14 ms·

WireGuard VPN review: A new type of VPN offers serious advantages

pimeys 8y ago
Having been running WireGuard in my router for a couple of months now I have to say it's just the first ever VPN to offer no bandwidth penalty and a very easy setup. Now I have IPv6 through the VPN, all traffic from the house is routed through anonymous servers and I've had no problems with the connection dropping. Very nice work here.
- wyldfire 8y ago
  Are there commercial providers?
  - jensv 8y ago
    Yes, see https://mullvad.net/en/guides/category/wireguard/ https://mullvad.net/en/guides/category/wireguard/
  - pimeys 8y ago
    Yep. https://mullvad.net/en/ https://mullvad.net/en/ Many servers. Can pay with bitcoin. You only get a randomized account number. /128 subnet for IPv6. https://www.azirevpn.com/ https://www.azirevpn.com/ A bit less servers. No need to give email. /64 subnet for IPv6.
    - heh 8y ago
      Mullvad also doesn't require an email, and you can mail them cash anonymously.
      - pimeys 8y ago
        Yep. And the service with both of these is top notch.
        nickik 8y ago
        Talked to some of the guys at a conference. They are really nice and they are doing a lot with Wireguard, helping if financially as well.
- sealthedeal 8y ago
  do you have a write up of this and how you configured your router, etc?
- corybrown 8y ago
  What router do you have that lets you run wire guard?
  - ac29 8y ago
    You can run it on Ubiquiti's EdgeRouters: https://community.ubnt.com/t5/EdgeRouter/Release-WireGuard-for-EdgeRouter/td-p/1904764 https://community.ubnt.com/t5/EdgeRouter/Release-WireGuard-f...
    - dogecoinbase 8y ago
      To be fair, then your bandwidth penalty just comes from something else. (I run a large number of ERs, mostly because you can easily run so much other software on the hardware -- but they're not great devices if you need performance or reliability. "You get what you pay for" absolutely applies.)
    - technofiend 8y ago
      And if you're feeling like a fun weekend hacking project it's also available on OpenBSD which runs on the EdgeRouter including support for the onboard packet accelerator. https://marc.info/?l=openbsd-ports&m=152712417729497&w=2 https://marc.info/?l=openbsd-ports&m=152712417729497&w=2 Nothing against vyatta/edgeos but since getting into edge cases requires command line anyway, you can just start there without too much trouble.
      - IcePic 8y ago
        You just get to port Go to octeons during that weekend then. But if you do, I will be happy! \o/
  - aaronmdjones 8y ago
    OpenWRT has WireGuard support, so also, every router you can put an OpenWRT image on. EDIT: I'm using it on my Netgear WNDR3800, and my grandmother's Sitecom WLR-4000 (which is a rebranded Sitecom WL-351, which is a rebranded EnGenius ESR9850).
  - 8y ago
- zamadatix 8y ago
  > I have to say it's just the first ever VPN to offer no bandwidth penalty By protocol design it incurs a 4%-~50% (1500 byte and 64 byte packets respectively) bandwidth penalty over the internet due to headers. The encryption of the payload is extremely fast though.
  - pimeys 8y ago
    Of course I was exaggerating a bit. But... I've been trying to setup OpenVPN for ages, and it always eats about 60-80% of the bandwidth. No matter what I try with it, I just cannot get the full speed of my internet connection through the protocol. With Wireguard I haven't noticed any difference. fast.com is as fast with or without WireGuard. I have to say it's the first time in my life I see it working this easily.
- ericnyamu 8y ago
  Am assuming you get your full bandwidth when you do a speedtest via wireguard ?
Sami_Lehtinen 8y ago
4096 bit keys, comparison, aah. Sounds like the crypto stuff is really badly off in this article. Key length alone doesn't practically mean anything. Classic VPN lies and hype.
- borski 8y ago
  Did you read the article? The author agrees with you, and talks about why 4096-bit keys are not inherently more secure...
  - SlowRobotAhead 8y ago
    12 cheeseburgers are more than 1, but pretty useless to me because 1 is really all I can use. If current openvpn or IPSEC isn’t being cracked, there is only more energy wasted in going to 4096bit keys. Edit: lol downvotes... ok, cool. Tell me who is breaking 2048bit diffiehellman exchange to 256bit AES in CBC mode. I’ll wait right here.
    - rubatuga 8y ago
      Except cheeseburgers rot, but crypto doesn’t. 4096 keys might be useful twenty years in the future.
    - y4mi 8y ago
      You are probably getting downvoted because the article points out exactly that. The author was erroneously thinking that a big key is necessary - and wireguard doesn't provide one. Which made him discover that fallacy.
  - computerfriend 8y ago
    The author seems to misunderstand that the 4096 bit keys are RSA keys, not elliptic curve or symmetric AES keys.
    - Dylan16807 8y ago
      The reason OpenVPN (and almost all VPN solutions) use such ridiculously long keys is that you don't have to brute-force them. An actual cryptographic attack on the algorithms commonly used for VPNs (or for HTTPS connections to websites) looks a lot more like a dictionary attack than a brute-force attack; you can discount great swathes of the problem space without having to actually try them. That explanation seems fine to me. It's not an explanation of the underlying math but it doesn't need to be.
hbcondo714 8y ago
> Waiting for Windows support is going to put WireGuard out of reach for many users for another few months. Haven't tried it yet but Mullvad.net just released a VPN app for Windows: https://mullvad.net/en/blog/2018/8/14/official-release-new-mullvad-vpn-app-windows/ https://mullvad.net/en/blog/2018/8/14/official-release-new-m...
