon.com/bePatron?c=1100957 https://www.patreon.com/bePatron?c=1100957
lvh 8y ago
Wireguard has taken third party funds to expedite development, but as far as I know the author is pretty adamant all the implementations are freely available and open source, so maybe angel funds aren’t the best direct way forward. Disclaimer: I’m a principal at Latacora and we paid the author some money to make native Mac clients happen. There’s also a VPN provider who paid money toward development. I’d rather they did it right than rush it to meet a kickstarter date.
- codezero 8y ago
  Private Internet Access was one of the vpn providers. https://www.privateinternetaccess.com/blog/2018/01/private-internet-access-proud-supporting-wireguard-project/ https://www.privateinternetaccess.com/blog/2018/01/private-i...
- throw2465723 8y ago
  Also seems to have received 1BTC from controversial Mircea Popescu. (http://btcbase.org/log/2018-04-11#1796067 http://btcbase.org/log/2018-04-11#1796067)

jolmg 8y ago

> It’s a little hard to overstate how big a deal this is. [...] Nobody trusts either codebase, or, for that matter, either crypto protocol. Both are nightmares to configure and manage. Those seem quite the overstatements. I don't remember having any particular distrust in OpenVPN's codebase or protocol. I also didn't have that much trouble configuring neither the server nor the clients. I particularly liked how OpenVPN's configuration is basically putting command line arguments in a file. I could test configurations by simply changing invocations of openvpn, and when I found something I liked, I just put the options in a file and enabled the service to use that configuration file. Compared to the configuration of other kinds of services, OpenVPN is pretty simple. EDIT: This is my first time hearing of WireGuard. I can't say how it compares, but the way this reads like a sales pitch and is so dismissive of SSH and OpenVPN, both of which I've had nothing but good experiences from, doesn't leave a good impression on me. I mean: > Death to SSH over the public Internet. Death to OpenVPN. Death to IPSEC. Long live WireGuard! Really? This page would've been more effective on me if it objectively described how WireGuard was better than these technologies.

dewyatt 8y ago
It's just pure marketing - create a problem where it doesn't exist, and sell the solution.
- lvh 8y ago
  Would you care to rebut the arguments the blog post puts forth, such as argue that wireguard is actually harder to configure than IPSec or that the protocol is actually less trustworthy? IPsec’s design era, implementation size... really nothing about the thing is even vaguely comparable. Also: wireguard is free and open source software. So what precisely are we (people advocating for it) selling? We paid a hell of a lot more than the cost of an OpenVPN AS license so that everyone could get a macOS client, for free. I don’t make a dime off of you using wireguard. So far 100% of the deployed OpenVPN I’ve seen has had bad crypto. Wireguard just categorically doesn’t have that problem.
- atonse 8y ago
  Oh the problem definitely exists. And it shows in the fact that only more sophisticated teams use VPN. And when they have to use VPN, too many teams use OpenVPN because it's seemingly the easiest to use. Also there are scripts like the amazing Algo that make it easier to run your own VPN server. But this has historically been a totally unsolved problem from the perspective of usability. I look at it as the difference between PGP and keybase. PGP was always too complex to use, and that's a bad security design. Keybase is a lot easier to use (and Signal even easier). Wireguard is like that. Although I haven't used it yet, the configurations seem like "really? that's it? there's got to be more to it"

craftyguy 8y ago

Is support for this in the Linux kernel yet? The lack of acceptance there is a major reason why I haven't tried this out yet.

zx2c4 8y ago
Not yet, but I'm working on readying the v1 [PATCH] submission.
hamandcheese 8y ago
But why? Its still very easy to install. Is it just a matter of not trusting kernel extensions?
- craftyguy 8y ago
  > But why? Principle. I strongly believe that software which runs in kernel space must adhere to the same standards (for better or worse) as the kernel. For Linux kernel modules, this means being accepted into the upstream kernel, and demonstrating a history of maintaining compatibility with the mainline kernel. I've been burned a lot in the past by companies releasing their own modules, and quickly failing to keep up compatibility with the mainline kernel versions. Not going to make that mistake again.
  - zx2c4 8y ago
    That's a fine and fair principle. I understand where you're coming from, and getting this mainlined is important to me too. But for the record, we're maintaining meticulous compatibility with all kernel.org kernels back to 3.10 and up to whatever the most recent RCs are (at the moment, 4.17-rc5). We also support the frankenkernels from ubuntu, redhat, and suse. We have a build and run-in-a-vm CI box testing all these kernels for every commit and on a bunch of architectures: https://www.wireguard.com/build-status/ https://www.wireguard.com/build-status/ And because we're actively working on upstreaming this, you can be sure that this is going to continue working with upstream. Also, this isn't a "company releasing their own modules" situation, providing some kind of throw-it-over-the-fence corporate crap code. I'm a kernel developer with a decent amount of upstream code, and the work I do is nearly always for upstream kernels.

