3 ms·

Any plans for 2FA/MFA? A lot of businesses these days prefer or even require it for remote access. That would then make WireGuard a good alternative to OpenVPN

Any plans for 2FA/MFA? A lot of businesses these days prefer or even require it for remote access. That would then make WireGuard a good alternative to OpenVPN in those environments.

cyphar 8y ago
That is something that would be built on top of WireGuard. I think some people are working on such projects, but the whole point of WireGuard "core" is that it's incredibly minimal in what it does.
- dcbadacd 8y ago
  I for one applaud that. Strongswan and OpenVPN both have so much legacy cruft it's hard to make sure the VPN is secure - that the OSs implementation isn't incredibly out-of-date and I haven't made grave configuration mistakes, not even talking about how much harder Strongswan is to configure compared to Wireguard.
- mbreese 8y ago
  I could see the server side effectively operating like a public wifi hotspot and force all routing to a disclaimer type page. Then you could implement the 2FA there (or even proper username/password logins, which seems weird for WireGuard). If you enter the correct 2FA code, then your IP is no longer blocked. I know phones (and computers) can handle this when connecting to a new WiFi SSID, but do they also run their check when connecting over VPN? I might have to try that.
  - zamadatix 8y ago
    I can confirm automatic captive portals work on most wired devices. Those that don't will have to go to http://example.com http://example.com or similar to be redirected. Word of warning for anyone that implements this: your DNS portal needs to be internal and captive as well.
  - ownagefool 8y ago
    You could write a web portal that generate the wireguard configs on the server and offers the user the client config as a download. The portal then can hook upto to SAML / OIDC endpoint, use claims / groups / roles to offer specific profile configurations and you treat the keys in the configs as temporary tokens, as you attach an empiry time to the profile such as 8 hours, so your devs need to download a new configuration every day. I have a portal that does this for openvpn: https://github.com/secureweb/openvpn-portal https://github.com/secureweb/openvpn-portal The code quality isn't great as it's my hello world golang project, but I think the idea is fairly sound.

Any plans for 2FA/MFA? A lot of businesses these days prefer or even require it for remote access. That would then make WireGuard a good alternative to OpenVPN in those environments.

cyphar 8y ago

That is something that would be built on top of WireGuard. I think some people are working on such projects, but the whole point of WireGuard "core" is that it's incredibly minimal in what it does.

dcbadacd 8y ago
I for one applaud that. Strongswan and OpenVPN both have so much legacy cruft it's hard to make sure the VPN is secure - that the OSs implementation isn't incredibly out-of-date and I haven't made grave configuration mistakes, not even talking about how much harder Strongswan is to configure compared to Wireguard.
mbreese 8y ago
I could see the server side effectively operating like a public wifi hotspot and force all routing to a disclaimer type page. Then you could implement the 2FA there (or even proper username/password logins, which seems weird for WireGuard). If you enter the correct 2FA code, then your IP is no longer blocked. I know phones (and computers) can handle this when connecting to a new WiFi SSID, but do they also run their check when connecting over VPN? I might have to try that.
- zamadatix 8y ago
  I can confirm automatic captive portals work on most wired devices. Those that don't will have to go to http://example.com http://example.com or similar to be redirected. Word of warning for anyone that implements this: your DNS portal needs to be internal and captive as well.
- ownagefool 8y ago
  You could write a web portal that generate the wireguard configs on the server and offers the user the client config as a download. The portal then can hook upto to SAML / OIDC endpoint, use claims / groups / roles to offer specific profile configurations and you treat the keys in the configs as temporary tokens, as you attach an empiry time to the profile such as 8 hours, so your devs need to download a new configuration every day. I have a portal that does this for openvpn: https://github.com/secureweb/openvpn-portal https://github.com/secureweb/openvpn-portal The code quality isn't great as it's my hello world golang project, but I think the idea is fairly sound.