- middleclick 8y ago
  That's interesting, it's refreshing to see open source VPN apps (desktop or mobile).
- detaro 8y ago
  are you sure that uses Wireguard?
  - eptcyka 8y ago
    Not yet, but it's in the works. There currently isn't a stable userspace implementation of Wireguard that would work on all the major platforms anyway :(
dewey 8y ago
Is there any "easy" algo-like setup? I've checked but all of them still seem to involve a lot of steps. I could do it but I'd prefer if there's some quick start to test it out.
- eat_veggies 8y ago
  Algo already supports it
  - deleted 8y ago
    [deleted]
- StavrosK 8y ago
  I wrote a guide, you can just copy my configs: https://www.stavros.io/posts/how-to-configure-wireguard/ https://www.stavros.io/posts/how-to-configure-wireguard/
  - pvg 8y ago
    It's a nice enough guide but its default set up is something 97.30133% (recurring, of course) users aren't trying to do with a VPN - reach a home computer from their server. What most people want is to shovel all their client's traffic through the server. This is also described as a sort of afterthought, but I think for most people, it's the thing they're trying to accomplish when they want to set up a VPN.
- pvg 8y ago
  Algo supports it, without being super-obvious about it. When it's done doing its thing, fish out the generated wireguard client config from algo/configs/your.server.ip/wireguard/uname.conf Add PersistentKeepalive = 25 as the last line (should be in the [Peer] section). Feed the conf file to your client. That's it.
  - aorth 8y ago
    I've been using WireGuard via algo for a few months and love it. What does PersistentKeepalive do?
dingaling 8y ago
Unfortunately WireGuard is UDP only, so I can't even use it to get out through the university wifi firewall. 80 / 443 on TCP only. At least OpenVPN, for all the criticism the article throws at it, has the configurability to pass through the various strange firewall rules that exist in the real World. Waiting eight seconds for negotiation isn't a big deal when the new and shiny 'replacement' doesn't have a hope of working.
- lucb1e 8y ago
  I was going to say that that's illegal but you're probably from the USA, right? I'm not sure what the status there on net neutrality is right now. Edit: going by downvotes, it still seems to be a sore spot. That answers my question about its current status in the USA I suppose...
  - nickik 8y ago
    You clearly don't know what net neutrality is.
    - lucb1e 8y ago
      I'm not sure that I don't, I've followed new IT-related laws in the Netherlands closely so I'm pretty sure I know what's included without looking it up. I'm more sceptical of someone who says "you have no idea" without anything to back that statement up. But for other readers, I'll elaborate. Blocking UDP is not treating all traffic the same. Even if the law would be about treating services equally and not any IP packet equally, then it still has a different impact on services like VoIP (which are often UDP) than it does on other services. Blocking certain types of packets is not compliant with net neutrality -- at least, not in the Netherlands. If there is a different definition whereever you come from, please tell me about it.
      - zamadatix 8y ago
        I have a feeling it's a bit more nuanced than that otherwise you're telling me a University in the Netherlands can't run a firewall on their internet link and they need to have all public addresses to get around the fact that no device dynamically NATs all L4 protocols. I'd be willing to bet my lunch that there are exceptions for private, government, and educational institutions or that there is an exception related to security services.
StavrosK 8y ago
If you aren't using WireGuard yet, do. Setting it up is super easy, I wrote a guide for common setups: https://www.stavros.io/posts/how-to-configure-wireguard/ https://www.stavros.io/posts/how-to-configure-wireguard/
- rahimnathwani 8y ago
  This is a great guide. Thanks. I was reading it just yesterday. If Algo had supported WireGuard at the time you looked into this, would you still have done it yourself?
  - StavrosK 8y ago
    I'm not sure how Algo does it, but the configuration is easy enough. I wouldn't do it without the post to help me, because it took a long time to figure it out, but copying two files isn't much hassle.
    - rahimnathwani 8y ago
      Cool. I'll try it out this week. My current VPN uses shadowsocks tunneled over KCPTUN, but I don't think I've optimised the KCPTUN parameters well enough, as the throughput is similar with and without it. I'm curious to see what throughput I get with WireGuard.
andrewflnr 8y ago
Regarding the whole-protocol versions instead of mix and match negotiation: is there a reason that wouldn't have worked for TLS? At least technologically; I'm sure it was a non-starter politically. I'm just wondering if there are any actual downsides to this scheme. It seems like such an obviously good idea that I'm second-guessing myself.
- hedora 8y ago
  I wonder if protocol agility was pushed through the IETF as part of the NSA’s intentional weakening of crypto protocols.
  - saas_co_de 8y ago
    It was required to comply with US laws against exporting strong cryptography. In order to have a global standard the protocol had to be decoupled from the crypto implementation and clients had to be able to negotiate down to the (broken) crypto approved for export. https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...
- loeg 8y ago
  It would have worked fine for SSL (now TLS). Wireguard has the advantage of being able to learn from decades of experience with real world SSL/TLS vulnerabilities — the advantage of hindsight.
