11 ms·
WireGuard for iOS
- newscracker 8y agoNice joke on the pricing of the app. :) Though you have a donation option on your website, it probably makes sense to put in the iOS app, in some way, a message to tell the user that this is an option to support the development (I’m not going to tell you what the best way to do this is, because it involves usability and other considerations, including App Store rules).
- zx2c4 8y agoAs the mailing list post mentions, this is a super new code base, and we could certainly use a hand, if any iOS developers out there are itching to help out. Opportunity to jump into a codebase while it's still pretty fresh, if that sort of experience is appealing to you. Don't hesitate to email me (jason [at] zx2c4.com) or poke me on IRC (I'm zx2c4 on freenode in #wireguard).
- xoa 8y agoThanks so much for your work on this, I think iOS is the last major platform right? Amazing effort in so short a time, I guess that's another advantage alongside the security ones of having a very simple, focused code base without unnecessary knobs and dials. I'm sorry it didn't make it into the kernel this cycle though, granted maybe that was a little much to hope for at this stage of things, and I really hope Vancouver goes well for you and Zinc. It's not that WG is hard to get setup on any given system, but I think kernel integration will lower the bar towards getting it available as a standard feature in a lot of turnkey appliance systems that I see a ton in SMB usage in particular. I can understand being conservative there but man do I already want it everywhere :)!
- zx2c4 8y agoOur final frontier is Windows, actually. Hope to have that out soon!
- craftyguy 8y agoWhat is the current status with getting the required bits merged into the Linux kernel? I don't really follow lkml (my email service would instantly hit its quota), and the todo list (https://www.wireguard.com/todo/ https://www.wireguard.com/todo/) surprisingly doesn't include any word about this.
- zx2c4 8y agoPosted v8 a few weeks ago. I'm working on v9 now. I'm mostly working on readying the new crypto api, Zinc -- https://lwn.net/SubscriberLink/770750/95c3c169634d1447/ https://lwn.net/SubscriberLink/770750/95c3c169634d1447/ -- and I'll be hopefully discussing it with some folks at the conference in Vancouver next week.
- craftyguy 8y agoThanks for the update, and good luck!
- jensv 8y agoAny chance the session will be recorded? I noticed that Linux Plumbers no longer seems to publish on Youtube in recent years (since 2013) and the tickets to the conference are sold out. :< Also a big thank you. There's nothing wrong with charging for an app or VPN service, charity is unfortunately not a sustainable business model and the app can still remain FLOSS but that's just my two cents.
- DavidNielsen 8y agoI’d certainly not mind helping fund development in some form, if there is some discomfort with charging for the app I’d be happy to see an IAP tip jar.
- cyphar 8y agoYou can donate directly here [1]. Apple takes a 30% tax on app purchases, so (as usual) it's better to donate directly. [1]: https://www.wireguard.com/donations/ https://www.wireguard.com/donations/
- deleted 8y ago[deleted]
- egorfine 8y agoThank you so much for this software!
- regecks 8y agoA massive thank you to you and any of the sponsors who made it possible to put a rush on the iOS app. Never imagined it'd be here so soon. Worked fantastically - generated a client profile on the server and setup within a couple of minutes with the QR code. It's solving all my problems - inter-DC communication, IPv6 tunnel and now mobile VPN. Sent some $ your way :).
- deleted 8y ago[deleted]
- appletux 8y agoI'm glad that WireGuard followed in TunSafe's footsteps [1] and also released an iOS TestFlight alpha / beta. Then we can help to provide feedback instead of just waiting. A week ago we had no iOS alternatives and now we suddenly have two. Thanks! [1] https://www.reddit.com/r/WireGuard/comments/9t85h6/tunsafe_released_android_and_ios_wireguard_client/ https://www.reddit.com/r/WireGuard/comments/9t85h6/tunsafe_r...
- ivank 8y agoI am using WireGuard for iOS and already vastly prefer it over OpenVPN Connect: WireGuard stays connected and doesn't exhibit OpenVPN's unreliable reconnect-on-unlock behavior. Your efforts are much appreciated.
- jesseb 8y agoI am so glad to hear this! I've been holding off on Wireguard solely because I need iPhone support, but I've had the same problems you're referring to with OpenVPN.
- maltalex 8y agoOpenVPN on IOS is horrible. But if you're looking for something a bit more mature than wireguard for now, IKEv2 IPSec VPNs based on strongswan work great. There are some ready made docker containers [0] that set up an IKEv2 VPN and can generate an IOS mobileconfig file for your phone. [0]: https://github.com/gaomd/docker-ikev2-vpn-server https://github.com/gaomd/docker-ikev2-vpn-server
- pilif 8y agoThe configuration PFSense uses for Strongswan works without requiring you to install a mobileconfig file on iOS. This has rapidly become my favourite solution for a VPN setup because it uses only built-in software on the client and it's extremely stable.
