8 ms·

Decentralized VPN Written in Go

167 points by ngaut 7y ago

davecap1 7y ago
Is this similar to ZeroTier https://www.zerotier.com/ https://www.zerotier.com/?
- DuskStar 7y ago
  Except not as battle hardened and with fewer features, but otherwise that's what it looks like to me ZeroTier's pretty damn cool, IMO: https://github.com/zerotier/ZeroTierOne https://github.com/zerotier/ZeroTierOne
  - 0az 7y ago
    ZeroTier is cool. With it on, I can just grab a file / test something on my laptop without needing to expose it publicly and either setup dyndns or grab my laptop's assigned IP address. I can just keep one bookmark for each service. As a bonus, it'll route directly, instead of through an Open on server, etc. I just wish they had an alternative to curl | bash. Something like Docker's install instructions, where you don't have to look through the install script to figure out what's going on inside sudo.
    - nine_k 7y ago
      Both Debian and Void Linux have proper packages; did not try other distros. Android has an app, though I don't know whether the GUI part is open source. So far, works great for me.
    - zrail 7y ago
      The curl | bash just figures out your distro, adds the appropriate setup to your package manager, and installs a package. You can do it all by hand if you want.
q3k 7y ago
Looking at it for a few minutes, this has some issues: - symmetrical crypto with shared key across all clients, letting any VPN client act as any other client - no PFS (straight AEAD with AES-GCM) - alternatively, sketchy home-grown AES-CBC crypto that doesn't seem to be authenticated and as such allows for replay attacks and whatnot - home-rolled SHA-1 pbkdf1 instead of stdlib pbkdf2 with a better hash - static routing (ie. no way for a client to decide what prefixes to announce at a given time without updating the centralized config) - no support for roaming clients like phones or clients behind NAT (currently just depends on being able to send UDP datagrams to a preconfigured remote address) There's probably other things I missed, especially crypto-wise. I'd stay away from this (at least for now) and use something like wireguard or tinc instead.
- pinewurst 7y ago
  But it’s written in Go and that makes all the difference!
  - ngcc_hk 7y ago
    Yes. That is why it is interesting. Want to democratic this area so no big brother. But then.
  - tgsovlerkhgsel 7y ago
    Ironically, Wireguard has an official Go implementation...
  - fouc 7y ago
    I suddenly wondered if the Go compiler would ever insert anything that phones home to Google or if any of the networking parts end up providing data to Google in any way.
    - throwaway8941 7y ago
      Microsoft has already tried this one. https://reddit.com/r/cpp/comments/4ibauu/ https://reddit.com/r/cpp/comments/4ibauu/
jaimex2 7y ago
Is this how HBO's Silicon Valley series ends?
ngcc_hk 7y ago
Those free vpn you can get from people who want to target you and get your traffic ? Not as bad I hope.
bananocurrency 7y ago
why the fuck would you even give CBC mode as an option?
xvilka 7y ago
There is also a Rust[1] implementation. [1] https://github.com/dswd/vpncloud https://github.com/dswd/vpncloud
ltbarcly3 7y ago
(preparing to be downvoted into oblivion) Why does it matter what language it's written in? If it was written in C++ would that make it less noteworthy? Would that mean it was never really noteworthy?
- eeZah7Ux 7y ago
  It's a way to appeal to language fanboys. If someone needs an application written in a specific language they can just search for it.
- tadzik_ 7y ago
  To me personally, any time something is advertised as "written in X" makes it seem like it's not really worth the attention, as the "written in X" is apparently its primary selling point.
- pfranz 7y ago
  I think what you're getting at is when I hear the language it's written in as the main differentiator, I assume it's a toy project written to scratch an itch. I think the language is more of interest here than on the product page and toy projects are relevant for discussion. If it's a language or a domain I'm interested in, I'll peek at the libraries and idioms used. I'll likely tag it for later referencing. It's also relevant because they don't offer binaries and there are certain build systems I'm not interested in dealing with.
deleted 7y ago
[deleted]
sebsito 7y ago
Apart from "written in X" is kind of clickbaity I find it useful after all. I think that Go code is clear and readable and so it would be much easier to add missing feature and use if I had such need. Where "written in Rust" is almost a show stopper for me because I just can't read through the source despite numerous attempts (not saying that Rust is bad of course, it's just subjectively hard to approach for me)
mawalu 7y ago
Hijacking this for a project I created a while back. An ansible role that creates a "mesh" VPN between a set of servers using wireguard: https://github.com/mawalu/wireguard-private-networking https://github.com/mawalu/wireguard-private-networking
OJFord 7y ago
With WireGuard in the kernel, and even systemd support, why? What is this even aiming to offer that wg doesn't or couldn't be better done as an abstraction over wg (e.g. if you wanted a Go library for it)?
- merb 7y ago
  actually with a "home grown" vpn (userspace) you control the transport. thus you can even create a transport on h2 which makes it way harder to detect.
  - tptacek 7y ago
    There's userspace WireGuard in Go.
davidcollantes 7y ago
Related, recently on HN[0]: https://github.com/jedisct1/dsvpn https://github.com/jedisct1/dsvpn [0] https://news.ycombinator.com/item?id=20571739 https://news.ycombinator.com/item?id=20571739

167 points by ngaut 7y ago

davecap1 7y ago

Is this similar to ZeroTier https://www.zerotier.com/ https://www.zerotier.com/?

