13 ms·
I made my own WireGuard VPN server
- mirimir 8y agoOK, that's cool and all. But what's really cool about WireGuard is how simple it is. It's far simpler than OpenVPN, and vastly simpler than IPSec/IKEv2. Given SSH logins to a pair of VPS, it takes maybe an hour at most to setup a link. https://www.wireguard.com/quickstart/ https://www.wireguard.com/quickstart/
- hardwaresofton 8y agoIs it arrogant that I feel like I've basically invented this once before? The combination of asymmetric keys for identity and symmetric rotating keys for actual message sending is something that's just always made sense to me, but I never bothered trying to implement this since I was usually working in a web context and "just use HTTPS", was the better solution than trying to work out a custom scheme. [EDIT] - when I think about it, the management with kernel internals is definitely something I couldn't do. Writing kernel-level drivers/software is not my cup of tea.
- hyper2grams 8y ago>Is it arrogant that I feel like I've basically invented this once before? Probably.
- hardwaresofton 8y agoYeah... -- reading the wireguard paper[0] now, and my cursory analysis ("oh this is like that time that I...") of how it works/what it needed to accomplish is suuuuper naive. [0]: https://www.wireguard.com/papers/wireguard.pdf https://www.wireguard.com/papers/wireguard.pdf
- pvg 8y agoThe mathematical foundations and power/elegance (and often even simplicity) of cryptographic primitives make it really easy to get the completely wrong idea about the difficulty and disturbing fragility of actual cryptographic engineering. Happens to pretty much everyone.
- rubiquity 8y agoAll right, spill the beans. Which one are you? Diffie or Hellman?
- hardwaresofton 8y agoHaha I didn't mean I invented the key exchange mechanism -- just that after learning how easy it was to generate asymmetric public keys (on the shoulders of multiple giants), and how it easy it was to generate symmetric AES keys randomly (on the shoulders of more giants), I envisioned building services that would deliver public keys to a central repo and communicate over regular HTTP, but using encrypted payloads, and some MITM protection. I thought this was clever, then I realized I had just "discovered" HTTPS.
- dogma1138 8y agoopenssl genrsa 2048? ;) But in any case drafts for TLS over HTTP (also known as aTLS) exist: https://tools.ietf.org/html/draft-friel-tls-atls-00 https://tools.ietf.org/html/draft-friel-tls-atls-00 https://tools.ietf.org/html/draft-friel-tls-over-http-00 https://tools.ietf.org/html/draft-friel-tls-over-http-00
- hardwaresofton 8y agoThanks so much for the pointer, those two drafts are now in my reading list!
- rzzzt 8y agoIt's giants all the way up, shoulder on shoulder.
- Ao7bei3s 8y agoJust naive, not arrogant (it's ok & encouraged to think through things yourself, even if there already is a solution. you can't expect to come up with actually new good things on day 1.). You've described the obvious part - this is in any crypto intro course. But it's not even getting the details of that right (which is _a_ challenge) that's interesting, because that's not where wireguard innovates. Well it does actually propose a nice scheme, but still - OpenVPN (in TLS mode), IPSEC (with IKE, else it's DIY) and, in a way, HTTPS already have working schemes. wireguard shines is other areas: the simple (factor 500 smaller code than IPSEC/IKE), performant and fully in-kernel (both unlike OpenVPN) implementation, ifaces instead of xfrm policies (for IPSEC. though that's not entirely far, you can have VTI's. they just don't scale well we've found.), the lessons learned wrt crypto agility (tl;dr: don't), implicit source verification, the beautiful DOS cookie implementation (feels nicer than TA key), that servers are silent/invisible unless you know their public key (cant provoke any response packets without), all connections are p2p. To name a few. Read the Wireguard paper. It's short and very approachable.