ollybee 8y ago

A benefit unmentioned in this article is full IP roaming on both ends. That is good on its own but combined with the Android support has some very interesting possibilities.

aorth 8y ago
Yes! Like `mosh` for your VPN. Pretty cool.

joshbaptiste 8y ago

Most of the time I do not need my whole ip stack to be forwarded over a secure channel but simply HTTP/s .. here is where SSH/socks proxying suits well for me in hotels etc..

lvh 8y ago
Have you tried both? Particularly on bad hotel WiFi and roaming, wireguard perf is not comparable to SSH proxying.
- joshbaptiste 8y ago
  ah gotcha.. ok I'll setup wreguard tonight as there is really no need to route everything via a "tun0" if I don't need to anyway, when I think about it.

jedisct1 8y ago

And for a VPN with multipath support, check out Glorytun: https://github.com/angt/glorytun https://github.com/angt/glorytun Used by OVH routers to efficiently aggregate multiple physical links.

oedmarap 8y ago

> Death to OpenVPN. > ...nightmares to configure and manage. This opinion seems a bit overdone. OpenVPN is one of the simplest and robust VPN protocols to setup and manage in my experience. If you've had issues with OpenVPN, there are simpler options like Angristan's OpenVPN script [0] on GitHub to get you started. I'm not arguing against WireGuard's use case as it's a nifty tool and viable option. While it's codebase is indeed smaller in size, denigrating a proven tool like OpenVPN or assuming that everyone is incapable of managing it because it's "complex" is both unnecessary and incorrect. [0] https://github.com/Angristan/OpenVPN-install https://github.com/Angristan/OpenVPN-install

foobarbazetc 8y ago
The performance of OpenVPN is atrocious though. Good enough to load some jira/confluence but that’s pretty much it.
lvh 8y ago
Yes: OpenVPN was one of the most robust and easy to set up protocols. Because the alternative was IPSec. Now we have wireguard, and it’s better on basically every metric. 100% of OpenVPNs we have seen deployed at startups had BFCBC as the default protocol. 100% (I think?) of IPsecs had aggressive mode IKE. Wireguard doesn’t have bad modes. It benefits from decades extra of r&d in usable, secure cryptography.
CiPHPerCoder 8y ago
> This opinion seems a bit overdone. OpenVPN is one of the simplest and robust VPN protocols to setup and manage in my experience. I burnt 2 days earlier this month because `comp-lzo` is apparently distinct from `compress lz4` and fixing that required an OS upgrade (because it didn't exist before 2.4 and this VM isn't on the bleeding edge), which killed my VM's desktop environment, so I ended up needing to rebuild the entire environment. Even after that, the GNOME network manager doesn't respect the existence of this flag, so I have to work around the OS. Changing the VPN server's configuration to disable compression wasn't an option either. (Compression oracles are bad, m'kay?) If they were using WireGuard, this problem wouldn't have existed in the first place. Maybe compare/contrast them for yourself? You may find WireGuard even easier to get running. I for one welcome our modern crypto overlords.

guy98238710 8y ago

In my experience, people use VPNs as an excuse to push weak host security through review. Eventually, everyone dismisses all security concerns with "it's behind VPN". And then they connect to the VPN with their malware-ridden computers. People are also surprised that whatever they run inside supposedly sandboxed VM actually gets full access to the VPN. And then there are configuration errors that can lead to surprising effects like forwarding all traffic from one's home computer through company's network filter/sniffer. For these reasons, I always recommend running everything with public IP address. No more excuses. It's public, so security is a must. No more surprising network flows. Cloud-based monitoring tools can access the servers. Limited access can be granted to non-core team members and computer-illiterate staff.

