6 ms·

> Death to OpenVPN. > ...nightmares to configure and manage. This opinion seems a bit overdone. OpenVPN is one of the simplest and robust VPN protocols to set

> Death to OpenVPN. > ...nightmares to configure and manage. This opinion seems a bit overdone. OpenVPN is one of the simplest and robust VPN protocols to setup and manage in my experience. If you've had issues with OpenVPN, there are simpler options like Angristan's OpenVPN script [0] on GitHub to get you started. I'm not arguing against WireGuard's use case as it's a nifty tool and viable option. While it's codebase is indeed smaller in size, denigrating a proven tool like OpenVPN or assuming that everyone is incapable of managing it because it's "complex" is both unnecessary and incorrect. [0] https://github.com/Angristan/OpenVPN-install https://github.com/Angristan/OpenVPN-install

foobarbazetc 8y ago
The performance of OpenVPN is atrocious though. Good enough to load some jira/confluence but that’s pretty much it.
lvh 8y ago
Yes: OpenVPN was one of the most robust and easy to set up protocols. Because the alternative was IPSec. Now we have wireguard, and it’s better on basically every metric. 100% of OpenVPNs we have seen deployed at startups had BFCBC as the default protocol. 100% (I think?) of IPsecs had aggressive mode IKE. Wireguard doesn’t have bad modes. It benefits from decades extra of r&d in usable, secure cryptography.
CiPHPerCoder 8y ago
> This opinion seems a bit overdone. OpenVPN is one of the simplest and robust VPN protocols to setup and manage in my experience. I burnt 2 days earlier this month because `comp-lzo` is apparently distinct from `compress lz4` and fixing that required an OS upgrade (because it didn't exist before 2.4 and this VM isn't on the bleeding edge), which killed my VM's desktop environment, so I ended up needing to rebuild the entire environment. Even after that, the GNOME network manager doesn't respect the existence of this flag, so I have to work around the OS. Changing the VPN server's configuration to disable compression wasn't an option either. (Compression oracles are bad, m'kay?) If they were using WireGuard, this problem wouldn't have existed in the first place. Maybe compare/contrast them for yourself? You may find WireGuard even easier to get running. I for one welcome our modern crypto overlords.
tptacek 8y ago
WireGuard is simpler to set up (it's hard to imagine something being simpler to set up than WireGuard, since its configuration is literally the minimum amount of information you'd need to build an encrypted tunnel), should be more robust in practice because of its transport model, is much faster, and is optimally secure by default. I understand why people like OpenVPN --- their alternative before OpenVPN was IPSEC, which is a nightmare. What we're telling you is that there's something even simpler than OpenVPN, and it has the virtue of being materially more secure. People should stop using OpenVPN as soon as they can.
- tssva 8y ago
  WireGuard is easy to setup for particular use cases. A small number of dedicated links or a small number of mobile users. WireGuard provides the foundation of a complete VPN service. It doesn't provide features such as user management and authentication, key management, ip address assignment, client configuration distribution, end-user friendly VPN clients, support for easily implementing complex split-routing and dns configurations for VPN end users. And most of those things aren't in progress. And it is likely there will be multiple solutions competing to provide these on top of WireGuard, so there may never be on true flavor WireGuard solution. Also once these are in place the overall attack surface expands to be closer to OpenVPN and IPsec. Other issues include lack of support for multicast which means IPv6 which requires multicast is mostly supported but not completely which can cause issues in some circumstances. Accomplishing some simple tasks like using a floating route to provide failover across two WireGuard links isn't possible. WireGuard interfaces don't go down unless you manually tear them down, so you either have to run another tunneling protocol over the WireGuard links and assign your routes to those interfaces which can go down or use a dynamic routing protocol. And WireGuard has a few caveats when being used with certain dynamic routing protocols which starts to make it as complicated as OpenVPN or IPsec at scale. Currently there is an issue being discussed on the WireGuard mailing list regarding there currently being a requirement for time to be set on devices before establishing a first connection to a peer. This is because of an anti-replay requirement WireGuard has for initial packets which IPsec and OpenVPN don't. This is impacting a group that was hoping to use WireGuard to encrypt the traffic across a community wireless mesh network. The devices used in such networks often don't have a realtime clock. There are potential workarounds but again suddenly the simplicity advantage starts to slip away. I think Jason has done great work, I like WireGuard and I use WireGuard, but it is not near ready to replace OpenVPN or IPsec in most circumstances.
oedmarap 8y ago
Wanted to clarify that my parent comment was based on the adversarial way the article was written, not on the content as it related to the features of WireGuard (which are superb). The subsequent replies are all correct in that WireGuard is in fact simpler than OpenVPN to install/administer, has a smaller footprint and better performance as well. In that same vein, WireGuard is therefore magnitudes more efficient than the older VPN protocols that OpenVPN once usurped.

