3 ms·

I've been interested in using WireGuard for a while, though I don't really have a use-case for it currently. In the interest of honest understanding, what woul

I've been interested in using WireGuard for a while, though I don't really have a use-case for it currently. In the interest of honest understanding, what would be reasons not to use WireGuard over existing VPN software (excluding the obvious legacy interop) ?

atonse 8y ago
I am a huge fan of Wireguard and use on all the major production servers I currently manage. But user management is exactly as sophisticated as SSH key management. That is to say, easy for 2-3 people, a pain otherwise. There are attempts at creating UI based user managers for wireguard, and I hope those go somewhere. I bet the major wireguard-supporting VPN providers have solved this problem for themselves though. Update: Just wanted to add that I don't think that user management (the work of actually provisioning and managing users) should fall under the umbrella of Wireguard. It's perfect the way it is. But I suspect there will be an ecosystem of tools that come up around it.
- AceJohnny2 8y ago
  Thanks, this is exactly the kind of useful information I was looking for. (this wouldn't be an issue for my personal use, but it's useful to be aware of it)
  - jandrese 8y ago
    It's not an issue for like 95% of the users, which is why Wireguard went that way. For the people who really need something better they are left to figure it out for themselves. Normally this is OK, but sometimes it leads to situations like PGP Email where key distribution is never really solved and the whole thing kind of lumbers around in a half dead state forever.
tptacek 8y ago
WireGuard is currently in a place where it works really well for site-to-site VPNs (where network/devops engineers are the only ones interacting with it directly, and it's just magic for everyone else) and for access (laptop-to-VPC) VPNs for engineers. It's not yet in a place where I'd recommend it for access VPNs for, say, support staff. It's more pleasant to use and manage than SSH or SSH tunnels (this is surprising and speaks to what an achievement WireGuard is and why people are so nuts about it), so if you calibrate your tooling/slickness expectations accordingly, you should do fine with it.
- tssva 8y ago
  WireGuard works well for basic site-to-site VPNs. It has limitations regarding multicast traffic and link up/down detection which can make more complex networks actually more difficult to support than using IPsec.

atonse 8y ago

I am a huge fan of Wireguard and use on all the major production servers I currently manage. But user management is exactly as sophisticated as SSH key management. That is to say, easy for 2-3 people, a pain otherwise. There are attempts at creating UI based user managers for wireguard, and I hope those go somewhere. I bet the major wireguard-supporting VPN providers have solved this problem for themselves though. Update: Just wanted to add that I don't think that user management (the work of actually provisioning and managing users) should fall under the umbrella of Wireguard. It's perfect the way it is. But I suspect there will be an ecosystem of tools that come up around it.

AceJohnny2 8y ago
Thanks, this is exactly the kind of useful information I was looking for. (this wouldn't be an issue for my personal use, but it's useful to be aware of it)
- jandrese 8y ago
  It's not an issue for like 95% of the users, which is why Wireguard went that way. For the people who really need something better they are left to figure it out for themselves. Normally this is OK, but sometimes it leads to situations like PGP Email where key distribution is never really solved and the whole thing kind of lumbers around in a half dead state forever.

tptacek 8y ago

WireGuard is currently in a place where it works really well for site-to-site VPNs (where network/devops engineers are the only ones interacting with it directly, and it's just magic for everyone else) and for access (laptop-to-VPC) VPNs for engineers. It's not yet in a place where I'd recommend it for access VPNs for, say, support staff. It's more pleasant to use and manage than SSH or SSH tunnels (this is surprising and speaks to what an achievement WireGuard is and why people are so nuts about it), so if you calibrate your tooling/slickness expectations accordingly, you should do fine with it.

tssva 8y ago
WireGuard works well for basic site-to-site VPNs. It has limitations regarding multicast traffic and link up/down detection which can make more complex networks actually more difficult to support than using IPsec.