8 ms·
> We built Warp around WireGuard So basically Cloudflare created an app with Cloudflare branding and set up a Wireguard server for everyone. No bad, but just c
by arendtio 8y ago
> We built Warp around WireGuard
So basically Cloudflare created an app with Cloudflare branding and set up a Wireguard server for everyone. No bad, but just check out the original:
https://www.wireguard.com https://www.wireguard.com
While I am not a big fan of VPNs in general, I have to admit, that Wireguard performs exceptionally well. I tested it a week ago and the added latency is pretty much just the network latency and the bandwidth loss is minimal (so small I couldn't even measure it reliably). What I found most interesting, was that there were some use-cases when the network with Wireguard performed even better than without it (probably related to congestion control).
- apexalpha 8y agoFrom personal experience: When coupled with an DNS based ad blocker Wireguard can actually make your internet faster than when not using it. More so on Android than iOS and more so on mobile than fixed, but still feels so much smoother. you can even only forward the DNS requests and not the rest of the data so your home upload speed won't become your bottleneck.
- obenn 8y agoThis is precisely my setup, and I couldn't be happier. I have a lot of internal infrastructure including pi-hole, confluence and a number of self-hosted services. WireGuard lets me go anywhere on my laptop and its like I never left home, and I just keep two configurations for when I want to forward only internal IP addresses, or all my traffic.
- walterbell 8y agoAny pointers on setup instructions for WireGuard split tunneling on iOS?
- fonosip 8y agonot for wireguard. but for openvpn here's a howto https://ba.net/adblock/vpn/doc/howto.html https://ba.net/adblock/vpn/doc/howto.html
- eximius 8y agoInstructions for wireguard in general: https://www.ckn.io/blog/2017/11/14/wireguard-vpn-typical-setup/ https://www.ckn.io/blog/2017/11/14/wireguard-vpn-typical-set... Then you'd just need to use the iOS app, I hope?
- fretn 8y agoYou have issues with WireGuard split tunneling in general or only on iOS ? To make split tunneling work in WireGuard I changed AllowedIPs = 0.0.0.0/0 in the config file into: AllowedIPs = 92.13.14.15/32 10.192.122.0/24 where 10.192.122.0/24 is the subnet of my tunnel, and 92.13.14.15/32 is the ip address of my home computer this works on iOS and macos for me
- tomjakubowski 8y ago> I have a lot of internal infrastructure including pi-hole, confluence Confluence as in the Atlassian software? What do you use it for at home?
- dzhiurgis 8y agoTorturing people
- pimeys 8y agoYep. A 3€ Hetzner server with Wireguard and pi-hole. Running several private services on my server that are just available in my private network. Like an extension to my phone that's always on and working perfectly. The only thing I was never able to get working was the IPv6 support. Oh well...
- fonosip 8y agoFor a business solution for this try https://ba.net/adblockvpn https://ba.net/adblockvpn Disclosure. It is my day job
- maltalex 8y ago> What I found most interesting, was that there were some use-cases when the network with Wireguard performed even better than without it (probably related to congestion control). It could be the different routing. Your ISP's routing might be sub-optimal to certain destinations. After all, it chooses routes based (at least in part) on cost, not performance. There are commercial products that do this sort of tunneling (among other things) to lower routing latencies.
- newaccoutnas 8y agoCould also be packet-shaping/QoS on the ISP side
- arendtio 8y agoPossible but I am not exactly sure what caused the difference. I used fast.com for testing and when I increased the number of parallel connections the performance degradation was lower when using Wireguard. I assumed that it is related to congestion control as Wireguard uses UDP AFAIK and otherwise I would use TCP on the bottleneck part of the connection.
- atonse 8y agoThe ISP might be doing it knowing you're connecting to Netflix. But if you do a VPN, they don't know those specific packets are going to Netflix, so they can't shape the packets.
- cube2222 8y agoThey've also written they're own client in rust https://github.com/cloudflare/boringtun https://github.com/cloudflare/boringtun
- Shank 8y agoI consider myself fairly competent, and I couldn’t understand the wireguard documentation enough to setup my own install without resorting to algo [0]. There’s real value in wrapping a system like WireGuard into a product, because it democratizes technology rather than making it available only to those knowledgable enough to understand how to set it up. I think Warp is great in that regard. [0]: https://github.com/trailofbits/algo https://github.com/trailofbits/algo
- TimTheTinker 8y ago> I couldn’t understand the wireguard documentation enough to setup my own install without resorting to algo Not sure what you mean. Algo has no relationship to WireGuard; it's basically a customized StrongSwan setup under the hood, which utilizes IKEv2 (not WireGuard) as the transport.
- akerl_ 8y agoAlgo added WireGuard support at least several months ago.
- dguido 8y agoAlgo does not have a relationship to Wireguard, but Trail of Bits does. We made a substantial donation to them prior to including Wireguard support in Algo. You can find us on their donation page here: https://www.wireguard.com/donations/ https://www.wireguard.com/donations/
- StavrosK 8y agoI was in the same boat, hopefully this will help: https://www.stavros.io/posts/how-to-configure-wireguard/ https://www.stavros.io/posts/how-to-configure-wireguard/ It's actually very easy to set up, I don't know why the official docs make it seem super hard.
- kohtatsu 8y agoWhat's the reasoning behind embedding the private keys directly in the config?
- kentonv 8y ago> So basically Cloudflare created an app with Cloudflare branding and set up a Wireguard server for everyone. Not just one -- servers in 175 (and growing) locations spread around the world, and the app will always use the closest one to you. That's arguably a lot more important that what protocol it uses, and is not something you could easily DIY.
- eximius 8y agoI mean, for DIY you only need one because you're only one user. Pick a VPS host with a data center near you... done.
- jedberg 8y agoIt's only near you when you're at home though. This works around the world.
- broknbottle 8y agowouldn't be that difficult to write a script that checks geoip and launches a VPS in the region closest to your current devices public address. You could even create an iOS shortcut to allow you to do it from your iPhone
- Sammi 8y agoWhat's the chance that there are a lot of unknown unknowns that you are not counting on? I'd say that even the known unknown that ips and networks change routinely should make it a headache to maintain.
- wmf 8y agoClassic HN comment. I predict that Warp will fail just as hard as Dropbox.
- manigandham 8y agoSeveral billion-dollar businesses have been built doing things that "wouldn't be that difficult". In this case, I agree that a single VPS is usually enough for most but never underestimate the market power of making things simpler and faster.
- topranks 8y agoWell right now this only tunnels DNS traffic so it’s not quite the same. You can go on the wait-list for WARP+ which sounds like it’ll route everything over the VPN.
- fulafel 8y agoVPN does not usually add appreciable latency from the processing, unless either peer is overloaded.