19 ms·
WireGuard for iOS
- zx2c4 8y agoIt might still take some time to show up in search, but if you visit https://itunes.apple.com/us/app/wireguard/id1441195209?ls=1&mt=8 https://itunes.apple.com/us/app/wireguard/id1441195209?ls=1&... on iOS, it should take you to the right place in the App Store.
- shshhdhs 8y agoAwesome! Thanks for the hard work! I’ll give this a go and submit a bug report if I find an issue :-)
- iampims 8y agoI couldn’t find the reasoning behind using Go for the “API”, would you mind sharing some thoughts on the subject?
- tpankaj 8y agoI believe another contributor wrote a Go user-space implementation and Jason decided to build off that for the PC user-space implementations and Android and iOS. So basically, because it was there.
- yardstick 8y agoAny plans for 2FA/MFA? A lot of businesses these days prefer or even require it for remote access. That would then make WireGuard a good alternative to OpenVPN in those environments.
- cyphar 8y agoThat is something that would be built on top of WireGuard. I think some people are working on such projects, but the whole point of WireGuard "core" is that it's incredibly minimal in what it does.
- dcbadacd 8y agoI for one applaud that. Strongswan and OpenVPN both have so much legacy cruft it's hard to make sure the VPN is secure - that the OSs implementation isn't incredibly out-of-date and I haven't made grave configuration mistakes, not even talking about how much harder Strongswan is to configure compared to Wireguard.
- mbreese 8y agoI could see the server side effectively operating like a public wifi hotspot and force all routing to a disclaimer type page. Then you could implement the 2FA there (or even proper username/password logins, which seems weird for WireGuard). If you enter the correct 2FA code, then your IP is no longer blocked. I know phones (and computers) can handle this when connecting to a new WiFi SSID, but do they also run their check when connecting over VPN? I might have to try that.
- zamadatix 8y agoI can confirm automatic captive portals work on most wired devices. Those that don't will have to go to http://example.com http://example.com or similar to be redirected. Word of warning for anyone that implements this: your DNS portal needs to be internal and captive as well.
- ownagefool 8y agoYou could write a web portal that generate the wireguard configs on the server and offers the user the client config as a download. The portal then can hook upto to SAML / OIDC endpoint, use claims / groups / roles to offer specific profile configurations and you treat the keys in the configs as temporary tokens, as you attach an empiry time to the profile such as 8 hours, so your devs need to download a new configuration every day. I have a portal that does this for openvpn: https://github.com/secureweb/openvpn-portal https://github.com/secureweb/openvpn-portal The code quality isn't great as it's my hello world golang project, but I think the idea is fairly sound.
- doublepg23 8y agoYou maintain pass to? Damn, thanks for your hard work on both!
- aesh2Xa1 8y agoHe's the original author (not just maintainer).
- dbcooper 8y agoAnyone used wireguard in China?
- swordfeng 8y agoI know someone do use wireguard to bypass the GFW. It's not blocked at the moment. However, a concern is that the UDP-based protocol is not hard to detect.
- dbcooper 8y agoThanks. Would be nice to have an alternative to shadowsocks.
- 0xADEADBEE 8y agoThis HN comment might be worth a look: [0] It details the steps to setup udptunnel to tunnel Wireguard traffic over TCP. Hope it helps someone! [0] - https://news.ycombinator.com/item?id=17847008 https://news.ycombinator.com/item?id=17847008
- daakus 8y agoAnyone have experience with making this work? I tried starting it on the server I have WireGuard running on and it fails to start because it also wants to bind to the UDP port WireGuard uses (even in server mode). Additionally http://www.cs.columbia.edu/~lennox/udptunnel/ http://www.cs.columbia.edu/~lennox/udptunnel/ has a note saying: UDPTunnel is designed to tunnel RTP-style traffic, in which applications send and receive UDP packets to and from the same port (or pair of ports). It does not support request/response-style traffic, in which a client request is sent from a transient port X to a well-known port Y, and the server's response is returned from port Y to port X. Which from what I understand is exactly what WireGuard does.
- NamTaf 8y agoIt's billed on Streisand's Github page [1] as working there. I'll be giving it a spin in February as an alternative to Shadowsocks and Anyconnect. Just need Wireguard on Windows now! [1]: https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand
- abc-xyz 8y agoYou're doing God's work.. literally saving lives. I hope history books will acknowledge your work and achievements.
- kgraves 8y agoThis. I don't know why this is receiving downvotes, but wireguard truly is a life saver. Just needs a desktop GUI interface and it would make a difference to thousands.