tptacek 8y ago
For organizations with extremely sophisticated security teams, pretty far beyond the industry norm for "unicorn" startups (which themselves tend to have security teams with 10+ people on them, meaning millions of dollars of annual spend on security), this makes sense. But for other companies, when they haven't been architected from the beginning to carefully support this access model, this is terrible advice. Just awful. Converting a company with a VPN/private deployment environment model directly to a "YOLO BeyondCorp" model will get that company owned up. Further: if the primary things people need to get into private IP space for are (1) developer access and (2) access for non-technical staff to admin interfaces, the win just isn't there, even if done correctly, for most companies with the BeyondCorp model. It costs more to keep that model secure than it does to set up a system of VPNs for private access.
- joshbaptiste 8y ago
  Indeed.. There's no way at "OlderCorp" where I work would be able to move to this "YOLO BeyondCorp" public ip everything, we would be owned in seconds.
- kdv 8y ago
  I'm certainly comfortable with WireGuard for machine to machine connections, but I don't see how it would replace traditional VPN w/ 2FA (e.g OVPN w/ Duo) for non-technical staff to access internal apps (at least without something similar to PAM)

baobrien 8y ago

Is this a kernel implementation of WireGuard for MacOS, or is it one of the two ongoing userspace implementations? I probably missed it, but I didn't see a separate repo for it at https://git.zx2c4.com/ https://git.zx2c4.com/ . On that note, can anybody say how far along the userspace rust implementation is? How hard it'd be to port the MacOS version to FreeBSD?

zx2c4 8y ago
The macOS client mentioned in the article uses the Go implementation: https://git.zx2c4.com/wireguard-go/about/ https://git.zx2c4.com/wireguard-go/about/ It should be very easy to port to FreeBSD, and I'd like to make this happen. Care to help?
- e12e 8y ago
  Hey! I was just sitting here grumbling to myself:"I whish they'd prioritise a solid portable user-space version" - and it turns out you did! How realistic is it to get this running on Windows 10?
  - kim0 8y ago
    Maybe try running it under subsystem for Linux!

mmebane 8y ago

Is there any hope for an implementation that can be run on a Windows/macOS machine as an unprivileged user, and exposed as a SOCKS5 proxy? I often find myself wishing for an isolated VPN experience which applies only to a particular browser, but to all traffic in that browser. Something like Tor browser, but with my VPN instead of Tor.

kevin_nisbet 8y ago

@lvh What are your thoughts on the wireguard homepage effectively saying it's not ready for production use? I've looked at using wireguard on a few occasions, but it's always sounded not ready for production usage reading through it. Looking forward to the point where I can though.

zx2c4 8y ago
We're just conservative. At some point we'll change the webpage.
- lvh 8y ago
  (Since GP asked me specifically: I completely agree with Jason here.)

hapnin 8y ago

I'm not as well versed as many here (I'm an advanced amateur) but have some understanding of networks and crypto and am trying to wrap my head around this. Can Wireguard be described as an encrypted, stateless, roaming, keypair based UDP tunnel?

tptacek 8y ago
It's a routed tunnel, which is what distinguishes VPNs from encrypted tunnels.

rauhl 8y ago

> But the most important use case for VPNs for startups is to get developers access to cloud deployment environments, and developers use MacOS, which made it hard to recommend. What’s that? > … developers use MacOS … Not all developers! I’ll believe that many developers use macOS. It’s even possible that most developers conducting certain kinds of development use macOS. But not all developers do. I don’t. Noöne on my last team did (we were Linux-only). Several folks on my current team don’t.

tptacek 8y ago
If your developers use Linux, they've already had a mature WireGuard implementation for months. It may even land in the mainline Linux kernel (I hope it does). I don't have advice for developers on Windows right now, but we haven't run into any of those at Latacora; you can assume we're broadly writing for an audience of the kinds of startups we serve.
- zx2c4 8y ago
  We'll have a Windows client in due time.

gok 8y ago

> TODO: this should use scutil and be slightly more clever. But for now we simply overwrite any _manually set_ DNS servers for all network services. This means we get into trouble if the user doesn't actually want DNS via DHCP when setting this back to "empty". Because macOS is so horrible to deal with here, we'll simply wait for irate users to provide a patch themselves. [1] So the setup script completely deletes all your manual DNS settings without warning you. [1] https://git.zx2c4.com/WireGuard/tree/src/tools/wg-quick/darwin.bash?id=a0d5736e11e1e70189393fc8803c2c1500c87d3e https://git.zx2c4.com/WireGuard/tree/src/tools/wg-quick/darw...

chatmasta 8y ago
> “now available for testing” Aka it’s alpha software, use at your own risk. Thus, yours seems like an unreasonable criticism. Definitely good to know though.
- gok 8y ago
  Destroying user data without warning is acceptable as long as you say "this is for testing"?
  - chatmasta 8y ago
    Maybe I’m misreading it but I think it only deletes the DNS data while the wireguard connection is active?
    - zx2c4 8y ago
      Before I fixed it, it wouldn't restore the previous non-DHCP-set DNS servers when you took the interface down. Now this bug is fixed.
zx2c4 8y ago
Pointed out on the mailing list, too. Did you make a concerted effort to link to the file revision that doesn't contain the fix for that? Anyway, this is taken care of now, and will be released with the next snapshot. https://git.zx2c4.com/WireGuard/commit/?id=b39298dfb540ad9c751e15585f4b95acb071ca84 https://git.zx2c4.com/WireGuard/commit/?id=b39298dfb540ad9c7...

