5 ms·

I've been using OpenVPN on my home pfSense box, it's working pretty good and didn't require I install anything except the OpenVPN app on my phone. Not sure if

I've been using OpenVPN on my home pfSense box, it's working pretty good and didn't require I install anything except the OpenVPN app on my phone. Not sure if WireGuard has anything to offer that would motivate a switch.

soohyung 7y ago
It's faster. But if you already have a working system that you are happy with it may not warrant a switch. I think it's main strength lies in how easy it is to set up though. First time setting it up from scratch I had a working VPN in less than 5 minutes.
mikl 7y ago
Wireguard does claim to be faster. It’s also much simpler from a design perspective, so it might end up being more secure. But other than that, there’s no big reason to switch if you have a setup you’re happy with.
- tptacek 7y ago
  It doesn't just claim to be faster; it's clearly, materially, obviously faster, at least in straightforward configurations (which is to say that someone could come up with some weird OpenVPN configuration that makes up the [large] gap, but I haven't see that yet).
  - 1996 7y ago
    IF you only use AH with strongswan then it is faster than either wireguard or openvpn
    - mikl 7y ago
      The question was if there was a reason to switch away from OpenVPN ;)
    - psanford 7y ago
      If you are just using AH you aren't encrypting your traffic so it isn't really comparable to wireguard or openvpn.
      - 1996 7y ago
        Or maybe you encrypt at another layer and just want strongswan for the interconnection without too much overhead. Or maybe you do not care about the encryption, but care about the virtual and private part of VPN There are many usecase. There is no one size fit all.
CharlesColeman 7y ago
WireGuard is supposed to be faster and more reliable. In addition it has a far, far smaller codebase than OpenVPN, which makes it easier to audit and therefor more secure.
- jason0597 7y ago
  WireGuard's codebase is so small because it is lacking many features that the vast majority of people don't need. For the people who do need those missing features, WireGuard is unusable. https://news.ycombinator.com/item?id=17096899 https://news.ycombinator.com/item?id=17096899
  - hitpointdrew 7y ago
    Some of those criticisms are just wrong. I setup WireGuard to do split tunneling without any issue.
vsviridov 7y ago
As people mentioned already it is much faster. The downside is - there's nothing close to automatic DHCP or something of that nature, you have to effectively hard-code client's IP addresses
mindslight 7y ago
I wrote a comment similar to this, not wanting to spend time learning new details. Then I set up Wireguard once. Setting up Wireguard is actually quicker than refreshing your memory with the OpenVPN man page.
- mikl 7y ago
  That part really is wonderful. I don’t show it in the guide, but I’ve set up three peers now, and my config file is still just 15 lines long (including headers), and once you wrap your head around what AllowedIPs means in the two different contexts, it’s really easy to read.
philjohn 7y ago
As others have said ... it's faster HOWEVER I've had some issues when travelling where OpenVPN wasn't blocked but WireGuard was in some hotels. So I have both, if I can, I use wireguard, otherwise OpenVPN is slower, but does the job.
- mikl 7y ago
  You’re can choose a port number to run Wireguard on that should pass through all but the craziest firewall. 53 or 443 could work. Or run it OpenVPN’s port 1194. Only limitation is that it has to be UDP, Wireguard doesn’t support TCP.
  - derpsabert 7y ago
    443 and 1194 only make sense for TCP since there's nothing of note that commonly runs on those UDP ports.
    - mikl 7y ago
      443/UDP is used for HTTP/3 (aka QUIC), and is pretty quickly becoming ubiquitous – and OpenVPN also supports UDP, so if the port is open for TCP, it might well also be open for UDP.
    - 1996 7y ago
      For UDP, the OP could try the SIP ports
  - philjohn 7y ago
    Tried that ... looks like they were using a security gateway that did packet inspection and disallowed anything but "well known" VPNs.
- hsivonen 7y ago
  Does WireGuard over https exist yet? Something that encapsulates WireGuard as HTTP/3 where UDP is permitted and falls back to HTTP/2?
Havoc 7y ago
>WireGuard has anything to offer that would motivate a switch. A lot slicker in my experience. Instead of support everything it assumes both sides speak wireguard. Increases speed, reconnects faster etc. ...whether I'd break an existing setup for it...probably not.

