4 ms·

If all of my remote access can be done via ssh {+ local/remote forwarding}, is there a reason for me to consider wireguard?

by ohazi 7y ago

tptacek 7y ago
Yes. WireGuard is cryptographically superior to SSH, attaches at a network layer without fussy interactions with a Unix shell (that then also needs to be accounted for in a security model), has higher performance, is practically bulletproof in terms of keeping connections alive, and gets you direct access to whatever resources you've provisioned the network to provide. I wouldn't ding someone using SSH tunnels (carefully), but in a de novo design, I would always recommend WireGuard first.
- labawi 7y ago
  > WireGuard .. is practically bulletproof in terms of keeping connections alive Try switching between IPv4 and IPv6 networks, or reaching a peer on non-default/primary network on Windows. Not denying it would usually have better connectivity than TCP based ssh.
  - xyzzy_plugh 7y ago
    Where do you encounter IPv6 in the wild?
    - labawi 7y ago
      There were multiple complaints on the mailing list about roaming not working on IPv4/v6 transitions. I believe it was mobile vs. wifi.
    - AceJohnny2 7y ago
      Cellular networks. Cellular networks abroad.
    - emj 7y ago
      I've come across it on Wifi hotspots as well for some reason, it felt like the were deployed by a telecom company (cellular being most common way for non tech people to use IPv6 on my sites).
  - akerl_ 7y ago
    As an anecdotal point, I’ve been using always-on WireGuard (using a setup that’s essentially a fork of Algo) on my iPhone, iPad, and MacBook for months, via the native clients for each. I routinely hop between countries, SIM cards, WiFi networks, etc. I hit issues with Apple’s built-in captive portal detection (which has to kick in so it gives me the captive portal outside of the always-on VPN), but the WireGuard tunnel itself has been pretty much solid.
- zokula 7y ago
  Wireguard does not have better performance or is faster verses Openvpn in any independent Benchmark released up to now.
  - ubercow13 7y ago
    Do any independent benchmarks show it to be no faster?
  - FDSGSG 7y ago
    Yeah, but nobody cares. OpenVPN is horribly slow and wireguard isn't, there's no point in comparing these two. You wouldn't have an independent benchmark comparing a GTR and a semi truck.
  - tjoff 7y ago
    Sure there are, many threads about wireguard include performance comparisons to openvpn. Most home routers that can install both see a significant increase (I saw about 3-4x if I remember correctly). Also see the endless discussions on how to deliver 100 Mbit/s for single connections on OpenVPN. It is absolutely insane, you have to spend many hundreds of dollars on hardware to have a fighting chance. And even if you get hardware acceleration that doesn't help nearly as much as you'd expect. And aside from cost the power consumption required for such hardware is very prohibitive for most. Meanwhile my phone (first gen. Pixel (so three generations behind)), over wifi, gets at least 60 mbit/s over wireguard to a weak home router and then out to internet.
  - pm7 7y ago
    I was just benchmarking routers in VM. I also tested Openvpn vs Wireguard. Results: Openwrt 18.06.4 32-bit wireguard: 645 Mbit/s ping 1.1ms openvpn: 164 Mbit/s ping 1.2ms Openwrt 19 (snapshot r11159) 64-bit: wireguard: 1.16 Gbit/s ping 1.1ms openvpn: 230 Mbit/s ping 1.2ms pfsense 2.4.4-p3 (amd64): openvpn: 115 Mbit/s ping 1.2ms It was tested by moving traffic between two virtual bridges, Debian>router>Debian, on KVM (libvirt), CPU E3-1270, kernel: 4.19.0-4-amd64 #1 SMP Debian 4.19.28-2 (2019-03-15) x86_64 1 core, 2GB per VM iperf3 -t 60 Settings: Wireguard: defaults OpenVPN: no compression, udp, tun, defaults I would also note that I setting wg took about 5-10 minutes while setting openvpn took about an hour.
- labawi 7y ago
  >> If all of my remote access can be done via ssh {+ local/remote forwarding}.. > WireGuard .. has higher performance ... Note there are circumstances where ssh port forwarding (-L, -R, -D) is faster than any L2/L3 vpn because it breaks TCP connections in two segments, so any flaky retransmission causing issues are localized, RTTs are smaller, TCP ramp-up is faster, etc. On the other hand, ssh tun/tap forwarding will almost certainly be slower. If you are connecting over a flaky wifi/2g/3g connection, possibly to a flaky/distant counterpart, and have performance issues, I would recommend trying (L4 is it?) ssh/socks or even http forwarding via a stable middle host.

