5 ms·

What's the current status of WireGuard? Is it usable? I remember reading that Cloudfare is implementing it on their VPN product.

by Jonnax 7y ago

geolgau 7y ago
I've been using it for almost a year without any problems at all. But I have just a simple connection to my home network. No internet routing or anything complicated. Debian server / fedora & android clients.
dispat0r 7y ago
Yes it's usable but you need to install external packages.
ryanlol 7y ago
Wireguard has been perfectly usable for years now.
KenanSulayman 7y ago
It hasn't been merged into Linux 5.0 (4.20), so it's not available as part of the kernel without installing additional software. That said, there are several user-land implementations of Rust written in Go & Rust, one of which was written by the author of Wireguard and one by Cloudflare.
getsimon 7y ago
Windows client (pre-alpha) has just been released too. https://lists.zx2c4.com/pipermail/wireguard/2019-May/004126.html https://lists.zx2c4.com/pipermail/wireguard/2019-May/004126....
- jszymborski 7y ago
  I've been waiting for the Windows client to get finished off before switching to WireGuard. I've been using SoftEther in the mean time, and man is it flexible. Punches through NATs with wild abandon, doesn't get blocked since it communicates through 443 (if you should so config it), is super portable, and offers solid security and performance as far as I can tell.
Down_n_Out 7y ago
I'm using WireGuard in combination with Pi-Hole on a VPS and connecting to it on my mobile phone to have far better ad blocking. Works as a charm. Rock solid.
- amirmasoudabdol 7y ago
  Is there any guide that you can recommend to set this up?
  - mayamatrix 7y ago
    https://drexl.me/guides/wireguard-pihole-vpn-setup.html https://drexl.me/guides/wireguard-pihole-vpn-setup.html should get you there.
  - isatty 7y ago
    I have the same setup too, but with my own infrastructure running on my own "LAN" through Wireguard. I'll think about writing up a guide on doing this.
KaiserPro 7y ago
it is usable. For ubuntu/debian there is a package that installs everything. The config is very simple, more simple than openvpn. For mobile there are "official" clients, that use QR codes for config.
- dewey 7y ago
  I'm probably not the target audience but I'd say that it's usable but still not very straight forward to set up. Yes it has less options than OpenVPN but with a bunch of tutorials I was usually able to get OpenVPN set it up and have my traffic flow through it in 30 min. Following tutorials like this https://www.stavros.io/posts/how-to-configure-wireguard/ https://www.stavros.io/posts/how-to-configure-wireguard/ (which seems like a good one from a fellow HN user) always seems to work that I'm able to connect to the server but my internet doesn't work after running it. Probably something related to the IP tables rules or firewall I assume? I'm using the official mac client and Ubuntu 18.10 running on a server at OVH.
  - deleted 7y ago
    [deleted]
  - cyphar 7y ago
    I have a script that will generate the server config and auto-generate the client configurations for you[1]. In short, the primary thing you need to remember to add is: PostUp = iptables -A FORWARD -i %i -j ACCEPT PostUp = iptables -A FORWARD -o %i -j ACCEPT PostUp = iptables -t nat -A POSTROUTING -o $HOST_NIC -j MASQUERADE PostDown = iptables -D FORWARD -i %i -j ACCEPT PostDown = iptables -D FORWARD -o %i -j ACCEPT PostDown = iptables -t nat -D POSTROUTING -o $HOST_NIC -j MASQUERADE To your server's .conf file (using wg-quick). HOST_NIC is eth0 or whatever your server gets its internet from. You also need to enable IP forwarding: sysctl -w net.ipv4.ip_forward=1 (If you want to use IPv6 too, make sure to add the corresponding ip6tables and net.ipv6.conf.all.forwarding=1 bits.) [1]: https://github.com/cyphar/dotfiles/blob/master/.local/bin/wg-enroll https://github.com/cyphar/dotfiles/blob/master/.local/bin/wg...
    - 7y ago
cyphar 7y ago
It is possibly the most usable VPN I've used (in terms of resilience -- configuration is pretty easy but could be made more out-of-the-box ready). Almost every distribution has packages for it[1] and it's just a matter of copying the example wg-quick configurations from the internet. Personally I've written a more complete script[2] that allows you to dynamically add new devices to a server (and generate a QR code for the Android client). Yes, it's not mainline yet but it appears to be getting quite close and people still use VirtualBox even though its drivers are out-of-tree. Even though Donenfeld hasn't started tagging releases that are CVE-eligible I'm willing to bet that WireGuard is more secure than its alternatives (has anyone even attempted a formal proof of OpenVPN or IPSec?). There are a few userspace implementations too. [1]: https://www.wireguard.com/install/ https://www.wireguard.com/install/ [2]: https://github.com/cyphar/dotfiles/blob/master/.local/bin/wg-enroll https://github.com/cyphar/dotfiles/blob/master/.local/bin/wg...
kdtsh 7y ago
I’m not sure how much the installation and configuration process has changed in the last 6-8 months, but when I set it up as a call-to-home VPN, it was extremely easy to install (it’s in most package managers, although I recall I was trying to run it on Debian Jessie on ARM and I just couldn’t get the prerequisite kernel version installed for some reason I can’t recall - an upgrade to Stretch fixed this). It was a bit fiddly to set up though, mainly because a basic idea of how network admin works (subnets, default routes, ports, firewalls) is assumed. You don’t need to work with interfaces directly anymore though, since WireGuard now has the wg-quick tool. There are also fairly foolproof user guides and walkthroughs now, e.g. for how to set up a basic VPN and forward all traffic to the server to the Internet, which is a use case for users who want WireGuard to be their glorified web proxy (full disclosure: like me).
mercora 7y ago
I use wireguard daily in a somewhat complex setup and it works beautifully for me. I used ipsec before for everything and don't miss it much. It appears to be a lot simpler and setting it up is certainly a lot easier. It has been stable for me since its in use for like half a year or so. That said i miss being able to use a trusted CA for provisioning. Every new client needs to be setup at the server which is annoying. I would also like to see the possibility to do Ethernet style virtual interfaces instead of raw ip interfaces in order to be able to bridge those. However, ipsec did not allow me to do that either. Allowing non unicast traffic would also be huge benefit for some applications. I think all or some of this could be done by a different implementation using the same protocol. Maybe something like ipsec's IKE daemon but for wireguard could handle key exchange and dynamic routing allowing dynamic clients and probably fully meshed networks easily.
Hamuko 7y ago
It's usable, but not audited. Likewise, Cloudflare's BoringTun has also not been audited properly.

