16 ms·
WireGuard is submitted for Linux kernel inclusion
- ofrzeta 8y agoGreat news. I started using Wireguard instead of OpenVPN and won't look back. Actually it was easy to set up even with DKMS kernel modules but having it in mainline will be great.
- dtx1 8y agoDo you only use it to connect remotely into your home network or are there VPN Services for wireguard available?
- bubblethink 8y agoAzire gives free WG access while in beta
- apazgo 8y agoI second Azirevpn.com! Great speeds
- mick87 8y agoI use the mullvad VPN service for wireguard. They currently have 44 wireguard servers active around the world.
- bjoli 8y agoI second this. I remember reading an interview with one of the mullvad staff saying "y dream openVPN config would be [insert more or less verbatim the wireguard spec], but due to the nature of openVPN that either won't happen or will take a long time". They were quick at adopting wireguard :) They are very knowledgeable and spend a lot of effort in securing their VPN. I contacted them about what I thought was a bug, and got a very thorough answer about why mullvad behaved like that, what kind of threat it mitigated, and how I got the behaviour I wanted together with things I could do to keep safe (which was to update the kernel). Within 6 hours. I am a very happy customer.
- simias 8y agoCan you explain what makes it better than venerable old OpenVPN?
- phaer 8y agoMostly speed, a more minimal configuration syntax, more modern crypto. OpenVPN works fine, is quite portable and runs in user space. It's quite a lot slower, but is well-tested and can be managed with a Certificate Authority in organisation where that's desired.
- cm2187 8y agoI presume speed on linux? Otherwise doesn't wireguard suffer from the same peformance drawback than OpenVPN on windows (running in user mode)?
- deleted 8y ago[deleted]
- Hello71 8y agoOpenVPN is quite configurable, not as much as IPsec, but still a lot, and (from what I hear) has quite a bit of code bloat. I believe that userspace WireGuard has better performance than OpenVPN.
- cm2187 8y agoMy understanding (and experience) is that OpenVPN on windows is structurally capped at about 5-10 MB/s. I was curious of how that compares to WireGuard.
- neilalexander 8y agoPerformance issues with OpenVPN on Windows arise out of the inefficiencies of the TUN/TAP driver, not the OpenVPN software itself.
- robotmay 8y agoI've been using WireGuard on my router for the last 6 months, and it's fantastic. I get the full speed of my line through it, when OpenVPN was only giving me 20%. Because of the great plugin they have for Vyatta I'm going to be looking at using it for some stuff at work now too.
- Improvotter 8y agoOnly 20%? How did you test this? I'm currently using OpenVPN but am looking at Wireguard.
- robotmay 8y agoBy running speed tests through both tunnels. I was getting ~7Mbps over OpenVPN and get ~35Mbps over WireGuard to the same server :) I believe the speed difference is primarily related to the processing power of my router. WireGuard is seemingly much quicker because it's less intensive on the router.
- exhilaration 8y agoHow did you install it on your router? I'm assuming this isn't a throwaway $30 consumer router?
- rhblake 8y agoI use it on an EdgeRouter Lite 3 which is about $99. See: https://github.com/Lochnair/vyatta-wireguard https://github.com/Lochnair/vyatta-wireguard https://community.ubnt.com/t5/EdgeRouter/Release-WireGuard-for-EdgeRouter/td-p/1904764 https://community.ubnt.com/t5/EdgeRouter/Release-WireGuard-f... (discussion)
- poizan42 8y agoThe EdgeRouter Lite 3 also happens to be one of the few generally available Mips64 platforms (Cavium OCTEON CN5020). Actually I have just ordered its big brother EdgeRouter Lite 4. It costs double as much, but it also packs a quad-core 1GHz OCTEON CN7130.
- newman314 8y agoI'd love to see this included as part of the next macOS / iOS.
- jwandborg 8y agoI'm sorry.
- yjftsjthsd-h 8y agoIt probably won't happen for other reasons, but there is a userspace port, so it should be usable from Darwin.