kdv 8y ago

Is there any info on how many concurrent clients the WireGuard server can handle? I'd be interested in hearing if anyone has used this for management traffic to a large (>100) number of devices Edit: ..and if so, how they handled IP assignment and key distribution.

zx2c4 8y ago
Linux kernel module supports 2^20 (1048576) peers per interface. Go userspace version supports 2^16 (65536) peers per interface. Both limits can quite easily be raised if necessary.
- kdv 8y ago
  Edited my question above for clarity. Any info on performance, key management, and managing peer address assignment in larger deployments?

deleted 8y ago

[deleted]

sandGorgon 8y ago

it'll be very useful if they build user-facing enterprise security from the get-go. How do you build SAML, Oauth/Google-Auth, 2-factor support into a VPN from the ground up ?

zimbatm 8y ago

The real competitor, which the article doesn't talk about is https://www.zerotier.com/ https://www.zerotier.com/ . Is is also open-source and have been available on macOS, iPhone, Android, Windows on top of Linux for many months now. It is easy to install and use. Deals with punching NAT and does smart routing when both devices are on the same network. I don't know how well it compares in terms of performance and crypto, it would be nice to know.

tptacek 8y ago
Where is ZeroTier's protocol documented? All I could find was a document that said it was custom, and "like IPSEC". What could ZeroTier do as a VPN protocol that would make it better than WireGuard, which has a pedigreed protocol that, in its WireGuard incarnation, has had multiple rounds of formal validation? I wrote the article we're commenting on. Why would I take the time to talk about something like ZeroTier? WireGuard solves the problem I'm talking about decisively. I'm prepared to hear something about ZeroTier that makes it interesting in the WireGuard setting, but I am not interested in a long list of non-VPN non-access-tunnel features that ZeroTier might have that WireGuard lacks, because lacking random features is exactly the point of WireGuard.
- comex 8y ago
  It may not be interesting to you. To me, and probably a lot of people, the ability to communicate directly between two hosts each behind a NAT (using UDP hole punching) is a big advantage for a VPN, since, compared to forwarding through a central server, it can be faster and lower latency, and it also means you don’t have to pay for that server. Edit: As to why it’s relevant to the “WireGuard setting”, that depends on your definition of the WireGuard setting, but: (1) it’s easy to find examples of people trying to use WireGuard for peer-to-peer communication, the use case ZeroTier solves better; and (2) ZeroTier shares WireGuard’s property of being stateless/connectionless, a significant convenience advantage over traditional VPN protocols.
  - tptacek 8y ago
    I think I could have worded that better. By "in the WireGuard setting" I mean "doing the job most startups will use WireGuard to do", which is, manage remote access to internal resources in the cloud. I don't think overlay networks are pointless; I am enthusiastic about them. But for the remote access problem, what I want and what I'm writing about is streamlined VPN software, not a new overlay.

textmode 8y ago

https://en.wikipedia.org/wiki/Back_to_My_Mac https://en.wikipedia.org/wiki/Back_to_My_Mac For comment/discussion. Not a "recommendation", nor a positive/negative opinion. Believe it has never been discussed on HN before.

Bud 8y ago

So can we get WireGuard as a commercial service? Will anyone roll it out that way?

zx2c4 8y ago
Yes. https://mullvad.net/en/blog/2017/9/27/wireguard-future/ https://mullvad.net/en/blog/2017/9/27/wireguard-future/ https://www.azirevpn.com/wireguard https://www.azirevpn.com/wireguard https://www.privateinternetaccess.com/blog/2018/01/private-internet-access-proud-supporting-wireguard-project/ https://www.privateinternetaccess.com/blog/2018/01/private-i... http://blackholecloud.com http://blackholecloud.com And more on their way.

tzakrajs 8y ago

macOS

deleted 8y ago

[deleted]

locusm 8y ago

Hopefully this means its coming to FreeBSD/pfSense also.

rdtsc 8y ago

Any experience with this in an enterprise / DoD domain? ChaCha-Poly algorithm is not FIPS-140-2 validated from what I understand.

kim0 8y ago

Great news! I wish more smart people would put more effort to technically stop repressive regimes from blocking VPNs like WG.