- tialaramex 8y ago
  SSL and especially TLS are used in lots of different applications. So either most of them don't get the features they want in this scenario, or they all use mutually incompatible protocols. The no-negotiation approach also means if things change you can't find out why you can't connect. Maybe you need to upgrade your software? Or downgrade it? Did you change any settings? It's a mystery!
Johnny555 8y ago
Is Wireguard stable and ready for general use? The Wireguard devs seem to think it's not: https://www.wireguard.com/#about-the-project https://www.wireguard.com/#about-the-project Work in Progress WireGuard is not yet complete. You should not rely on this code. It has not undergone proper degrees of security auditing and the protocol is still subject to change. We're working toward a stable 1.0 release, but that time has not yet come. There are experimental snapshots tagged with "0.0.YYYYMMDD", but these should not be considered real releases and they may contain security vulnerabilities (which would not be eligible for CVEs, since this is pre-release snapshot software). If you are packaging WireGuard, you must keep up to date with the snapshots.
- chme 8y ago
  When it has been reviewed merged into the mainline linux kernel, then it can be considered stable. AFAIK Jason does use wireguard for himself now, but is cautious to recommend that to everyone. The last submission to the linux kernel is here: http://lkml.iu.edu/hypermail/linux/kernel/1808.3/00619.html http://lkml.iu.edu/hypermail/linux/kernel/1808.3/00619.html While merging wireguard should not be a problem, its own crypto library called 'zinc' has bigger open points of discussion.
  - viraptor 8y ago
    Merging into mainline doesn't mean things are stable. There's a few experimental options available when compiling the kernel.
    - pnutjam 8y ago
      Btrfs has been in the kernel for years.
      - viraptor 8y ago
        I'm not sure if this was meant as a jab or accurate, but btrfs is a good example. The core of it is stable, but there are a few features which are unstable/experimental, yet still included.
adrian_mrd 8y ago
Does anyone know if any commercial VPN providers implement WireGuard yet on iOS? > "An iOS app is available in the WireGuard repository, but as it isn't in the App Store yet. It's probably not going to do you any good unless you're an iOS developer yourself." The article references code for iOS apps but also states that "it needs to be baked right into the kernel for that to happen.". Would iOS apps also need the iOS Kernel (say iOS 12.x or iOS 13.x) to include WireGuard to take advantage of some of the speed advantages over OpenVPN?
- monocularvision 8y ago
  I don’t think so, although I am hardly an expert. The iOS SDK has the ability for apps to provide custom VPN implementations for use system wide (see: https://developer.apple.com/documentation/networkextension/nepackettunnelprovider https://developer.apple.com/documentation/networkextension/n... ) I don’t know if WireGuard being UDP causes issues, but I would assume it is possible.
- zx2c4 8y ago
  WireGuard even in userspace is generally pretty fast anyway, since it's multi-threaded.
codedokode 8y ago
I don't like that it is running in the kernel. Running in userspace makes everything more secure and I'm fine with little less bandwith.
- helper 8y ago
  There's a userspace implementation you can use if you want.
- confounded 8y ago
  Not doubting you, but ignorant and curious. What’s the security benefit of userspace? Easier to introspect/update/verify?
  - chrisper 8y ago
    You won't get access to kernel memory space (I think).
  - codedokode 8y ago
    If the kernel code is vulnerable then the attacker gets full control over your system. They can also easily hide their presence. If the code is in userspace, the attacker won't even be able to read your files if you run the daemon under a separate user account. They only will be able to mine Bitcoins or use your computer as a proxy for a short time.
A_No_Name_Mouse 8y ago
I love the Android client. OpenVPN used to consume some 25% of the battery life. With wireguard it's next to nothing and it's very very quick to connect. Great stuff!
nemoniac 8y ago
Tried it but couldn't make it work. When someone provides instructions to set up a WireGuard server on my Linux server and a client on my Android, I might just buy into that "easy setup" story.
- computerfriend 8y ago
  There's plenty of tutorials, including a couple posted in this thread. It's unfortunate that you had a bad experience setting it up, since it is usually pretty simple. But I think the "easy setup" is relative to the setup for OpenVPN, etc.
bmacauley 8y ago
From a security perspective, what happens if the wireguard key is passed to another user? How would you implement MFA in a wireguard system?
- helper 8y ago
  This is what Jason said the last time it came up on the mailing list[1]: "I think that given the WireGuard building block, it's certainly possible to build a 2FA framework around it. And I do generally like 2FA and short-lived credentials and such. Probably after getting the implementations buttoned up -- kernel mainline, windows, etc -- I'll turn a bit of attention to expanding tooling and full packages around the simple wg0 interface." [1]:https://www.mail-archive.com/wireguard@lists.zx2c4.com/msg02882.html https://www.mail-archive.com/wireguard@lists.zx2c4.com/msg02...
auslander 8y ago
Is supporting EAP planned? Like EAP-IKEv2, which can use passwords for authentication and session keys, RFC3748 ?
- helper 8y ago
  No.
xmichael999 8y ago