- tptacek 8y agoIt works well from macOS.
- xroche 8y agoYou may want to check out the very nice presentation on WireGuard at Kernel Recipes: https://www.youtube.com/watch?v=9Rk4doELmwM https://www.youtube.com/watch?v=9Rk4doELmwM
- zx2c4 8y agoThere are several other (and newer) presentations here as well: https://www.wireguard.com/presentations/ https://www.wireguard.com/presentations/
- lighttower 8y agois there a presentation explaining some of the networking setup you need to understand in order to get wireguard working properly? For example, a common openVPN complaint is that the default setup hijacks all your network traffic -- and on ubuntu since 16.04 the default config gives a dns leak (they changed to systemd-resolved)
- 1023bytes 8y agoWhy does this need to be included in the kernel directly and not just as a loadable module?
- viraptor 8y agoWhen the API it relies on changes, the person doing the change will fix WG rather than the WG maintainers. Also it enables you to update the kernel without having to hunt for the matching release of WG separately.
- deleted 8y ago[deleted]
- tinus_hn 8y agoLike most device drivers it can be included in the mainline kernel but compile as a module.
- voxadam 8y agoOn a slight tangent, I wonder how realistic it would be to implement Wireguard as an eBPF program.
- scott00 8y agoThere are three related decisions in how software can be constructed in relation to linux, and it sounds like you might be confusing them a bit. They are: user space vs kernel space, base kernel vs kernel module, in tree vs out of tree. User space vs kernel space is the biggest decision and has a huge impact on nearly every aspect of the software. Wireguard has both user space and kernel space implementations. I'll link you to the Wireguard author's explanation as to why he chose to do a kernel space implementation: https://news.ycombinator.com/item?id=11994544 https://news.ycombinator.com/item?id=11994544 Base kernel vs kernel module is usually an easy one: almost everything that CAN go in a kernel module SHOULD go in a kernel module. Since modules can be loaded only when needed, it avoids using everyone's computing resources on features that not everyone might want. Wireguard is a kernel module. In tree vs out of tree means whether you commit your code into the main linux source tree, or whether you distribute it outside of the linux project. Linux software development practices make it pretty annoying to distribute kernel software out of tree, even if it's a module. Basically, linux doesn't maintain stable APIs or ABIs in kernel space, so if you distribute in binary form you'll need to distribute different versions for every kernel version, and if you distribute in source form, your users will need to recompile whenever they update their kernel, which is pretty often if they're keeping up with security updates. DKMS helps with the recompilation process, but it's still pretty annoying for users. This announcement is about the proposed transition of the wireguard kernel module from out of tree to in tree.
- Osiris 8y agoI have a VPS I use for VPN, which means, unfortunately, no custom kernels or kernel modules. So, I'm stuck with OpenVPN. It would be awesome to have WireGuard included in the kernel by default.
- brewrwe 8y agoBased on what you stated, I assume this VPS is running on OpenVZ? If so, I doubt it will ever see newer kernel features, in part due to OpenVZ hosts relying on ancient LTS kernel branches and also due to OpenVZ "optimizations", whereby kernel features that use extra resources to enable just get disabled. Or, if your lucky they'll give you a button to re-enable them for youe container on an ad-hoc basis. Heads up, $20 yearly and similar KVM deals are becoming more common, and you can run any kernel you want in KVM :P
- jwilk 8y agoWhere do you get these $20/y deals?
- esistgut 8y agoarubacloud.com has KVM based VPSes starting at 1€/month.
- PascalW 8y agoLots of offers on lowendtalk.com. Not all equally reliable. Arubacloud is pretty good, but €1 offer is only available in Italy. Besides that RamNode, BuyVM, Hetzner and Ultravps are pretty good (though all a bit more expensive than 20$/year).