- a012 8y agoHN will downvote comments those didn't contribute anything to the topic, for specific their comment was looked very like from a spambot.
- abc-xyz 8y agoI don't mind the downvotes, I just wanted to encourage the author (since I know he'd be reading it) and everybody else who are fighting for people's privacy. I realize this kind of encouragement is usually more welcome at Show HN, but well, WireGuard are already so big and has achieved so much that this is basically a Show HN for them. Edit: hopefully it goes without saying that the downvotes are/were aimed at me for stating the obvious (with little relevance to the topic), rather than people actually disagreeing with the what I said.
- regecks 8y agoBeen using it for some weeks via TestFlight, it's really solid and works without a hitch. Great to see it on the actual store. It now has "on-demand mode" and transitions seamlessly between Wi-Fi and cellular. When setting up, use the QR method, makes it a breeze to setup a phone: https://wiki.debian.org/Wireguard#A3._Import_by_reading_a_QR_code_.28most_secure_method.29 https://wiki.debian.org/Wireguard#A3._Import_by_reading_a_QR...
- 0xADEADBEE 8y agoI set up Wireguard with this script [0] and made the jump from OpenVPN earlier this week (using Testflight). Has worked wonderfully throughout (once I added a DNS server to my client config - that one bit me!) and I'm now a convert. [0] - https://github.com/l-n-s/wireguard-install https://github.com/l-n-s/wireguard-install
- nissarup 8y agoThank you for that link. I tried manually setting up a VPN for my phone. It didn't work. After deleting my old wg0.conf (and adding the DNS to the client) it worked.
- 0xADEADBEE 8y agoYou’re so welcome! Thrilled to have saved someone else the debugging time. Enjoy!
- singularity2001 8y agojust a reminder that for Linux you can use SSH connections to any server as VPN via SSHuttle. 100% simple and easy
- cyphar 8y agoSure, but WireGuard has several other benefits (security-wise and operation-wise to sshuttle). sshuttle is a "poor man's VPN", WireGuard is a next generation VPN.
- Havoc 8y agoNice. Recently tried setting up both openvpn and wireguard and was struck by how much easier wireguard was.
- y0ghur7_xxx 8y agoI hope pfSense implements this soon: https://redmine.pfsense.org/issues/8786 https://redmine.pfsense.org/issues/8786
- zamadatix 8y agopfSense probably won't implement it natively until it's part of the FreeBSD kernel. If you want to run it on pfSense now you could bundle the userspace Go implementation as a pfSense package though.
- Aissen 8y agoPeople using WireGuard: how well does it work in public networks that only have a few select open ports (http/https/openvpn…) ? Does anyone have a workaround (e.g a reverse tcp (+tls/sni?) proxy on port 443?)
- tinco 8y agoProxying on 443 would 100% work, I can say that without trying. The only case that would not work is if the firewall would do any deep packet inspection to see whether the connection setup resembles https. That of course would also be easy to circumvent, but I don't think any firewall would go so far.
- vinay_ys 8y agoWireguard packets on port 443 looks like malformed QUIC packets. Any firewall that is doing protocol inspection (for L7 policy enforcement) would typically be configured to drop malformed packets. Wireguard would get blocked by such firewalls.
- dcbadacd 8y agoTime to make the suggestion to either actually use QUIC or simulate QUIC?
- Youden 8y agoWireGuard itself requires UDP but it's fairly trivial to tunnel UDP over TCP with for example ssf: https://securesocketfunneling.github.io/ssf/ https://securesocketfunneling.github.io/ssf/
- 8fingerlouie 8y agoI've been meaning to try it out, but the lack of an iOS client has held me back. Perhaps now is a good time to start :) I wish there had been some progress with the EdgeOS port, specifically with hardware offload. a Ubnt employee was looking into it a year ago, and then nothing. The current (major release) beta of it doesn't mention anything about it either.
- JustSomeNobody 8y agoThis (EdgeOS w/ hw offload) is what I'm waiting for before trying it.
- graystevens 8y agoI’ve been using the TestFlight beta for a while now - since it was first announced - and it’s been a great experience so far. The recently added option to activate on-demand is great, as it means I can now force VPN for any WiFi and/or mobile data connections. The primary niggle I came across was transferring the keys between my host and the client, however after a bit of tweaking I found it far easier to just utilise the QR codes option. For those interested, I wrote about my experiences on my blog[0] [0] https://grh.am/2018/wireguard-setup-guide-for-ios/ https://grh.am/2018/wireguard-setup-guide-for-ios/
- mattrad 8y agoGreat write up, thank you! Looking at your blog post, it seems that once I've followed your guide, I only need to forward port 51820 from my router to the WG server. Is that correct?