I feel I gotta mention Tinc https://www.tinc-vpn.org https://www.tinc-vpn.org The article mentions it's existence but then ignores it... It is as easy to use as WireGuard and has two advantages over wireguard. 1. It will automatically mess, and find the best path. 2. It has a far wider range of platforms supported than wireguard.
- galadran 8y ago
  tinc is not a secure choice! Have you seen their documentation? https://www.tinc-vpn.org/documentation/Security.html#Security https://www.tinc-vpn.org/documentation/Security.html#Securit... The default cipher is from 1993 and its creator recommends everyone updates. 32 bit MACs are hilariously tiny. Home rolled authentication based around RSA. Their own documentation even states: ”tinc’s security is not as strong as TLS or IPsec." DO NOT USE tinc!
  - Freaky 8y ago
    New deployments should be with 1.1 using its new protocol. https://www.tinc-vpn.org/documentation-1.1/Simple-Peer_002dto_002dPeer-Security.html https://www.tinc-vpn.org/documentation-1.1/Simple-Peer_002dt...
    - galadran 8y ago
      That does look a lot better, however: a) its not supported by the stable release b) There are no claims about downgrade resistance. The manual specifies the new transport protocol is used if both clients support it and both have changed their configs to enable experimental mode. Can an attacker still force them to connect with legacy mode? c) Users have to ensure every single config on every client has the correct setting. d) It still doesn't have the identity hiding features of Wireguard. (Someone observing your network traffic can see which servers you are talking to from the transmitted signatures)
      - Freaky 8y ago
        You can disable legacy support by not generating any RSA keys, or by building with DISABLE_LEGACY.
SEJeff 8y ago
Linus is also a huge fan of wireguard overall: http://lkml.iu.edu/hypermail/linux/kernel/1808.0/02472.html http://lkml.iu.edu/hypermail/linux/kernel/1808.0/02472.html Praise like this from him is rare.
- scriptsmith 8y ago
  His comment appears in the third paragraph of the article
- snaky 8y ago
  Linus never was a big fan of serious security matters. He is interested primarily in simple, small code that is simple to maintain, code that doesn't require any serious changes in other parts of the kernel, that's it.
linsomniac 8y ago
I wonder how it works in ChromeOS, anyone tried it? I had OpenVPN working for a while, but the debugibility of it was pretty low, it was a pain to set up. I was always turning it on and off, unlike my Linux laptop where it would just always be on and working. That's using the built in OpenVPN, not an android app. I wonder if setting it up in the "ChromeOS centrally managed" mode would help any? I'm really using my chromebook a lot these days at home, but wish I had a better VPN option for it.
amckinlay 8y ago
Why can't we have IPSec + IKEv2 everywhere as originally intended as part of IPv6. No "VPN" necessary.
- felix_nagaand 8y ago
  That makes snooping much more difficult.
- MaxBarraclough 8y ago
  We're not in IPv6 world yet, but even if we were, Amazon AWS EC2 would doubtless continue to make IPSec awkward. They only route UDP and TCP to your VM, so if you want IPSec, you have to mess about with 'Amazon Virtual Private Cloud'.
edwinyzh 8y ago
I don't know much about the fundamentals of networking and security, just asking - can a Linux server with WireGuard installed to be able be detected by GFW (the Great FireWall) and thus get the IP address blocked? On the other hand, I couldn't wait for the Windows client.
- computerfriend 8y ago
  In principle, yes.
rooam-dev 8y ago
Recently we had to decide what to use and went with IPSec instead of WireGuard. Any reasons to reconsider and switch to WG? Thanks.
- chrisper 8y ago
  Less complex and easier on firewall traversals.
  - rooam-dev 8y ago
    Easier from performance point of view? Thanks.
    - chrisper 8y ago
      I think IPSec needs special treatment when it comes to NAT port forwarding. WireGuard claims this is not necessary with wireguard.
fulafel 8y ago
If you'd like to run a memory-safe-ish implementation of WireGuard, apparently there is a working Go version: https://www.wireguard.com/xplatform/ https://www.wireguard.com/xplatform/
syedamer 8y ago
What bothers me in the Article, the official documentation and almost all guides for wireguard is that they ignore ipv6 completely. They either result in a leaking vpn or bad working one where all ipv6 connections fail.
- bjoli 8y ago
  Doesn't it just tunnel everything on one interface? In my tests, using a minimal config, ipv6 is tunneled just fine without extra consideration. The only thing I have added is a kill switch that blocks internet access if the WG interface goes down.
jorangreef 8y ago
"SipHash24 for hashtable keys" Someone can correct me, but I would prefer Tabulation Hashing to SipHash, even though SipHash is by DJB. Tabulation Hashing offers optimal guarantees and performance, and it's much simpler.
opk 8y ago
So the control program is just "wg". We only have one namespace for commands so using a two-letter combination for something as obscure as controlling VPNs is not very clever. Two-letter combinations should be left to user aliases and core things like cp, ls, df.
- majewsky 8y ago
  I sure use "wg" more often than I use "ul", "as", "bc", "eg", "ex", "gc", "id", "ld", "nl", "od", "pr", "sg", "tc" and "ul". All these courtesy of `ls {,/usr}/{,s}bin/??`. In fact, there are only 44 two-lettered commands on my (Arch Linux) system right now, so this particular realm appears to be very sparsely populated. (Not counting shell builtins though.)
zanchey 8y ago
Automatic roaming seems to be the killer feature that nobody has noticed - I know IPsec has this to a degree but Wireguard looks like it works much faster.