- StavrosK 8y agoI started using Wireguard two days ago to access my home LAN and love it, I can access everything with one command, as if I'm home. The only problem I have with it is the complete lack of documentation. The tutorial refers to a configuration file, but nowhere on the site does it tell you how to write one. It also took me days to set up what I think is a common use case, logging in to a server/router at home and accessing the rest of the computers in the LAN. I I couldn't find how to forward/masquerade traffic, and it took some help from the good people at #linux to get it set up. I think it would be a great help if they had a configuration file on their site detailing how to set that up. Lacking that, I'll write an article with my config so the info is at least out there, but I believe Wireguard is held back by its lack of documentation.
- ryanlol 8y agoI've been using wg for over a year now and never had any difficulty finding documentation. `man wg` works just fine as does `man wg-quick` https://www.wireguard.com/quickstart/ https://www.wireguard.com/quickstart/ also shows you how to make a config file
- ZoomZoomZoom 8y agoThe problem is that a regular user [some of them] can follow documentation, set up a server and a client, use wg to connect them and may be even ping the connection. That's it, congratulations. How is this connection can be used? Which IPs should be used to establish a useful connection? How can a user see their LAN resources through it? How can a user route his web browsing through this connection (here we at least have wg-quick)? And so on. This information is lacking, and WG documentation is not the sole offender.
- weavie 8y agoThat's the thing with a vpn - it is just a single component of a fully setup network. The vpn documentation generally just covers how to setup the vpn connection. The routing and rest of the network setup, as per the questions you are asking, generally falls out of its domain and into general networks.. which is quite a huge area!
- foobarbazetc 8y agoThe biggest issue we’ve encountered with WireGuard is that it doesn’t (yet?) support GRO, which means the kernel doesn’t combine multiple sequential TCP frames inside the tunnel into one before presenting it to a program. This increases RTT by a significant amount.
- kanox 8y agoThat doesn't sound right, GRO is a performance optimization but shouldn't be required for interactive response. Sounds like what you need is TCP_NODELAY?
- foobarbazetc 8y agoSee above. ;)
- zx2c4 8y agoActually, I turned on inner-packet GRO a few weeks ago with this one-line change, resulting in surprisingly massive performance boosts for TCP: https://git.zx2c4.com/WireGuard/commit/?id=95951af7249912a4356b9a03cf3addc7e3f8f724 https://git.zx2c4.com/WireGuard/commit/?id=95951af7249912a43...
- foobarbazetc 8y agoWoohoo! Well, that’s amazing. We built a whole massively scalable CDN on top of WireGuard then hit that issue and had to shelve like 3 months of work. Thanks for that!
- pferde 8y agoThe only downside with WireGuard for me is that it only works over UDP. I am in a situation where I only have two or three TCP ports available for a VPN, so I won't be moving off OpenVPN anytime soon. I was following WG development for a while now and I think it's a great project, but sadly not for my particular use case.
- arghwhat 8y agoYou really need to get that fixed, as you are severely handicapped without UDP. Apart from existing UDP usecases, the general progression is away from TCP and onto UDP. QUIC is an example of such progression. The reason Wireguard doesn't do TCP is that it is only a handicap for tunneling, and impedes Wireguard's connectionless features. Maybe Wireguard could add it as a compat option, but the experience will be worse than over UDP. In the meantime, making a hacky UDP<->TCP<->UDP proxy isn't very hard. Less than 100 lines of Go. It'll handicap Wireguard quite a bit (even more than a built-in TCP compat feature), but it'll probably still be faster than OpenVPN.
- pferde 8y agoWell, this is a network where only SSH and one or two more TCP ports are open, and it's not something I can "get fixed". Still, I do not have any practical reason for switching to Wireguard, as I do not really see any reduced speed - it is possible that the bandwidth limitation of this network's internet connection is low enough for that to be the bottleneck, instead of OpenVPN. :)
- arghwhat 8y ago> Well, this is a network where only SSH and one or two more TCP ports are open, and it's not something I can "get fixed". Are the other TCP ports, as well as UDP blocked by a force of nature? :) > Still, I do not have any practical reason for switching to Wireguard, as I do not really see any reduced speed - it is possible that the bandwidth limitation of this network's internet connection is low enough for that to be the bottleneck, instead of OpenVPN. :) At lower throughput networks, you don't need wireguard. It'll still mean fewer CPU resources used, much simpler configuration, and things OpenVPN and the likes just cannot do (such as maintain the connection despite both ends changing IP, as long as it doesn't happen simultaneously).