soohyung 7y ago

It's faster. But if you already have a working system that you are happy with it may not warrant a switch. I think it's main strength lies in how easy it is to set up though. First time setting it up from scratch I had a working VPN in less than 5 minutes.

mikl 7y ago

Wireguard does claim to be faster. It’s also much simpler from a design perspective, so it might end up being more secure. But other than that, there’s no big reason to switch if you have a setup you’re happy with.

tptacek 7y ago
It doesn't just claim to be faster; it's clearly, materially, obviously faster, at least in straightforward configurations (which is to say that someone could come up with some weird OpenVPN configuration that makes up the [large] gap, but I haven't see that yet).
- 1996 7y ago
  IF you only use AH with strongswan then it is faster than either wireguard or openvpn
  - mikl 7y ago
    The question was if there was a reason to switch away from OpenVPN ;)
  - psanford 7y ago
    If you are just using AH you aren't encrypting your traffic so it isn't really comparable to wireguard or openvpn.
    - 1996 7y ago
      Or maybe you encrypt at another layer and just want strongswan for the interconnection without too much overhead. Or maybe you do not care about the encryption, but care about the virtual and private part of VPN There are many usecase. There is no one size fit all.

CharlesColeman 7y ago

WireGuard is supposed to be faster and more reliable. In addition it has a far, far smaller codebase than OpenVPN, which makes it easier to audit and therefor more secure.

jason0597 7y ago
WireGuard's codebase is so small because it is lacking many features that the vast majority of people don't need. For the people who do need those missing features, WireGuard is unusable. https://news.ycombinator.com/item?id=17096899 https://news.ycombinator.com/item?id=17096899
- hitpointdrew 7y ago
  Some of those criticisms are just wrong. I setup WireGuard to do split tunneling without any issue.

vsviridov 7y ago

As people mentioned already it is much faster. The downside is - there's nothing close to automatic DHCP or something of that nature, you have to effectively hard-code client's IP addresses

mindslight 7y ago

I wrote a comment similar to this, not wanting to spend time learning new details. Then I set up Wireguard once. Setting up Wireguard is actually quicker than refreshing your memory with the OpenVPN man page.

mikl 7y ago
That part really is wonderful. I don’t show it in the guide, but I’ve set up three peers now, and my config file is still just 15 lines long (including headers), and once you wrap your head around what AllowedIPs means in the two different contexts, it’s really easy to read.

philjohn 7y ago

As others have said ... it's faster HOWEVER I've had some issues when travelling where OpenVPN wasn't blocked but WireGuard was in some hotels. So I have both, if I can, I use wireguard, otherwise OpenVPN is slower, but does the job.

mikl 7y ago
You’re can choose a port number to run Wireguard on that should pass through all but the craziest firewall. 53 or 443 could work. Or run it OpenVPN’s port 1194. Only limitation is that it has to be UDP, Wireguard doesn’t support TCP.
- derpsabert 7y ago
  443 and 1194 only make sense for TCP since there's nothing of note that commonly runs on those UDP ports.
  - mikl 7y ago
    443/UDP is used for HTTP/3 (aka QUIC), and is pretty quickly becoming ubiquitous – and OpenVPN also supports UDP, so if the port is open for TCP, it might well also be open for UDP.
  - 1996 7y ago
    For UDP, the OP could try the SIP ports
- philjohn 7y ago
  Tried that ... looks like they were using a security gateway that did packet inspection and disallowed anything but "well known" VPNs.
hsivonen 7y ago
Does WireGuard over https exist yet? Something that encapsulates WireGuard as HTTP/3 where UDP is permitted and falls back to HTTP/2?

Havoc 7y ago

>WireGuard has anything to offer that would motivate a switch. A lot slicker in my experience. Instead of support everything it assumes both sides speak wireguard. Increases speed, reconnects faster etc. ...whether I'd break an existing setup for it...probably not.