- auslander 8y agoYou still need an mobileconfig to configure On Demand (kind of always on) mode. But yeah, native IKEv2 on iOS is pretty solid.
- willio58 8y agoDon’t know what it does after reading this whole email.
- zx2c4 8y agoIt's an email for a mailing list of people who already know about the project, not a press release, but somebody posted it here anyway. The main site -- https://www.wireguard.com https://www.wireguard.com -- has lots of info if you're curious.
- craftyguy 8y agohttps://www.wireguard.com/ https://www.wireguard.com/
- donkey-hotei 8y agoHell yes.
- NamTaf 8y agoCan't wait to give this a spin next time I'm in China. Streisand[1] claims that Wireguard can jump the GFW and I'm interested in seeing how the performance stacks up compared to Shadowsocks with simple-obfs. One particular feature I like with Shadowrocket on iOS is the VPN-on-demand feature it offers. I can tell the app to only turn my VPN on when on wifi, for example, since global roaming is itself essentially a VPN back to my home telco. In that instance, I don't want to route my traffic back up from Australia to the US (which I pick for my VPN due to its close routing from China). Can I expect the Wireguard app to feature something similar in time? [1]: https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand
- reaperhulk 8y agoI use WireGuard (including WireGuard iOS) every day in Shanghai. It’s mostly fast and performant but nothing escapes the occasional “drop all UDP to your endpoint”. Typically this manifests as windows of time (typically a few minutes) where no traffic to the VPN gets through. However, unlike an openVPN solution WireGuard recovers without having to bounce the tunnel or constantly reconnect. The GFW is not a monolithic entity though so be aware that performance and blocking characteristics can vary widely between cities, ISPs, and sometimes even between cell towers. VPN on demand features are on the iOS todo list. iOS supports the idea of making a VPN on demand for cellular or WiFi so it will be able to do what you want once that feature is merged.
- NamTaf 8y agoThat's all good news. I'm aware that them blackholing all UDP traffic is always going to be an issue, but it's good to hear that Wireguard recovers gracefully. So, too, does Shadowsocks. Alternatives are always good, and having something more reflecting a true VPN rather than a SOCKS proxy will be useful once it makes it to Windows.
- cyphar 8y agoThe really nice thing about WireGuard on Linux is that it acts like a regular network device and thus you can use iptables or network namespaces for free with it. Very clean and genius design that eradicates the need for any client support as well as removing the potential for leaking at the network device level (if you configure it in the "container" mode where you move your host network devices into an inaccessible network namespace and only provide wg0 on the host).
- matthewaveryusa 8y agoJust to comment on the paid version joke. You can simply offer a carbon-copy of your app with a cost of 3.99 -- I'd personally be more than happy to pay for it to compensate you for your effort and support the software -- it's the least frictional way for me to pay you. A bon entendeur, salut
- QuinNafuku 8y agoActually, you can donate here: https://www.wireguard.com/donations/ https://www.wireguard.com/donations/ -- hopefully with similarly low friction.
- bdhess 8y agoEven better to go this way; no Apple tax.
- adtac 8y agoFor reference, on $3.99, Stripe takes ~10%, Bitcoin ~3%, Patreon ~12%, and Paypal ~15%. Apple takes nearly 30%.
- wpdev_63 8y agoDoesn't stripe usually charge 3%?
- Cogito 8y ago3% plus a flag of $0.30 from memory? It wasn't hard to check so it's actually 1.75% domestic cards (Australia) or 2.99% international, $0.30 flag fall. On $30 that is $0.83 - $1.20, or 2.75% - 3.99%
- Cogito 8y agoLook at that I completely used the wrong starting figure... On $3.99, this is $0.37 - $0.42, or 9.27% - 10.51%
- lemming 8y agoOne thing that isn't quite clear to me after a quick peruse of the website - say I'd like to use WireGuard as a VPN for my general personal internet security. I guess I'd need a server running somewhere with a WireGuard server, and then the iOS client - is that correct? i.e. it's not something like a SOCKS tunnel where I just need ssh at the other end.
- loeg 8y agoLike anything else, you need an appropriate server at the other end. For SOCKS, that would be a SOCKS server (not sshd). (ssh <-> sshd happens to have an option to spawn a limited SOCKS server, but it is not the only SOCKS server in existence.)
- lemming 8y agoAh, I see - thanks for the clarification.