- jwilk 8y agoThere's no next message in this thread? Huh? This mail archive works: https://www.spinics.net/lists/netdev/msg516566.html https://www.spinics.net/lists/netdev/msg516566.html
- zx2c4 8y ago[0/3] https://marc.info/?l=linux-netdev&m=153306429108040&w=2 https://marc.info/?l=linux-netdev&m=153306429108040&w=2 [1/3] https://marc.info/?l=linux-netdev&m=153306429908043&w=2 https://marc.info/?l=linux-netdev&m=153306429908043&w=2 [2/3] https://marc.info/?l=linux-netdev&m=153306437408074&w=2 https://marc.info/?l=linux-netdev&m=153306437408074&w=2 [3/3] https://marc.info/?l=linux-netdev&m=153306440208084&w=2 https://marc.info/?l=linux-netdev&m=153306440208084&w=2
- nialv7 8y agoThey are trying to get a completely new crypto interface into the kernel, and they are posting the patches to linux-netdev mailing list. This is not gonna fly.
- rys 8y agoThey were asked to do that by the kernel maintainers.
- porjo 8y ago> This is not gonna fly This response on the 'linux-crypto' list seems to agree: https://marc.info/?l=linux-crypto-vger&m=153310819905231 https://marc.info/?l=linux-crypto-vger&m=153310819905231
- scott_s 8y ago"Not gonna fly" in the sense that this maintainer doesn't want the patch as-is, but they lay out a clear set of steps the WireGuard authors can take to get it in shape for an eventual commit.
- akerro 8y agoIs there any paid VPN provider that supports it?
- computerfriend 8y agoYeah, Mullvad and Azure both have a WireGuard offering.
- A_No_Name_Mouse 8y agoMullvad does
- pedro2 8y agoAzireVPN. Another one was mentioned in the thread. Mullvad?
- Zenig_ 8y agoAlso bunkervpn
- nopcode 8y agoI had the pleasure to meet Jason at 34C3 past winter, he's incredibly capable and I really hope this goes through somehow. After using WireGuard you really don't want to go back to the horrible IPSec/OpenVPN solutions.
- auslander 8y agoIPSec IKEv2 is actually pretty good
- neilalexander 8y agoIt's pretty good if you have two devices that support the same proposed ciphers and don't implement other non-standard behaviour (I'm looking at you, Juniper). It's eye-bleed otherwise.
- auslander 8y agoWhy Juniper? I would not trust proprietary stuff over Strongswan, even if it worked correctly :) And Apple IKEv2 native clients work fine too.
- tptacek 8y agostrongSwan is literally 2 orders of magnitude more code than WireGuard, and for all that you get 1990s cryptography. Why would you trust it at all?
- auslander 8y agoTrust must be earned. In crypto it is mostly by time, since it takes quite a few research papers to arrive at scientific consensus. Codebase size is good argument, but consider how many optional components are in Strongswan, tens of RFCs supported. You can build it smaller omitting it in make. And what is the size of OpenBSD iked?
- 8y ago
- paulrd 8y agoHow would this compare to ZeroTier? (zerotier.com)
- emddudley 8y agoIt seems that someone asks about ZeroTier on every thread about WireGuard. According to tptacek: https://news.ycombinator.com/item?id=13601928 https://news.ycombinator.com/item?id=13601928 ZeroTier is cryptographically inferior to Wireguard, but also isn't really a VPN: it has centralized configuration and rendezvous. If you're running VPNs to get the US Netflix from your UK vacation, this is probably fine. If your VPN is how remote employees access your prod network, it is way less fine. I think it's a bit unfair to judge ZeroTier in comparison to VPNs, because that's not strictly speaking what it's trying to be. I like overlay networks! And here's some info from the ZeroTier developer: https://news.ycombinator.com/item?id=11996687 https://news.ycombinator.com/item?id=11996687 You can think of ZeroTier as a virtual smart switch built on a P2P network ... WireGuard does have some things in common with ZeroTier, such as the use of cryptography to identify endpoints and eliminate the hard-coding of endpoint addresses. ... I really like the WireGuard design in general and I think it has a somewhat different use case from ZeroTier, namely fast long-lived provisioned links across WANs and insecure LANs. You could use ZT for that but this being in-kernel makes it likely faster.