Having been running WireGuard in my router for a couple of months now I have to say it's just the first ever VPN to offer no bandwidth penalty and a very easy setup. Now I have IPv6 through the VPN, all traffic from the house is routed through anonymous servers and I've had no problems with the connection dropping. Very nice work here.

wyldfire 8y ago
Are there commercial providers?
- jensv 8y ago
  Yes, see https://mullvad.net/en/guides/category/wireguard/ https://mullvad.net/en/guides/category/wireguard/
- pimeys 8y ago
  Yep. https://mullvad.net/en/ https://mullvad.net/en/ Many servers. Can pay with bitcoin. You only get a randomized account number. /128 subnet for IPv6. https://www.azirevpn.com/ https://www.azirevpn.com/ A bit less servers. No need to give email. /64 subnet for IPv6.
  - heh 8y ago
    Mullvad also doesn't require an email, and you can mail them cash anonymously.
    - pimeys 8y ago
      Yep. And the service with both of these is top notch.
      - nickik 8y ago
        Talked to some of the guys at a conference. They are really nice and they are doing a lot with Wireguard, helping if financially as well.
sealthedeal 8y ago
do you have a write up of this and how you configured your router, etc?
corybrown 8y ago
What router do you have that lets you run wire guard?
- ac29 8y ago
  You can run it on Ubiquiti's EdgeRouters: https://community.ubnt.com/t5/EdgeRouter/Release-WireGuard-for-EdgeRouter/td-p/1904764 https://community.ubnt.com/t5/EdgeRouter/Release-WireGuard-f...
  - dogecoinbase 8y ago
    To be fair, then your bandwidth penalty just comes from something else. (I run a large number of ERs, mostly because you can easily run so much other software on the hardware -- but they're not great devices if you need performance or reliability. "You get what you pay for" absolutely applies.)
  - technofiend 8y ago
    And if you're feeling like a fun weekend hacking project it's also available on OpenBSD which runs on the EdgeRouter including support for the onboard packet accelerator. https://marc.info/?l=openbsd-ports&m=152712417729497&w=2 https://marc.info/?l=openbsd-ports&m=152712417729497&w=2 Nothing against vyatta/edgeos but since getting into edge cases requires command line anyway, you can just start there without too much trouble.
    - IcePic 8y ago
      You just get to port Go to octeons during that weekend then. But if you do, I will be happy! \o/
- aaronmdjones 8y ago
  OpenWRT has WireGuard support, so also, every router you can put an OpenWRT image on. EDIT: I'm using it on my Netgear WNDR3800, and my grandmother's Sitecom WLR-4000 (which is a rebranded Sitecom WL-351, which is a rebranded EnGenius ESR9850).
- 8y ago
zamadatix 8y ago
> I have to say it's just the first ever VPN to offer no bandwidth penalty By protocol design it incurs a 4%-~50% (1500 byte and 64 byte packets respectively) bandwidth penalty over the internet due to headers. The encryption of the payload is extremely fast though.
- pimeys 8y ago
  Of course I was exaggerating a bit. But... I've been trying to setup OpenVPN for ages, and it always eats about 60-80% of the bandwidth. No matter what I try with it, I just cannot get the full speed of my internet connection through the protocol. With Wireguard I haven't noticed any difference. fast.com is as fast with or without WireGuard. I have to say it's the first time in my life I see it working this easily.
ericnyamu 8y ago
Am assuming you get your full bandwidth when you do a speedtest via wireguard ?

Sami_Lehtinen 8y ago

4096 bit keys, comparison, aah. Sounds like the crypto stuff is really badly off in this article. Key length alone doesn't practically mean anything. Classic VPN lies and hype.

borski 8y ago
Did you read the article? The author agrees with you, and talks about why 4096-bit keys are not inherently more secure...
- SlowRobotAhead 8y ago
  12 cheeseburgers are more than 1, but pretty useless to me because 1 is really all I can use. If current openvpn or IPSEC isn’t being cracked, there is only more energy wasted in going to 4096bit keys. Edit: lol downvotes... ok, cool. Tell me who is breaking 2048bit diffiehellman exchange to 256bit AES in CBC mode. I’ll wait right here.
  - rubatuga 8y ago
    Except cheeseburgers rot, but crypto doesn’t. 4096 keys might be useful twenty years in the future.
  - y4mi 8y ago
    You are probably getting downvoted because the article points out exactly that. The author was erroneously thinking that a big key is necessary - and wireguard doesn't provide one. Which made him discover that fallacy.
- computerfriend 8y ago
  The author seems to misunderstand that the 4096 bit keys are RSA keys, not elliptic curve or symmetric AES keys.
  - Dylan16807 8y ago
    The reason OpenVPN (and almost all VPN solutions) use such ridiculously long keys is that you don't have to brute-force them. An actual cryptographic attack on the algorithms commonly used for VPNs (or for HTTPS connections to websites) looks a lot more like a dictionary attack than a brute-force attack; you can discount great swathes of the problem space without having to actually try them. That explanation seems fine to me. It's not an explanation of the underlying math but it doesn't need to be.