foobarbazetc 8y ago

The performance of OpenVPN is atrocious though. Good enough to load some jira/confluence but that’s pretty much it.

lvh 8y ago

Yes: OpenVPN was one of the most robust and easy to set up protocols. Because the alternative was IPSec. Now we have wireguard, and it’s better on basically every metric. 100% of OpenVPNs we have seen deployed at startups had BFCBC as the default protocol. 100% (I think?) of IPsecs had aggressive mode IKE. Wireguard doesn’t have bad modes. It benefits from decades extra of r&d in usable, secure cryptography.

CiPHPerCoder 8y ago

> This opinion seems a bit overdone. OpenVPN is one of the simplest and robust VPN protocols to setup and manage in my experience. I burnt 2 days earlier this month because `comp-lzo` is apparently distinct from `compress lz4` and fixing that required an OS upgrade (because it didn't exist before 2.4 and this VM isn't on the bleeding edge), which killed my VM's desktop environment, so I ended up needing to rebuild the entire environment. Even after that, the GNOME network manager doesn't respect the existence of this flag, so I have to work around the OS. Changing the VPN server's configuration to disable compression wasn't an option either. (Compression oracles are bad, m'kay?) If they were using WireGuard, this problem wouldn't have existed in the first place. Maybe compare/contrast them for yourself? You may find WireGuard even easier to get running. I for one welcome our modern crypto overlords.

tptacek 8y ago

WireGuard is simpler to set up (it's hard to imagine something being simpler to set up than WireGuard, since its configuration is literally the minimum amount of information you'd need to build an encrypted tunnel), should be more robust in practice because of its transport model, is much faster, and is optimally secure by default. I understand why people like OpenVPN --- their alternative before OpenVPN was IPSEC, which is a nightmare. What we're telling you is that there's something even simpler than OpenVPN, and it has the virtue of being materially more secure. People should stop using OpenVPN as soon as they can.

tssva 8y ago
WireGuard is easy to setup for particular use cases. A small number of dedicated links or a small number of mobile users. WireGuard provides the foundation of a complete VPN service. It doesn't provide features such as user management and authentication, key management, ip address assignment, client configuration distribution, end-user friendly VPN clients, support for easily implementing complex split-routing and dns configurations for VPN end users. And most of those things aren't in progress. And it is likely there will be multiple solutions competing to provide these on top of WireGuard, so there may never be on true flavor WireGuard solution. Also once these are in place the overall attack surface expands to be closer to OpenVPN and IPsec. Other issues include lack of support for multicast which means IPv6 which requires multicast is mostly supported but not completely which can cause issues in some circumstances. Accomplishing some simple tasks like using a floating route to provide failover across two WireGuard links isn't possible. WireGuard interfaces don't go down unless you manually tear them down, so you either have to run another tunneling protocol over the WireGuard links and assign your routes to those interfaces which can go down or use a dynamic routing protocol. And WireGuard has a few caveats when being used with certain dynamic routing protocols which starts to make it as complicated as OpenVPN or IPsec at scale. Currently there is an issue being discussed on the WireGuard mailing list regarding there currently being a requirement for time to be set on devices before establishing a first connection to a peer. This is because of an anti-replay requirement WireGuard has for initial packets which IPsec and OpenVPN don't. This is impacting a group that was hoping to use WireGuard to encrypt the traffic across a community wireless mesh network. The devices used in such networks often don't have a realtime clock. There are potential workarounds but again suddenly the simplicity advantage starts to slip away. I think Jason has done great work, I like WireGuard and I use WireGuard, but it is not near ready to replace OpenVPN or IPsec in most circumstances.

oedmarap 8y ago

Wanted to clarify that my parent comment was based on the adversarial way the article was written, not on the content as it related to the features of WireGuard (which are superb). The subsequent replies are all correct in that WireGuard is in fact simpler than OpenVPN to install/administer, has a smaller footprint and better performance as well. In that same vein, WireGuard is therefore magnitudes more efficient than the older VPN protocols that OpenVPN once usurped.