DuskStar 7y ago
Except not as battle hardened and with fewer features, but otherwise that's what it looks like to me ZeroTier's pretty damn cool, IMO: https://github.com/zerotier/ZeroTierOne https://github.com/zerotier/ZeroTierOne
- 0az 7y ago
  ZeroTier is cool. With it on, I can just grab a file / test something on my laptop without needing to expose it publicly and either setup dyndns or grab my laptop's assigned IP address. I can just keep one bookmark for each service. As a bonus, it'll route directly, instead of through an Open on server, etc. I just wish they had an alternative to curl | bash. Something like Docker's install instructions, where you don't have to look through the install script to figure out what's going on inside sudo.
  - nine_k 7y ago
    Both Debian and Void Linux have proper packages; did not try other distros. Android has an app, though I don't know whether the GUI part is open source. So far, works great for me.
  - zrail 7y ago
    The curl | bash just figures out your distro, adds the appropriate setup to your package manager, and installs a package. You can do it all by hand if you want.

q3k 7y ago

Looking at it for a few minutes, this has some issues: - symmetrical crypto with shared key across all clients, letting any VPN client act as any other client - no PFS (straight AEAD with AES-GCM) - alternatively, sketchy home-grown AES-CBC crypto that doesn't seem to be authenticated and as such allows for replay attacks and whatnot - home-rolled SHA-1 pbkdf1 instead of stdlib pbkdf2 with a better hash - static routing (ie. no way for a client to decide what prefixes to announce at a given time without updating the centralized config) - no support for roaming clients like phones or clients behind NAT (currently just depends on being able to send UDP datagrams to a preconfigured remote address) There's probably other things I missed, especially crypto-wise. I'd stay away from this (at least for now) and use something like wireguard or tinc instead.

pinewurst 7y ago
But it’s written in Go and that makes all the difference!
- ngcc_hk 7y ago
  Yes. That is why it is interesting. Want to democratic this area so no big brother. But then.
- tgsovlerkhgsel 7y ago
  Ironically, Wireguard has an official Go implementation...
- fouc 7y ago
  I suddenly wondered if the Go compiler would ever insert anything that phones home to Google or if any of the networking parts end up providing data to Google in any way.
  - throwaway8941 7y ago
    Microsoft has already tried this one. https://reddit.com/r/cpp/comments/4ibauu/ https://reddit.com/r/cpp/comments/4ibauu/

jaimex2 7y ago

Is this how HBO's Silicon Valley series ends?

ngcc_hk 7y ago

Those free vpn you can get from people who want to target you and get your traffic ? Not as bad I hope.

bananocurrency 7y ago

why the fuck would you even give CBC mode as an option?

xvilka 7y ago

There is also a Rust[1] implementation. [1] https://github.com/dswd/vpncloud https://github.com/dswd/vpncloud

ltbarcly3 7y ago

(preparing to be downvoted into oblivion) Why does it matter what language it's written in? If it was written in C++ would that make it less noteworthy? Would that mean it was never really noteworthy?

eeZah7Ux 7y ago
It's a way to appeal to language fanboys. If someone needs an application written in a specific language they can just search for it.
tadzik_ 7y ago
To me personally, any time something is advertised as "written in X" makes it seem like it's not really worth the attention, as the "written in X" is apparently its primary selling point.
pfranz 7y ago
I think what you're getting at is when I hear the language it's written in as the main differentiator, I assume it's a toy project written to scratch an itch. I think the language is more of interest here than on the product page and toy projects are relevant for discussion. If it's a language or a domain I'm interested in, I'll peek at the libraries and idioms used. I'll likely tag it for later referencing. It's also relevant because they don't offer binaries and there are certain build systems I'm not interested in dealing with.

deleted 7y ago

[deleted]

sebsito 7y ago

Apart from "written in X" is kind of clickbaity I find it useful after all. I think that Go code is clear and readable and so it would be much easier to add missing feature and use if I had such need. Where "written in Rust" is almost a show stopper for me because I just can't read through the source despite numerous attempts (not saying that Rust is bad of course, it's just subjectively hard to approach for me)

mawalu 7y ago

Hijacking this for a project I created a while back. An ansible role that creates a "mesh" VPN between a set of servers using wireguard: https://github.com/mawalu/wireguard-private-networking https://github.com/mawalu/wireguard-private-networking

OJFord 7y ago

With WireGuard in the kernel, and even systemd support, why? What is this even aiming to offer that wg doesn't or couldn't be better done as an abstraction over wg (e.g. if you wanted a Go library for it)?

merb 7y ago
actually with a "home grown" vpn (userspace) you control the transport. thus you can even create a transport on h2 which makes it way harder to detect.
- tptacek 7y ago
  There's userspace WireGuard in Go.

davidcollantes 7y ago

Related, recently on HN[0]: https://github.com/jedisct1/dsvpn https://github.com/jedisct1/dsvpn [0] https://news.ycombinator.com/item?id=20571739 https://news.ycombinator.com/item?id=20571739