- tialaramex 8y ago> lessons learned wrt crypto agility (tl;dr: don't)" This definitely doesn't qualify as a lesson learned. It's maybe, maybe, best current practice, if you squint. We've even seen in other threads the WireGuard author arguing that oh, well, if there's a problem with say key exchange (it has a "conventional" elliptic curve key exchange and so an adversary with a big Quantum Computer definitely breaks that) then you can still rescue with PSKs. And as well as not addressing problems in any other primitive that doesn't stand up to a laugh test. If PSKs were fine you would already use PSKs and not have all this complicated public key dance at all. In reality if there's any problem you have to throw WireGuard itself away. So the hope is maybe all these primitives are fine. And that hope will seem 100% on the money right up until it isn't. We will see then, I think, valuable character information about its designers and key proponents, in light of how they react to that particular lesson, for example in helping people migrate off their now fatally damaged baby. The lesson learned wasn't "don't" it was that "more is always better" is wrong, we didn't need fifteen mediocre symmetric block ciphers without much cryptanalytic research behind them in TLS. But zero agility _definitely_ hasn't proven itself to be the right choice here either, it's just less work to implement.
- todd8 8y agoI've had this feeling frequently in the past. Many years ago, when I was just learning computer science related concepts, I would be repeatedly surprised to see solutions discussed for which I had already had an inkling. It would usually turn out that my ideas weren't really novel or perhaps weren't really workable. With more experience and education this changed, and I've had an enjoyable career problem solving problem and inventing. Inventive minds like yours will often have insights that aren't original, but over time and with more practice, some of these will be original and practical and valuable, and you will more often have the satisfaction of making important discoveries.
- mi_lk 8y agoDoes the quickstart apply to MacOS? I follow the instructions and can't get past `wireguard-go wg0`.
- timdoug 8y agoEarlier today I wrote some documentation on setting up WireGuard on macOS, it may be useful: https://www.timdoug.com/log/2018/08/04/#wireguard_macos https://www.timdoug.com/log/2018/08/04/#wireguard_macos Happy to answer questions if anything's unclear.
- deleted 8y ago[deleted]
- dragonsh 8y agoStreisand makes it very easy to setup privacy focused secure VPN including support for wireguard and tor. Just provide credentials of your preferred Cloud provider and it will do the setup very quickly and provide you easy instructions to use VPN and proxy on desktop and mobile phones. https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand
- deleted 8y ago[deleted]
- zhte415 8y agoI too use Streisand. It has a vast plethora of options. I would warn this blessing can become its achilles heel as this introduces a potentially large attack space. I limit every deployment of it to Wireguard and OpenConnect only as these are the only options I use.
- TabTwo 8y agoTrue, it’s a Swiss Knife with way to many options. It’s ok for a vacation with your family in a country that blocks Wikipedia or you visit a place with shitty WLAN with blocked ports. Streisand takes 15 minutes to setup and your done. If you need something permanent like a company VPN, you really need to spend more than 15 minutes. Way more than that.
- thr0000waay 8y agoMeh. https://nixos.wiki/wiki/Wireguard https://nixos.wiki/wiki/Wireguard
- brian_herman 8y agoWow this is the best TechCrunch article I have seen in a while that has reached the front page! Dude whoever wrote this deserves a big ass raise!
- tempotemporary 8y agoIMO they simply had nothing else to write about. This is the first time I see “how to” on TechCrunch.
- cheghook 8y agoHmmm, I've always wondered why you'd want to run your own VPN server. The very first step is to rent a server from Microsoft/Google/DigitalOcean/etc and then setup the VPN on that server, right? But how does it help you stay anonymous? You are still paying for that server using your CC and they'd have your address and all other info. Unless I can rent the server anonymously, I can't see any point to run my own VPN server. That's why I'm paying a third party, PIA for example, to rent and run that server for me.
- aequitas 8y agoThere are many more uses for VPN then anonymity. Like securing communication between my devices networks, bypassing/escaping restricted networks (geolocked or captive portal, proxies).
- cabraca 8y agoi run my own vpn server because a) i already have a server for teamspeak and other smaller stuff and b) it allows me to use public wifi more securely.
- xfer 8y agoMost people use vpn to hide from their own ISP, that's a sad state of affairs.
- zhte415 8y agoI live in a country, of which there are many, that blocks most internet content of interest and heeavily logs and monitors the rest. However having developed this habit I quite like my ISP being unable to monitor me
- chrisper 8y agoYou can also run the VPN server at home. Then you dial in and you will be able to access all your home services!
- int0x80 8y agoWhat? E: NVM, you mean to access your stuff without NAT etc.