If all of my remote access can be done via ssh {+ local/remote forwarding}, is there a reason for me to consider wireguard?

by ohazi 7y ago

If all of my remote access can be done via ssh {+ local/remote forwarding}, is there a reason for me to consider wireguard?

tptacek 7y ago

Yes. WireGuard is cryptographically superior to SSH, attaches at a network layer without fussy interactions with a Unix shell (that then also needs to be accounted for in a security model), has higher performance, is practically bulletproof in terms of keeping connections alive, and gets you direct access to whatever resources you've provisioned the network to provide. I wouldn't ding someone using SSH tunnels (carefully), but in a de novo design, I would always recommend WireGuard first.

labawi 7y ago
> WireGuard .. is practically bulletproof in terms of keeping connections alive Try switching between IPv4 and IPv6 networks, or reaching a peer on non-default/primary network on Windows. Not denying it would usually have better connectivity than TCP based ssh.
- xyzzy_plugh 7y ago
  Where do you encounter IPv6 in the wild?
  - labawi 7y ago
    There were multiple complaints on the mailing list about roaming not working on IPv4/v6 transitions. I believe it was mobile vs. wifi.
  - AceJohnny2 7y ago
    Cellular networks. Cellular networks abroad.
  - emj 7y ago
    I've come across it on Wifi hotspots as well for some reason, it felt like the were deployed by a telecom company (cellular being most common way for non tech people to use IPv6 on my sites).
- akerl_ 7y ago
  As an anecdotal point, I’ve been using always-on WireGuard (using a setup that’s essentially a fork of Algo) on my iPhone, iPad, and MacBook for months, via the native clients for each. I routinely hop between countries, SIM cards, WiFi networks, etc. I hit issues with Apple’s built-in captive portal detection (which has to kick in so it gives me the captive portal outside of the always-on VPN), but the WireGuard tunnel itself has been pretty much solid.
zokula 7y ago
Wireguard does not have better performance or is faster verses Openvpn in any independent Benchmark released up to now.
- ubercow13 7y ago
  Do any independent benchmarks show it to be no faster?
- FDSGSG 7y ago
  Yeah, but nobody cares. OpenVPN is horribly slow and wireguard isn't, there's no point in comparing these two. You wouldn't have an independent benchmark comparing a GTR and a semi truck.
- tjoff 7y ago
  Sure there are, many threads about wireguard include performance comparisons to openvpn. Most home routers that can install both see a significant increase (I saw about 3-4x if I remember correctly). Also see the endless discussions on how to deliver 100 Mbit/s for single connections on OpenVPN. It is absolutely insane, you have to spend many hundreds of dollars on hardware to have a fighting chance. And even if you get hardware acceleration that doesn't help nearly as much as you'd expect. And aside from cost the power consumption required for such hardware is very prohibitive for most. Meanwhile my phone (first gen. Pixel (so three generations behind)), over wifi, gets at least 60 mbit/s over wireguard to a weak home router and then out to internet.
- pm7 7y ago
  I was just benchmarking routers in VM. I also tested Openvpn vs Wireguard. Results: Openwrt 18.06.4 32-bit wireguard: 645 Mbit/s ping 1.1ms openvpn: 164 Mbit/s ping 1.2ms Openwrt 19 (snapshot r11159) 64-bit: wireguard: 1.16 Gbit/s ping 1.1ms openvpn: 230 Mbit/s ping 1.2ms pfsense 2.4.4-p3 (amd64): openvpn: 115 Mbit/s ping 1.2ms It was tested by moving traffic between two virtual bridges, Debian>router>Debian, on KVM (libvirt), CPU E3-1270, kernel: 4.19.0-4-amd64 #1 SMP Debian 4.19.28-2 (2019-03-15) x86_64 1 core, 2GB per VM iperf3 -t 60 Settings: Wireguard: defaults OpenVPN: no compression, udp, tun, defaults I would also note that I setting wg took about 5-10 minutes while setting openvpn took about an hour.
labawi 7y ago
>> If all of my remote access can be done via ssh {+ local/remote forwarding}.. > WireGuard .. has higher performance ... Note there are circumstances where ssh port forwarding (-L, -R, -D) is faster than any L2/L3 vpn because it breaks TCP connections in two segments, so any flaky retransmission causing issues are localized, RTTs are smaller, TCP ramp-up is faster, etc. On the other hand, ssh tun/tap forwarding will almost certainly be slower. If you are connecting over a flaky wifi/2g/3g connection, possibly to a flaky/distant counterpart, and have performance issues, I would recommend trying (L4 is it?) ssh/socks or even http forwarding via a stable middle host.