What's the current status of WireGuard? Is it usable? I remember reading that Cloudfare is implementing it on their VPN product.

by Jonnax 7y ago

What's the current status of WireGuard? Is it usable? I remember reading that Cloudfare is implementing it on their VPN product.

geolgau 7y ago

I've been using it for almost a year without any problems at all. But I have just a simple connection to my home network. No internet routing or anything complicated. Debian server / fedora & android clients.

dispat0r 7y ago

Yes it's usable but you need to install external packages.

ryanlol 7y ago

Wireguard has been perfectly usable for years now.

KenanSulayman 7y ago

It hasn't been merged into Linux 5.0 (4.20), so it's not available as part of the kernel without installing additional software. That said, there are several user-land implementations of Rust written in Go & Rust, one of which was written by the author of Wireguard and one by Cloudflare.

getsimon 7y ago

Windows client (pre-alpha) has just been released too. https://lists.zx2c4.com/pipermail/wireguard/2019-May/004126.html https://lists.zx2c4.com/pipermail/wireguard/2019-May/004126....

jszymborski 7y ago
I've been waiting for the Windows client to get finished off before switching to WireGuard. I've been using SoftEther in the mean time, and man is it flexible. Punches through NATs with wild abandon, doesn't get blocked since it communicates through 443 (if you should so config it), is super portable, and offers solid security and performance as far as I can tell.

Down_n_Out 7y ago

I'm using WireGuard in combination with Pi-Hole on a VPS and connecting to it on my mobile phone to have far better ad blocking. Works as a charm. Rock solid.

amirmasoudabdol 7y ago
Is there any guide that you can recommend to set this up?
- mayamatrix 7y ago
  https://drexl.me/guides/wireguard-pihole-vpn-setup.html https://drexl.me/guides/wireguard-pihole-vpn-setup.html should get you there.
- isatty 7y ago
  I have the same setup too, but with my own infrastructure running on my own "LAN" through Wireguard. I'll think about writing up a guide on doing this.