- omakoma 8y agothis news is lit! i remember using wireguard seems decent.
- zaarn 8y agoI can't wait until pfSense supports it. That'll be the moment I'll set the OpenVPN config on fire, because honestly, OpenVPN configs are magic and if it's not generated by some UI wizard, it's probably broken in some scenario. And even if you do the wizard, it's probably broken. Atm I have that funny bug where my laptop drops connection after 3 seconds but my desktop does fine. With the same configuration! Thank OVPN for that annoyance!
- moviuro 8y ago> Thank OVPN for that annoyance! Certainly, you reported that issue through proper channels, and attached detailled information regarding your hardware, software, as well as packet logs?
- zaarn 8y agoIt's a configuration error, not a OVPN bug itself. OVPN's configs are just so obfuscated that it's difficult to find the error.
- therealx 8y agoOpenVPN is really not that hard to configure, and I'm pretty darn sure my config isnt broken (it's been audited at least twice.)
- zaarn 8y agoOpenVPN is quite difficult to configure IMO, 90% of the time I spend setting up an openvpn install is spend figuring out the routes that make everything go and have both server and client set them up properly.
- rstuart4133 8y agoYeah, I'm with you. Saying a software package with over 300 different options and keeps default defaults that were depreciated years ago is easy to configure really is a stretch. Combine that with it being _very_ finicky about what x509 certs it accepts, requiring a directory of configuration files to set up the network and giving you raw openssl error messages, and I'd say it one of the harder things to I had to configure. IPSec is easier to setup, and by any measure IPSec isn't easy. OpenVPN still wins over IPSec because it works over so many different transports, and there is only one implementation so IPSec's interoperability issues vanish. It maintains that advantage over WireGuard too.
- arctux 8y agoI've been using Wireguard on both my laptop and my Android phone for about two months. I've been using the wg-quick systemd units, and everything has worked amazingly well. The only downside I've notice is slightly increased battery consumption on my phone, but that's to be expected (it uses approximately 5% of the battery per day). I use dnsmasq to resolve DNS queries on the server side. Dnsmasq's configuration file includes entries to block connections to ad networks, based on Steven Black's host file [0]. It's a great to achieve ad blocking on Android, since Google has banned ad blockers from the Play Store. Jason Donenfeld, Wireguard's author, has a Patreon page: https://www.patreon.com/zx2c4 https://www.patreon.com/zx2c4 [0] https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts
- deleted 8y ago[deleted]
- moviuro 8y ago> it uses approximately 5% of the battery per day OpenVPN uses about 20% of mine, so I guess it really is a step forward. Also, for your DNS lying file, you might be interested in: https://gitlab.com/moviuro/moviuro.bin/blob/master/lie-to-me https://gitlab.com/moviuro/moviuro.bin/blob/master/lie-to-me (which sources multiple domain lists)
- deleted 8y ago[deleted]
- move-on-by 8y agoSteven Black's list sources from multiple lists as well. Checking out your lie-to-me project, there is actually a lot of overlap between what Steven is already pulling in and what you are getting. Looks like one of your sources 'palevotracker.abuse.ch' is discontinued and responds with a 500.
- brg1007 8y agoYou can install pretty easy the F-Droid repository / store and download DNS66 from there. ( FOSS Ad-Blocking via DNS ).
- gigatexal 8y agoSo I can use this as a secure proxy to get around region restrictions? In the same way I do ssh -D? And then configure the proxy on my browser?