hbcondo714 8y ago

> Waiting for Windows support is going to put WireGuard out of reach for many users for another few months. Haven't tried it yet but Mullvad.net just released a VPN app for Windows: https://mullvad.net/en/blog/2018/8/14/official-release-new-mullvad-vpn-app-windows/ https://mullvad.net/en/blog/2018/8/14/official-release-new-m...

middleclick 8y ago
That's interesting, it's refreshing to see open source VPN apps (desktop or mobile).
detaro 8y ago
are you sure that uses Wireguard?
- eptcyka 8y ago
  Not yet, but it's in the works. There currently isn't a stable userspace implementation of Wireguard that would work on all the major platforms anyway :(

dewey 8y ago

Is there any "easy" algo-like setup? I've checked but all of them still seem to involve a lot of steps. I could do it but I'd prefer if there's some quick start to test it out.

eat_veggies 8y ago
Algo already supports it
- deleted 8y ago
  [deleted]
StavrosK 8y ago
I wrote a guide, you can just copy my configs: https://www.stavros.io/posts/how-to-configure-wireguard/ https://www.stavros.io/posts/how-to-configure-wireguard/
- pvg 8y ago
  It's a nice enough guide but its default set up is something 97.30133% (recurring, of course) users aren't trying to do with a VPN - reach a home computer from their server. What most people want is to shovel all their client's traffic through the server. This is also described as a sort of afterthought, but I think for most people, it's the thing they're trying to accomplish when they want to set up a VPN.
pvg 8y ago
Algo supports it, without being super-obvious about it. When it's done doing its thing, fish out the generated wireguard client config from algo/configs/your.server.ip/wireguard/uname.conf Add PersistentKeepalive = 25 as the last line (should be in the [Peer] section). Feed the conf file to your client. That's it.
- aorth 8y ago
  I've been using WireGuard via algo for a few months and love it. What does PersistentKeepalive do?

dingaling 8y ago

Unfortunately WireGuard is UDP only, so I can't even use it to get out through the university wifi firewall. 80 / 443 on TCP only. At least OpenVPN, for all the criticism the article throws at it, has the configurability to pass through the various strange firewall rules that exist in the real World. Waiting eight seconds for negotiation isn't a big deal when the new and shiny 'replacement' doesn't have a hope of working.

lucb1e 8y ago
I was going to say that that's illegal but you're probably from the USA, right? I'm not sure what the status there on net neutrality is right now. Edit: going by downvotes, it still seems to be a sore spot. That answers my question about its current status in the USA I suppose...
- nickik 8y ago
  You clearly don't know what net neutrality is.
  - lucb1e 8y ago
    I'm not sure that I don't, I've followed new IT-related laws in the Netherlands closely so I'm pretty sure I know what's included without looking it up. I'm more sceptical of someone who says "you have no idea" without anything to back that statement up. But for other readers, I'll elaborate. Blocking UDP is not treating all traffic the same. Even if the law would be about treating services equally and not any IP packet equally, then it still has a different impact on services like VoIP (which are often UDP) than it does on other services. Blocking certain types of packets is not compliant with net neutrality -- at least, not in the Netherlands. If there is a different definition whereever you come from, please tell me about it.
    - zamadatix 8y ago
      I have a feeling it's a bit more nuanced than that otherwise you're telling me a University in the Netherlands can't run a firewall on their internet link and they need to have all public addresses to get around the fact that no device dynamically NATs all L4 protocols. I'd be willing to bet my lunch that there are exceptions for private, government, and educational institutions or that there is an exception related to security services.

StavrosK 8y ago

If you aren't using WireGuard yet, do. Setting it up is super easy, I wrote a guide for common setups: https://www.stavros.io/posts/how-to-configure-wireguard/ https://www.stavros.io/posts/how-to-configure-wireguard/

rahimnathwani 8y ago
This is a great guide. Thanks. I was reading it just yesterday. If Algo had supported WireGuard at the time you looked into this, would you still have done it yourself?
- StavrosK 8y ago
  I'm not sure how Algo does it, but the configuration is easy enough. I wouldn't do it without the post to help me, because it took a long time to figure it out, but copying two files isn't much hassle.
  - rahimnathwani 8y ago
    Cool. I'll try it out this week. My current VPN uses shadowsocks tunneled over KCPTUN, but I don't think I've optimised the KCPTUN parameters well enough, as the throughput is similar with and without it. I'm curious to see what throughput I get with WireGuard.

andrewflnr 8y ago

Regarding the whole-protocol versions instead of mix and match negotiation: is there a reason that wouldn't have worked for TLS? At least technologically; I'm sure it was a non-starter politically. I'm just wondering if there are any actual downsides to this scheme. It seems like such an obviously good idea that I'm second-guessing myself.

hedora 8y ago
I wonder if protocol agility was pushed through the IETF as part of the NSA’s intentional weakening of crypto protocols.
- saas_co_de 8y ago
  It was required to comply with US laws against exporting strong cryptography. In order to have a global standard the protocol had to be decoupled from the crypto implementation and clients had to be able to negotiate down to the (broken) crypto approved for export. https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...
loeg 8y ago
It would have worked fine for SSL (now TLS). Wireguard has the advantage of being able to learn from decades of experience with real world SSL/TLS vulnerabilities — the advantage of hindsight.
tialaramex 8y ago
SSL and especially TLS are used in lots of different applications. So either most of them don't get the features they want in this scenario, or they all use mutually incompatible protocols. The no-negotiation approach also means if things change you can't find out why you can't connect. Maybe you need to upgrade your software? Or downgrade it? Did you change any settings? It's a mystery!