- sologoub 8y ago> Algo VPN runs on any Ubuntu server, but the easiest way to host your server is to create an account on DigitalOcean. Advertorial?
- andkenneth 8y agoI feel like saying the entire thing was written to direct people towards DO is stretching it just a tad. Possible that they have some affiliate program with DO? Sure. But Algo itself says that DO is the "most user friendly" on their github page.
- sologoub 8y agoConsidering Google Cloud is offering $300 credit and their Console is top notch AND offers browser based SSH. DO is not as obvious of a choice. Sustained use discount and top notch network further the case.
- obeattie 8y agoWe use Wireguard extensively at Monzo. It’s such a workhorse: extremely performant, straightforward to administer. Having dealt with the horrors of IPSec before, I can safely say I’d never go back.
- chrisper 8y agoI used IPSec before because OpenVPN was just too slow. Is Wireguard similar to OpenVPN when it comes to configs?
- dpwm 8y agoWireGuard is simpler to configure than OpenVPN and there's much less to tweak. A real-world config file can be under 10 lines for the client and under (10 + 5 * n_clients) lines for a server. Private and public keys are short base-64 encodings of 256-bit keys and can be generated with the wg command line tool. These live inside the config file.
- chrisper 8y agoI would like to try out WireGuard. Has anyone made any experience with TunSafe? https://tunsafe.com/ https://tunsafe.com/
- berti 8y agoIt's closed source crypto software. You can make your own judgement on how acceptable that is for you. Jason Donenfeld (Wireguard author) strongly recommends against it [1]. [1] https://lists.zx2c4.com/pipermail/wireguard/2018-March/002448.html https://lists.zx2c4.com/pipermail/wireguard/2018-March/00244...
- dpwm 8y agoWorth noting there was a HN discussion on it from 5 months ago. [0] I got the impression that ludde (the author of TunSafe) seems to think that people should trust him because he wrote uTorrent and he is, for reasons not specified, opposed to releasing it open source and suggests that the author of wireguard has a "general dislike against non open-source applications." For what it's worth I really cannot understand the mentality that would lead to you creating a high-quality, benign VPN client that you have no intention to charge for or sell and not wanting eyes (which have certainly been offered) to look over it before users rely on it. [0] https://news.ycombinator.com/item?id=16515637 https://news.ycombinator.com/item?id=16515637
- PlutoIsAPlanet 8y agoI'm still confused as to why Tunsafe isn't open-source. I feel like if he wanted people to trust it, open-sourcing it would be a way to go. There's nothing wrong with non open-source applications in general, but when it's a closed-source client of an open-source VPN server, you can't trust it, sorry.
- ludde 8y agoI don't want to lose control over it. If I open source it then anyone could just take it and rebrand it and pretend it's theirs.
- imhoguy 8y agoBeware of DNS leak [0]! It is easy to overlook when one configures own VPN solution. https://en.m.wikipedia.org/wiki/DNS_leak https://en.m.wikipedia.org/wiki/DNS_leak
- throwaway77384 8y agoIf you use OpenVPN, add the following (without quotes) at the end of your config file: "block-outside-dns" then run this test: https://www.dnsleaktest.com/ https://www.dnsleaktest.com/ I pass the extended test with it. Very easy and worth doing.
- nicois 8y agoWhat is the recommended way of UDP tunnelling wireguard? Is it necessary to run something like pwnat alongside it, or is there a better way? Using a TCP based VPN there are services such as ngrok for exposing only the VPN endpoint behind a NAT, but nothing equivalent for UDP. Unless it's possible to use the android and other clients to work in this way, it will limit the uptake of this, I believe.
- chungy 8y agoFor the sides that need to listen to an incoming connection (your server, typically), you'll need a direct port open, which might just be passed through via a NAT. For clients, it works like all other UDP applications, it just reaches out to the remote address and the NAT keeps a temporary mapping of the source and destination ports and addresses.
- puzzlingcaptcha 8y agoSo this requires maintaining an out-of-tree kernel module? Does it require rooting on android? I find OpenVPN plenty fast for personal use (with adjusted send/receive buffers and AES-NI on the server)
- dpwm 8y agoIn practice DKMS works well and is automated in many distros. You just notice updates take a bit longer as the WireGuard kernel module is built. I believe you can use wireguard-go on android, which doesn't require a kernel module.