- kortilla 8y agoIs your threat model that you trust your ISP for your wireguard server more than the mobile ISPs? WiFi I completely understand but 4g providers seem to be on par if not better than cable companies in the us when it comes to molesting your traffic.
- graystevens 8y agoDepends on the country I am in as to whether or not I want to VPN whilst on a mobile connection (whether that is for just having an IP in my home country or don’t fancy my traffic going over their wires). It is primarily for public and/or untrusted WiFi connections, or so that I can take packet captures of iOS applications easily without a jailbreak or connecting the phone via USB to a Mac.
- move-on-by 8y agoI also use the setting to automatically switch on when going to cellular. I use it because I have a PiHole for DNS ad blocking that I wish to continue to use when on cellular. Being on a VPN is the only way to do that on iOS.
- 8y ago
- deleted 8y ago[deleted]
- hnauz 8y agoI want to try this out but... Why is WireGuard a module in the kernel??
- pstch 8y agoThe developers intend to merge it in the mainline kernel. There are multiple advantages for having a VPN module be in-kernel, such as closer access to network/crypto APIs and better performance.
- hnauz 8y agoBut that means that if there's a security bug in the module, the whole computer is compromised, no?
- xena 8y agoHow is this better than a VPN software that runs as root?
- hnauz 8y agoIt isn't, but I don't see why you should run your VPN software as root at all.
- cyphar 8y agoIn order to listen (and forward) all network traffic you need privileges over the network namespace that you want to forward packets for. In most cases this ends up with you running as root. You can use proxies but that defeats the point of a VPN -- that all traffic is forwarded. But as I mentioned, WireGuard should really be the least of your problems (not to mention that there are userspace WireGuard implementations).
- cyphar 8y agoYes, but being in the kernel makes it much faster, since you don't have to copy packets between user space and kernel space. It also allows you to use WireGuard from early boot, as well as allowing you to manage it like a real network interface (you can do this with TAP interfaces but it's less clean). There is a userspace version available if you really don't want to use a kernel module (this is what the Android app uses if your kernel doesn't have WireGuard). Also, WireGuard is an incredibly small program, less than 4000 lines. You could audit it in day, and has been extensively fuzzed (and was designed to be secure in many aspects). I would be far more worried about buggy network drivers than WireGuard.
- ydushyant 8y agoreal question here is. (new to wireguard) how do i add one in the app ? how do i start the VPN :/
- Proven 8y agoiOS 12.0 and higher, gotta upgrade first
- tjoff 8y agoApologies for being slightly OT, but I'm curious. The windows version has been "coming soon" for what feels like a very long time. Is progress being made on the windows version or has it stalled?
- zx2c4 8y agoWe're now working on that basically full time, sprinting ahead to the finish line. The EV code signing certificate arrived a few days ago, even: https://twitter.com/EdgeSecurity/status/1073599888158535680 https://twitter.com/EdgeSecurity/status/1073599888158535680
- tjoff 8y agoThank you, good to hear and that makes me happy :)
- dcbadacd 8y agoIs there a way to get Wireguard on Android 4.4?
- tatersolid 8y agoUmm... if you’re still running Android 4.4, you have many far more significant security issues to address than your choice of VPN protocol.
- dcbadacd 8y agoThat doesn't mean I shouldn't be able to choose a VPN protocol.
- vbezhenar 8y agoIs there any estimation how much battery would it cost on modern phone?
- moviuro 8y agoNokia 7 Plus, starting 7am, now 4pm, tells me wireguard ate 27% (1026mAh, using 4G most of the time: 9am - 4pm). Though I'm not sure how much data I actually used. My phone does persistent keepalive so that I can use https://messages.android.com/ https://messages.android.com/ . Usage should go down quite a bit if you don't need remote connection to the phone.
- 0xADEADBEE 8y agoNot directly comparable of course because it's WiFi only, but my iPad reports 3% over the last 10 days (much of which would have been Wireguard being open and exporting logs when I was debugging whilst setting it up) and 1% over the last 24 hours. I was also concerned about this but it's been fine.
- bogomipz 8y agoDoes anyone know if there are any commercial VPN providers that support WireGuard yet? If so any recommendations?
- easel 8y agoMullvad does. I can say it works, but haven't compared to others enough to "recommend" it, per se.
- mockindignant 8y agoIVPN does. Ars did an article on it semi recently.
- ulzeraj 8y agoThank you and keep up the good work. WireGuard is so good that it made me drop FreeBSD and go back to Linux!