- AstralStorm 8y agoIt is more low level than that and closer to OpenVPN in terms of setup. Which means not bad. The main gain is in efficiency. It is much less resource intensive and thus sometimes faster.
- swsieber 8y agoSo, since lots of people here have experience with VPN, I'd like to ask theoretical project question: I have distant family memebers, and it'd be nice to have a simple way to get devices on the same network easily. My initial thought would be to setup a VPN server somewhere central and fast, and then distribute wireless routers with custom firmware that they could plugin to their network. Then anything they connect to that router would be connected to the VPN (because the router is pre-setup to connect to the VPN). Is that doable? Is it a good idea? I know just enough about networking to be dangerous...
- zzzcpan 8y agoUnless you are ok living with pwned routers, printers, you don't want devices with javascript-enabled web browsers and other random 3rd party software, like apps, to have access to anything on local network or at least not when they have access to the internet.
- ubercow13 8y agoWait what? Are you saying for example at home you would not allow your PC access to anything else on your LAN?
- forapurpose 8y agoHome equipment often is relatively poorly secured. The reality is that intra-LAN communication causes contagion to spread easily, that blocking intra-LAN communication can be very inconvenient, and that often there is no good solution. At least restrict it as much as possible. For example, allow connections only to the printer, if that is needed, and maybe only in one direction - and lock down that printer. But consider walk-up printing via USB cable: People print much less often these days and they have to walk over to the printer to pickup the document anyway.
- saganus 8y agoHave you seen ZeroTier? I've only used it for testing purposes, so I can't vouch for the quality of connections or anything else really, but it seems like something that could be useful for your use case.
- znpy 8y agoI can foresee a long, long and mostly pointless discussion/argument about code line length.
- ktta 8y agoEspecially with Linus being the one who dislikes long lines. I'm wondering if there has been any precedent of a non-trivial patch that was 80+
- zx2c4 8y agoNah, if people freak out I'll just change it. I _prefer_ my insanely long lines, and if Dave & co are alright with my preference, great, but if not, Linux is a big project with many people, and I'm happy to accommodate for different preferences.
- gct 8y agoI'd kind of like to see a screen shot of this
- lighttower 8y agoWhich of the popular VPN offer wireguard? Pia doesn't.
- ktta 8y agoMullvad
- rurban 8y agoThe only thing I don;t like about current WireGuard is that the single config file contains both the private key in clear, and all the public keys. IMHO the private keys should be in a separate file.
- Zenig_ 8y agohttps://wiki.archlinux.org/index.php/WireGuard#Store_private_keys_in_encrypted_form https://wiki.archlinux.org/index.php/WireGuard#Store_private...
- wahern 8y agoPrivate keys should be in secure hardware. Short of that it's all hand-waving. That's one benefit that IPSec+IKE has over Wireguard at the moment. With IPSec authentication can occur in userspace and the private key never needs to be exposed to the kernel or to userspace. By the time you implement this for Wireguard, if ever, the Wireguard "stack" (inside the kernel and, hopefully, outside the kernel) code size will have gotten considerably larger. It's largely theoretical at the moment because few IPSec setups actually make use of this capability. But it will become more common over time.
- Hnewswg1 8y agoGreat to hear that. What's the status with the official Windows client?
- lighttower 8y agois there a way for linux desktop to have some apps go through wireguard tunnel, and other apps to go through regular network interface?
- megous 8y agoIt's super easy to configure overall. But I know how to configure networing under Linux. The only thing I struggled with was AllowedIps concept, because that was the most unfamiliar thing to me. I use WireGuard to give my IPv4 only home computers fixed IPv6 addresses and connectivity via my VPS. It also serves as a sort of overlay network, where my devices despite not having a fixed IP address, are still reachable on a WireGuard network via my VPS.
- amaccuish 8y agoReally recommend if your systemd is up to date, describing your wg interfaces in .netdev files. Really clean, starting to really like systemd with things like this...
- cleanyourroom 8y agoThis is great News!