KaiserPro 7y ago

it is usable. For ubuntu/debian there is a package that installs everything. The config is very simple, more simple than openvpn. For mobile there are "official" clients, that use QR codes for config.

dewey 7y ago
I'm probably not the target audience but I'd say that it's usable but still not very straight forward to set up. Yes it has less options than OpenVPN but with a bunch of tutorials I was usually able to get OpenVPN set it up and have my traffic flow through it in 30 min. Following tutorials like this https://www.stavros.io/posts/how-to-configure-wireguard/ https://www.stavros.io/posts/how-to-configure-wireguard/ (which seems like a good one from a fellow HN user) always seems to work that I'm able to connect to the server but my internet doesn't work after running it. Probably something related to the IP tables rules or firewall I assume? I'm using the official mac client and Ubuntu 18.10 running on a server at OVH.
- deleted 7y ago
  [deleted]
- cyphar 7y ago
  I have a script that will generate the server config and auto-generate the client configurations for you[1]. In short, the primary thing you need to remember to add is: PostUp = iptables -A FORWARD -i %i -j ACCEPT PostUp = iptables -A FORWARD -o %i -j ACCEPT PostUp = iptables -t nat -A POSTROUTING -o $HOST_NIC -j MASQUERADE PostDown = iptables -D FORWARD -i %i -j ACCEPT PostDown = iptables -D FORWARD -o %i -j ACCEPT PostDown = iptables -t nat -D POSTROUTING -o $HOST_NIC -j MASQUERADE To your server's .conf file (using wg-quick). HOST_NIC is eth0 or whatever your server gets its internet from. You also need to enable IP forwarding: sysctl -w net.ipv4.ip_forward=1 (If you want to use IPv6 too, make sure to add the corresponding ip6tables and net.ipv6.conf.all.forwarding=1 bits.) [1]: https://github.com/cyphar/dotfiles/blob/master/.local/bin/wg-enroll https://github.com/cyphar/dotfiles/blob/master/.local/bin/wg...
  - 7y ago

cyphar 7y ago

It is possibly the most usable VPN I've used (in terms of resilience -- configuration is pretty easy but could be made more out-of-the-box ready). Almost every distribution has packages for it[1] and it's just a matter of copying the example wg-quick configurations from the internet. Personally I've written a more complete script[2] that allows you to dynamically add new devices to a server (and generate a QR code for the Android client). Yes, it's not mainline yet but it appears to be getting quite close and people still use VirtualBox even though its drivers are out-of-tree. Even though Donenfeld hasn't started tagging releases that are CVE-eligible I'm willing to bet that WireGuard is more secure than its alternatives (has anyone even attempted a formal proof of OpenVPN or IPSec?). There are a few userspace implementations too. [1]: https://www.wireguard.com/install/ https://www.wireguard.com/install/ [2]: https://github.com/cyphar/dotfiles/blob/master/.local/bin/wg-enroll https://github.com/cyphar/dotfiles/blob/master/.local/bin/wg...

kdtsh 7y ago

I’m not sure how much the installation and configuration process has changed in the last 6-8 months, but when I set it up as a call-to-home VPN, it was extremely easy to install (it’s in most package managers, although I recall I was trying to run it on Debian Jessie on ARM and I just couldn’t get the prerequisite kernel version installed for some reason I can’t recall - an upgrade to Stretch fixed this). It was a bit fiddly to set up though, mainly because a basic idea of how network admin works (subnets, default routes, ports, firewalls) is assumed. You don’t need to work with interfaces directly anymore though, since WireGuard now has the wg-quick tool. There are also fairly foolproof user guides and walkthroughs now, e.g. for how to set up a basic VPN and forward all traffic to the server to the Internet, which is a use case for users who want WireGuard to be their glorified web proxy (full disclosure: like me).

mercora 7y ago

I use wireguard daily in a somewhat complex setup and it works beautifully for me. I used ipsec before for everything and don't miss it much. It appears to be a lot simpler and setting it up is certainly a lot easier. It has been stable for me since its in use for like half a year or so. That said i miss being able to use a trusted CA for provisioning. Every new client needs to be setup at the server which is annoying. I would also like to see the possibility to do Ethernet style virtual interfaces instead of raw ip interfaces in order to be able to bridge those. However, ipsec did not allow me to do that either. Allowing non unicast traffic would also be huge benefit for some applications. I think all or some of this could be done by a different implementation using the same protocol. Maybe something like ipsec's IKE daemon but for wireguard could handle key exchange and dynamic routing allowing dynamic clients and probably fully meshed networks easily.

Hamuko 7y ago

It's usable, but not audited. Likewise, Cloudflare's BoringTun has also not been audited properly.