8 ms·

Off topic: Does anyone have a good tutorial on setting up Wiregaurd on a cloud server to act as a VPN? I’m currently using Algo from Trail of Bits, which is gre

by ghayes 8y ago

Off topic: Does anyone have a good tutorial on setting up Wiregaurd on a cloud server to act as a VPN? I’m currently using Algo from Trail of Bits, which is great, but takes a lot on control out of my hands through its Ansible scripts.

zwily 8y ago
https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand will do WireGuard.
iampims 8y ago
https://www.timdoug.com/log/2018/08/04/#wireguard_macos https://www.timdoug.com/log/2018/08/04/#wireguard_macos https://www.stavros.io/posts/how-to-configure-wireguard/ https://www.stavros.io/posts/how-to-configure-wireguard/ should be sufficient to help you set it up.
bubblethink 8y ago
Official documentation and the arch wiki (https://wiki.archlinux.org/index.php/WireGuard https://wiki.archlinux.org/index.php/WireGuard) are good sources
mirimir 8y ago
Others have posted great links. But one great aspect is how simple it is. The hardest part is getting a kernel module that works with your kernel. In my experience, the best way to do that is to build it. And that's the hardest part in getting WireGuard working. In Debian, that means using the latest stable release (at least) with the latest kernel. Once you have WireGuard working, creating tunnels is utterly trivial. For a toy implementation: peer 0 with IPv4 address 1.2.3.4 # ip link add dev wg0 type wireguard # ip link list [see wg0] # wg genkey | tee privatekey | wg pubkey > publickey # mkdir wg # mv privatekey publickey ./wg/ # ip address add dev wg0 10.0.10.1 peer 10.0.10.2 # wg set wg0 listen-port 51820 private-key ~/wg/privatekey # ip link set wg0 up # wg interface: wg0 public key: 0GS...0U= private key: (hidden) listening port: 51820 # wg set wg0 peer IlC...QI= allowed-ips 0.0.0.0/0 endpoint 6.7.8.9:51820 peer 1 with IPv4 address 6.7.8.9 # ip link add dev wg0 type wireguard # ip link list [see wg0] # wg genkey | tee privatekey | wg pubkey > publickey # mkdir wg # mv privatekey publickey ./wg/ # ip address add dev wg0 10.0.10.2 peer 10.0.10.1 # wg set wg0 listen-port 51820 private-key ~/wg/privatekey # ip link set wg0 up # wg interface: wg0 public key: IlC...QI= private key: (hidden) listening port: 51820 # wg set wg0 peer 0GS...0U= allowed-ips 0.0.0.0/0 endpoint 1.2.3.4:51820
- berti 8y ago
  Your distro's wireguard-dkms package is your friend.
  - mirimir 8y ago
    That didn't always make the nut :(
- rsync 8y ago
  "Others have posted great links. But one great aspect is how simple it is." (generate new keys to manage, create new network interfaces, assign new IPs, run wireguard ...) I would agree that this is relatively simple but only compared to the other mainstream options (namely, OpenVPN and IPSEC) but it is much, much more complicated than sshuttle[1] which distinguishes itself by allowing you to use any ssh server as a VPN endpoint. No server side software install is required - all you need on the endpoint is an ssh login. [1] https://github.com/sshuttle https://github.com/sshuttle
  - zx2c4 8y ago
    I think sshuttle is pretty cool. It does layer 3 tunneling over TCP in the right way. Usually when VPNs (like OpenVPN) try to tunnel IP packets over TCP, if those IP packets contain TCP data itself, then you have this problem with tunneling TCP over TCP, and the rate and congestion control algorithms of the two instances of TCP step all over each other, and performance becomes miserable. But sshuttle has done something pretty neat to fix that: it actually parses the TCP in the packets it receives, reconstructs those packets into a normal byte stream, and then sends that over TCP, reflowed, to then be converted back into the original TCP stream on the other end. It's a tiny bit involved, but they made it work well, and most of the time sshuttle "just works."
    - beagle3 8y ago
      Indeed. It even has (or at least had in previous versions) a configurable ping-time monitor that traded some bandwidth for interactivity - which is another part of what makes it work so well.
zigzaggy 8y ago
Just finished spinning up streisand to run Wireguard on my home network. This is my second time around with this set up, and it works great for me. https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand
trumped 8y ago
using a cloud server as your VPN? what made you come to that decision? how is that better then your ISP?
- hueving 8y ago
  The cloud providers havent shown themselves to be scum like some of the ISPs that happily inject Javascript into your http traffic.
  - trumped 8y ago
    might be true today
- cookiecaper 8y ago
  Comcast connections are metered for most residential users. Additional costs are incurred after 1TB of transfer. Also, home uplinks are generally pretty slow, and the VPN will be bottlenecked by its up speed.
  - trumped 8y ago
    you should be aware that VPN traffic still goes toward your 1TB data cap... actually, it probably uses a tiny more data then if you were not using a VPN...
    - icebraining 8y ago
      I think cookiecaper read your earlier message as "why don't you run the VPN endpoint in your home" rather than "why use a VPN at all if you're going to put the endpoint at a cloud service".
- jlgaddis 8y ago
  In my case, I work for an ISP -- althoug not my ISP -- and the "cloud server" is a small virtual guest (that I manage) in one of $work's facilities. Between $work and AT&T (my home ISP), who do you think I trust more? Many people have very little choice when it comes to the ISP they use. By setting up a "cloud server", at least they get to decide who, i.e. which cloud provider, has access to their traffic -- and can switch between providers much easier and at any time they wish.