Johnny555 8y ago

Is Wireguard stable and ready for general use? The Wireguard devs seem to think it's not: https://www.wireguard.com/#about-the-project https://www.wireguard.com/#about-the-project Work in Progress WireGuard is not yet complete. You should not rely on this code. It has not undergone proper degrees of security auditing and the protocol is still subject to change. We're working toward a stable 1.0 release, but that time has not yet come. There are experimental snapshots tagged with "0.0.YYYYMMDD", but these should not be considered real releases and they may contain security vulnerabilities (which would not be eligible for CVEs, since this is pre-release snapshot software). If you are packaging WireGuard, you must keep up to date with the snapshots.

chme 8y ago
When it has been reviewed merged into the mainline linux kernel, then it can be considered stable. AFAIK Jason does use wireguard for himself now, but is cautious to recommend that to everyone. The last submission to the linux kernel is here: http://lkml.iu.edu/hypermail/linux/kernel/1808.3/00619.html http://lkml.iu.edu/hypermail/linux/kernel/1808.3/00619.html While merging wireguard should not be a problem, its own crypto library called 'zinc' has bigger open points of discussion.
- viraptor 8y ago
  Merging into mainline doesn't mean things are stable. There's a few experimental options available when compiling the kernel.
  - pnutjam 8y ago
    Btrfs has been in the kernel for years.
    - viraptor 8y ago
      I'm not sure if this was meant as a jab or accurate, but btrfs is a good example. The core of it is stable, but there are a few features which are unstable/experimental, yet still included.

adrian_mrd 8y ago

Does anyone know if any commercial VPN providers implement WireGuard yet on iOS? > "An iOS app is available in the WireGuard repository, but as it isn't in the App Store yet. It's probably not going to do you any good unless you're an iOS developer yourself." The article references code for iOS apps but also states that "it needs to be baked right into the kernel for that to happen.". Would iOS apps also need the iOS Kernel (say iOS 12.x or iOS 13.x) to include WireGuard to take advantage of some of the speed advantages over OpenVPN?

monocularvision 8y ago
I don’t think so, although I am hardly an expert. The iOS SDK has the ability for apps to provide custom VPN implementations for use system wide (see: https://developer.apple.com/documentation/networkextension/nepackettunnelprovider https://developer.apple.com/documentation/networkextension/n... ) I don’t know if WireGuard being UDP causes issues, but I would assume it is possible.
zx2c4 8y ago
WireGuard even in userspace is generally pretty fast anyway, since it's multi-threaded.

codedokode 8y ago

I don't like that it is running in the kernel. Running in userspace makes everything more secure and I'm fine with little less bandwith.

helper 8y ago
There's a userspace implementation you can use if you want.
confounded 8y ago
Not doubting you, but ignorant and curious. What’s the security benefit of userspace? Easier to introspect/update/verify?
- chrisper 8y ago
  You won't get access to kernel memory space (I think).
- codedokode 8y ago
  If the kernel code is vulnerable then the attacker gets full control over your system. They can also easily hide their presence. If the code is in userspace, the attacker won't even be able to read your files if you run the daemon under a separate user account. They only will be able to mine Bitcoins or use your computer as a proxy for a short time.

A_No_Name_Mouse 8y ago

I love the Android client. OpenVPN used to consume some 25% of the battery life. With wireguard it's next to nothing and it's very very quick to connect. Great stuff!

nemoniac 8y ago

Tried it but couldn't make it work. When someone provides instructions to set up a WireGuard server on my Linux server and a client on my Android, I might just buy into that "easy setup" story.

computerfriend 8y ago
There's plenty of tutorials, including a couple posted in this thread. It's unfortunate that you had a bad experience setting it up, since it is usually pretty simple. But I think the "easy setup" is relative to the setup for OpenVPN, etc.

bmacauley 8y ago

From a security perspective, what happens if the wireguard key is passed to another user? How would you implement MFA in a wireguard system?

helper 8y ago
This is what Jason said the last time it came up on the mailing list[1]: "I think that given the WireGuard building block, it's certainly possible to build a 2FA framework around it. And I do generally like 2FA and short-lived credentials and such. Probably after getting the implementations buttoned up -- kernel mainline, windows, etc -- I'll turn a bit of attention to expanding tooling and full packages around the simple wg0 interface." [1]:https://www.mail-archive.com/wireguard@lists.zx2c4.com/msg02882.html https://www.mail-archive.com/wireguard@lists.zx2c4.com/msg02...

auslander 8y ago

Is supporting EAP planned? Like EAP-IKEv2, which can use passwords for authentication and session keys, RFC3748 ?

helper 8y ago
No.

xmichael999 8y ago

I feel I gotta mention Tinc https://www.tinc-vpn.org https://www.tinc-vpn.org The article mentions it's existence but then ignores it... It is as easy to use as WireGuard and has two advantages over wireguard. 1. It will automatically mess, and find the best path. 2. It has a far wider range of platforms supported than wireguard.