- pferde 8y agoFor now, yes. There are efforts to get it into the Linux kernel, see https://lists.zx2c4.com/pipermail/wireguard/2018-July/003176.html https://lists.zx2c4.com/pipermail/wireguard/2018-July/003176...
- Tharre 8y agoIt does not require rooting on android, the wireguard app[0] falls back to the userspace implementation if the kernel module is not available. [0] https://play.google.com/store/apps/details?id=com.wireguard.android https://play.google.com/store/apps/details?id=com.wireguard....
- vbezhenar 8y agoI've heard a lot that WireGuard is faster than OpenVPN. I must admit that my OpenVPN connection manages few megabits even if my server allows 100 Mb/s and my home connection allows 300 Mb/s. I didn't test WireGuard, it seems too hard to configure yet, but I wonder why is it more performant?
- riobard 8y agoThe white paper has detailed section explaining the kernel implementation https://www.wireguard.com/papers/wireguard.pdf https://www.wireguard.com/papers/wireguard.pdf
- phaer 8y agoMostly because it uses a kernel module instead of a pure user-space daemon using `tun` drivers.
- StavrosK 8y agoI found it similarly hard to configure, so when I finally managed it, I wrote up how so you can try my configs: https://www.stavros.io/posts/how-to-configure-wireguard/ https://www.stavros.io/posts/how-to-configure-wireguard/
- deleted 8y ago[deleted]
- crtasm 8y agoGDPR prompt implementation is terrible, shows the article, then redirects to prompt, then reloads article! Have to press back three times to return to HN.
- StavrosK 8y agoI was going to post this tomorrow, but I figure people here might find it useful now. I wrote an article on how to configure Wireguard for common scenarios: https://www.stavros.io/posts/how-to-configure-wireguard/ https://www.stavros.io/posts/how-to-configure-wireguard/
- Foxboron 8y agoI think the wg0 references should be swapped with `%i` as the config is dependent on the filename with that setup. Neat write up however.
- StavrosK 8y agoOh, great suggestion, thanks for that! I'll update it as soon as I get home. EDIT: Updated and published, thanks again.
- codethief 8y agoThis is a great guide, thank you! One suggestion though (from someone who has never set up Wireguard before): Could you elaborate on what the "AllowedIPs" setting does exactly? The name confuses me as your comments suggest that it doesn't have anything to do with permissions (as in "allow connections from the following IP addresses") but rather specifies the IP address or range of IP addresses that locally (on the machine I'm configuring) should be associated with the remote peer in question. (Such that packets to these IP addresses get routed to said remote peer.) Is this correct?
- StavrosK 8y agoAlmost: It specifies which addresses or ranges the remote peer can send packets from. Basically, if a packet comes in on the interface with an address that's not in AllowedIPs, it gets dropped. That's why for the "tunnel everything" example, the AllowedIPs are "0.0.0.0/0", i.e. a wildcard, so that packets from all addresses are allowed to come in from the remote server. EDIT: I've updated the article with more information and a link to the official docs, which explain this better.
- kdv 8y agoI truly appreciate Wireguard's simplicity but what's the best way to handle key management and peer address assignment in larger deployments?
- StavrosK 8y agoThat's the only feature request I have as well. Something where you could reference a file would be ideal, for example your config could be: PrivateKey = !peername Publickey = !peername And the actual credentials could be in a separate file with a specific name, with one peer per line: peername:pubkeystring:privkeystring That would make deployments much easier, as the credentials could be handled separately. However, the peer address assignment is another good question. One file per peer would be better, I think, but you'd need something like another directory, and, at that point, you might as well write a script to take all your config and concatenate it into one file. That having been said, I don't know why that can't be a part of wg-quick.
- pt 8y agoOn the client, is it possible to setup an “always on” VPN? Such that when the client restarts on reboot, there is no internet connection until the VPN is on. Or when either the client or server glitches, the end point computer/mobile does not connect to the internet in the clear?
- diafygi 8y agoOn Ubuntu, for each wifi/wired connection settings, there's a checkbox and dropdown to automatically connect to one of your VPNs.
- sexydefinesher 8y agoIts really frustrating that there isnt an option to enable automatic VPN for all connections.