by ghayes 8y ago

zwily 8y ago

https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand will do WireGuard.

iampims 8y ago

https://www.timdoug.com/log/2018/08/04/#wireguard_macos https://www.timdoug.com/log/2018/08/04/#wireguard_macos https://www.stavros.io/posts/how-to-configure-wireguard/ https://www.stavros.io/posts/how-to-configure-wireguard/ should be sufficient to help you set it up.

bubblethink 8y ago

Official documentation and the arch wiki (https://wiki.archlinux.org/index.php/WireGuard https://wiki.archlinux.org/index.php/WireGuard) are good sources

mirimir 8y ago

Others have posted great links. But one great aspect is how simple it is. The hardest part is getting a kernel module that works with your kernel. In my experience, the best way to do that is to build it. And that's the hardest part in getting WireGuard working. In Debian, that means using the latest stable release (at least) with the latest kernel. Once you have WireGuard working, creating tunnels is utterly trivial. For a toy implementation: peer 0 with IPv4 address 1.2.3.4 # ip link add dev wg0 type wireguard # ip link list [see wg0] # wg genkey | tee privatekey | wg pubkey > publickey # mkdir wg # mv privatekey publickey ./wg/ # ip address add dev wg0 10.0.10.1 peer 10.0.10.2 # wg set wg0 listen-port 51820 private-key ~/wg/privatekey # ip link set wg0 up # wg interface: wg0 public key: 0GS...0U= private key: (hidden) listening port: 51820 # wg set wg0 peer IlC...QI= allowed-ips 0.0.0.0/0 endpoint 6.7.8.9:51820 peer 1 with IPv4 address 6.7.8.9 # ip link add dev wg0 type wireguard # ip link list [see wg0] # wg genkey | tee privatekey | wg pubkey > publickey # mkdir wg # mv privatekey publickey ./wg/ # ip address add dev wg0 10.0.10.2 peer 10.0.10.1 # wg set wg0 listen-port 51820 private-key ~/wg/privatekey # ip link set wg0 up # wg interface: wg0 public key: IlC...QI= private key: (hidden) listening port: 51820 # wg set wg0 peer 0GS...0U= allowed-ips 0.0.0.0/0 endpoint 1.2.3.4:51820

berti 8y ago
Your distro's wireguard-dkms package is your friend.
- mirimir 8y ago
  That didn't always make the nut :(
rsync 8y ago
"Others have posted great links. But one great aspect is how simple it is." (generate new keys to manage, create new network interfaces, assign new IPs, run wireguard ...) I would agree that this is relatively simple but only compared to the other mainstream options (namely, OpenVPN and IPSEC) but it is much, much more complicated than sshuttle[1] which distinguishes itself by allowing you to use any ssh server as a VPN endpoint. No server side software install is required - all you need on the endpoint is an ssh login. [1] https://github.com/sshuttle https://github.com/sshuttle
- zx2c4 8y ago
  I think sshuttle is pretty cool. It does layer 3 tunneling over TCP in the right way. Usually when VPNs (like OpenVPN) try to tunnel IP packets over TCP, if those IP packets contain TCP data itself, then you have this problem with tunneling TCP over TCP, and the rate and congestion control algorithms of the two instances of TCP step all over each other, and performance becomes miserable. But sshuttle has done something pretty neat to fix that: it actually parses the TCP in the packets it receives, reconstructs those packets into a normal byte stream, and then sends that over TCP, reflowed, to then be converted back into the original TCP stream on the other end. It's a tiny bit involved, but they made it work well, and most of the time sshuttle "just works."
  - beagle3 8y ago
    Indeed. It even has (or at least had in previous versions) a configurable ping-time monitor that traded some bandwidth for interactivity - which is another part of what makes it work so well.

zigzaggy 8y ago

Just finished spinning up streisand to run Wireguard on my home network. This is my second time around with this set up, and it works great for me. https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand

trumped 8y ago

using a cloud server as your VPN? what made you come to that decision? how is that better then your ISP?

hueving 8y ago
The cloud providers havent shown themselves to be scum like some of the ISPs that happily inject Javascript into your http traffic.
- trumped 8y ago
  might be true today
cookiecaper 8y ago
Comcast connections are metered for most residential users. Additional costs are incurred after 1TB of transfer. Also, home uplinks are generally pretty slow, and the VPN will be bottlenecked by its up speed.
- trumped 8y ago
  you should be aware that VPN traffic still goes toward your 1TB data cap... actually, it probably uses a tiny more data then if you were not using a VPN...
  - icebraining 8y ago
    I think cookiecaper read your earlier message as "why don't you run the VPN endpoint in your home" rather than "why use a VPN at all if you're going to put the endpoint at a cloud service".
jlgaddis 8y ago
In my case, I work for an ISP -- althoug not my ISP -- and the "cloud server" is a small virtual guest (that I manage) in one of $work's facilities. Between $work and AT&T (my home ISP), who do you think I trust more? Many people have very little choice when it comes to the ISP they use. By setting up a "cloud server", at least they get to decide who, i.e. which cloud provider, has access to their traffic -- and can switch between providers much easier and at any time they wish.