galadran 8y ago
tinc is not a secure choice! Have you seen their documentation? https://www.tinc-vpn.org/documentation/Security.html#Security https://www.tinc-vpn.org/documentation/Security.html#Securit... The default cipher is from 1993 and its creator recommends everyone updates. 32 bit MACs are hilariously tiny. Home rolled authentication based around RSA. Their own documentation even states: ”tinc’s security is not as strong as TLS or IPsec." DO NOT USE tinc!
- Freaky 8y ago
  New deployments should be with 1.1 using its new protocol. https://www.tinc-vpn.org/documentation-1.1/Simple-Peer_002dto_002dPeer-Security.html https://www.tinc-vpn.org/documentation-1.1/Simple-Peer_002dt...
  - galadran 8y ago
    That does look a lot better, however: a) its not supported by the stable release b) There are no claims about downgrade resistance. The manual specifies the new transport protocol is used if both clients support it and both have changed their configs to enable experimental mode. Can an attacker still force them to connect with legacy mode? c) Users have to ensure every single config on every client has the correct setting. d) It still doesn't have the identity hiding features of Wireguard. (Someone observing your network traffic can see which servers you are talking to from the transmitted signatures)
    - Freaky 8y ago
      You can disable legacy support by not generating any RSA keys, or by building with DISABLE_LEGACY.

SEJeff 8y ago

Linus is also a huge fan of wireguard overall: http://lkml.iu.edu/hypermail/linux/kernel/1808.0/02472.html http://lkml.iu.edu/hypermail/linux/kernel/1808.0/02472.html Praise like this from him is rare.

scriptsmith 8y ago
His comment appears in the third paragraph of the article
snaky 8y ago
Linus never was a big fan of serious security matters. He is interested primarily in simple, small code that is simple to maintain, code that doesn't require any serious changes in other parts of the kernel, that's it.

linsomniac 8y ago

I wonder how it works in ChromeOS, anyone tried it? I had OpenVPN working for a while, but the debugibility of it was pretty low, it was a pain to set up. I was always turning it on and off, unlike my Linux laptop where it would just always be on and working. That's using the built in OpenVPN, not an android app. I wonder if setting it up in the "ChromeOS centrally managed" mode would help any? I'm really using my chromebook a lot these days at home, but wish I had a better VPN option for it.

amckinlay 8y ago

Why can't we have IPSec + IKEv2 everywhere as originally intended as part of IPv6. No "VPN" necessary.

felix_nagaand 8y ago
That makes snooping much more difficult.
MaxBarraclough 8y ago
We're not in IPv6 world yet, but even if we were, Amazon AWS EC2 would doubtless continue to make IPSec awkward. They only route UDP and TCP to your VM, so if you want IPSec, you have to mess about with 'Amazon Virtual Private Cloud'.

edwinyzh 8y ago

I don't know much about the fundamentals of networking and security, just asking - can a Linux server with WireGuard installed to be able be detected by GFW (the Great FireWall) and thus get the IP address blocked? On the other hand, I couldn't wait for the Windows client.

computerfriend 8y ago
In principle, yes.

rooam-dev 8y ago

Recently we had to decide what to use and went with IPSec instead of WireGuard. Any reasons to reconsider and switch to WG? Thanks.

chrisper 8y ago
Less complex and easier on firewall traversals.
- rooam-dev 8y ago
  Easier from performance point of view? Thanks.
  - chrisper 8y ago
    I think IPSec needs special treatment when it comes to NAT port forwarding. WireGuard claims this is not necessary with wireguard.

fulafel 8y ago

If you'd like to run a memory-safe-ish implementation of WireGuard, apparently there is a working Go version: https://www.wireguard.com/xplatform/ https://www.wireguard.com/xplatform/

syedamer 8y ago

What bothers me in the Article, the official documentation and almost all guides for wireguard is that they ignore ipv6 completely. They either result in a leaking vpn or bad working one where all ipv6 connections fail.

bjoli 8y ago
Doesn't it just tunnel everything on one interface? In my tests, using a minimal config, ipv6 is tunneled just fine without extra consideration. The only thing I have added is a kill switch that blocks internet access if the WG interface goes down.

jorangreef 8y ago

"SipHash24 for hashtable keys" Someone can correct me, but I would prefer Tabulation Hashing to SipHash, even though SipHash is by DJB. Tabulation Hashing offers optimal guarantees and performance, and it's much simpler.

opk 8y ago

So the control program is just "wg". We only have one namespace for commands so using a two-letter combination for something as obscure as controlling VPNs is not very clever. Two-letter combinations should be left to user aliases and core things like cp, ls, df.

majewsky 8y ago
I sure use "wg" more often than I use "ul", "as", "bc", "eg", "ex", "gc", "id", "ld", "nl", "od", "pr", "sg", "tc" and "ul". All these courtesy of `ls {,/usr}/{,s}bin/??`. In fact, there are only 44 two-lettered commands on my (Arch Linux) system right now, so this particular realm appears to be very sparsely populated. (Not counting shell builtins though.)

zanchey 8y ago

Automatic roaming seems to be the killer feature that nobody has noticed - I know IPsec has this to a degree but Wireguard looks like it works much faster.