- cyphar 8y ago[1] gives a very good rundown of what you need to do to make it work. It is actually very trivial (once you've got wireguard.ko). Just generate a key, and cross-copy the public halves. However configuration to make forwarding of all packets and thus making it usable as a full VPN requires a few extra steps on the server: * net.ipv4.ip_forward = 1 * net.ipv4.conf.all.proxy_ARP = 1 And on the client, especially if you're using wg-quick: * AllowedIPs = 0.0.0.0/0 But it shouldn't take that long. I got it working in tens of minutes. [1]: https://www.wireguard.com/quickstart/ https://www.wireguard.com/quickstart/
- snowwolf 8y agoOn the server config I also had to add some iptables rules PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o enp2s0 -j MASQUERADE PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o enp2s0 -j MASQUERADE
- jarym 8y agoFantastic progress! Going to China soon and was wondering if anyone has tried if this works through the GFW?
- apexalpha 8y agoWhen I was there I had to wrap all my tunnels in Stunnel because UDP traffic will simply get dropped from time to time. Was with OpenVPN though, not Wireguard.
- lrdd 8y agoFrom another user "reaperhulk" >I use WireGuard (including WireGuard iOS) every day in Shanghai. It’s mostly fast and performant but nothing escapes the occasional “drop all UDP to your endpoint”. Typically this manifests as windows of time (typically a few minutes) where no traffic to the VPN gets through. However, unlike an openVPN solution WireGuard recovers without having to bounce the tunnel or constantly reconnect. The GFW is not a monolithic entity though so be aware that performance and blocking characteristics can vary widely between cities, ISPs, and sometimes even between cell towers. >VPN on demand features are on the iOS todo list. iOS supports the idea of making a VPN on demand for cellular or WiFi so it will be able to do what you want once that feature is merged.
- tptacek 8y agoReaperhulk, for what it's worth, is a crypto engineer and also a co-author of Frinkiac.
- auslander 8y agoI had IPSec VPN set up on my iPhone for a year, zero problems. Native Apple client, no apps to install, just a profile file. It is always on for all traffic.
- auslander 8y agoAgain :) No third-party apps to install for IPSec VPNs, this is seriously more secure
- moviuro 8y ago> No third-party apps to install for IPSec VPNs, this is seriously more secure Just as telnet.exe is available on Windows but ssh isn't, so telnet must be more secure. It depends on your threat model and also on the tech below.
- auslander 8y agoNot a valid point, telnet is not encrypted, IKEv2 is pretty solid.
- pi-rat 8y agoThe client side story for IPSec is great, but configuring the (strongSwan) server is far from trivial. There are many decisions to make, and mistakes to avoid. Yes, amazing projects like Algo exists, but you can't use these on all platforms (ex: OpenWRT). My hope is that wireguard will provide a much easier (and safer) setup experience.
- indiv0 8y agoIf anyone is interested in setting up a VPN with wireguard [0], I'd like to whole-heartedly recommend Algo [1]. It's a set of Ansible scripts that sets up a dual IPSec/wireguard VPN on a VM or other machine. Wireguard itself is already super simple to setup and configure, and Algo makes it even easier by automating most of the surrounding process. I personally used it to setup a VPN a few days ago, and then manually tweaked it a bit to turn it into a site-to-site VPN instead of having it be just for tunneling (fun fact: wireguard works on Vyatta (AKA Ubiquiti) [2], and is currently running flawlessly on my Edgerouter Lite). Seriously, this is amazing software that just works and runs incredibly fast. Huge thanks to Jason and all the contributors to the various projects for their great work. [0]: https://www.wireguard.com/ https://www.wireguard.com/ [1]: https://github.com/trailofbits/algo https://github.com/trailofbits/algo [2]: https://github.com/Lochnair/vyatta-wireguard https://github.com/Lochnair/vyatta-wireguard
- curiousgal 8y agoOnly if you have Ubuntu if you're using Linux.
- indiv0 8y agoIf you're referring to Algo, you're correct, but it's intended to only setup a server, not a client. Having an Ubuntu VM or VPS available to host a VPN is a reasonable assumption to make.
- rauhl 8y ago> Having an Ubuntu VM or VPS available to host a VPN is a reasonable assumption to make. Is it? I personally & professionally prefer Debian over Ubuntu: by default it’s free-software–only, and I find that it’s somewhat more stable & predictable (which are important in a production server system). Of course, some people don’t care as much about software freedom as I do, and others may have had different experiences with respect to stability & predictability. Ubuntu is nice on the client side, given the reality of proprietary drivers in which we live, but even there I prefer e.g. Mint if I’m not using pure Debian.
- jbverschoor 8y agoStill no word about zerotier?
- yjftsjthsd-h 8y agoWhat about zerotier? Were they looking at supporting wireguard? That would be cool, but a little bit surprising since I thought they pretended to be a layer 2 device rather than the layer 3 device that wg provides. But it's been a while, so maybe I misremember.
- givinguflac 8y agoThis is great news! I would love to test it out just as soon as NordVPN finishes deploying support.
- kim0 8y agoReally wishing it would get a pluggable traffic obfuscation system, let a thousand obfuscator Bloom and make it hard for tyrant governments
- spurgu 8y agoI need an invitation code to install..?