4 ms·

I would never suggest OpenVPN when there is something like Wireguard. I switched to WG few years ago and the performance boost on a old Raspberry Pi v1 was asto

by pw6hv 7y ago

I would never suggest OpenVPN when there is something like Wireguard. I switched to WG few years ago and the performance boost on a old Raspberry Pi v1 was astonishing since it has much lower requirements wrt to the CPU.

w0utert 7y ago
It's also way easier to setup, and it covers all basic VPN needs for almost all home-VPN use cases. I remember spending a whole day configuring OpenVPN, lots of packages, certificates, key files, no clue what half of the things I was doing were for. I also didn't particularly like the OpenVPN iOS client. Setting up WireGuard took less than an hour, every step of the process made sense, and it allowed me to remove a whole lot of cruft from my server.
- sbarre 7y ago
  Would you have a link to a good reference/tutorial for Wireguard?
  - close04 7y ago
    These are pretty easy to follow (if you don't use something like dietPi): https://github.com/adrianmihalko/raspberrypiwireguard https://github.com/adrianmihalko/raspberrypiwireguard https://grh.am/2018/wireguard-setup-guide-for-ios/ https://grh.am/2018/wireguard-setup-guide-for-ios/
    - mbesto 7y ago
      Note https://github.com/adrianmihalko/raspberrypiwireguard https://github.com/adrianmihalko/raspberrypiwireguard has some outdated script responses in it. I learned this the hard way.
      - forgingahead 7y ago
        Are you able to submit a PR with the updated information? Thanks!
  - catalogia 7y ago
    The "Unofficial Wireguard Documentation" was good when I went through it: https://github.com/pirate/wireguard-docs https://github.com/pirate/wireguard-docs https://news.ycombinator.com/item?id=20036194 https://news.ycombinator.com/item?id=20036194
  - newman314 7y ago
    See trailofbits algo. If you can setup using that, things are super easy to get working after that.
- milankragujevic 7y ago
  I have the opposite experience. Setting up OpenVPN is as easy as: wget https://git.io/vpn https://git.io/vpn -O vpn.sh * inspect the file manually for malware etc.* sudo bash ./vpn.sh You enter your IP, port, protocol, client name and it generates a .ovpn file that you import into any client and it just works. If you need to revoke a client or add another one, re-run the script and it will ask you what to do. It can also uninstall itself safely. I still haven't managed to setup WireGuard. OpenVPN gets about 40 Mbps for me on the Pi, but my upload is less, so I don't need more. On a VPS, it gets about 90 Mbps.
  - lifthrasiir 7y ago
    For me OpenVPN server was not that hard to manually set up, but clients were really messy. I had various problems with both OpenVPN for Android and Tunnelblick (for macOS), where the latter were problematic enough for me to switch to WireGuard with no regret.
    - milankragujevic 7y ago
      I had no problems with OpenVPN Connect which is the "official" client for Android. For a short time I used Mac OS X (before rebranding), Tunnelblick never worked properly. I forgot the exact problems, but mainly crashing of the software that locks up all network interfaces until reboot, constant disconnecting, and one text field which was unfillable.
  - w0utert 7y ago
    For things that run on my home server I like to at least have the impression I know what I'm installing and how it is configured, so a magic script like you referred to is not really an option. I used this guide to configure OpenVPN [1], which you could almost publish as a paperback ;-) [1] https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-18-04 https://www.digitalocean.com/community/tutorials/how-to-set-...
    - milankragujevic 7y ago
SpikedCola 7y ago
Do you know if WireGuard supports DHCP yet? I can only find wg-dynamic[0] but it doesn't look like it's functional. [0] https://github.com/WireGuard/wg-dynamic/blob/master/docs/idea.md https://github.com/WireGuard/wg-dynamic/blob/master/docs/ide...
brokenfilez 7y ago
Seconding this, and that is one of my main points of irritation about the tech world, and the world in general. That we keep permeating outdated solutions in new articles and blog posts and elsewhere, when other actually superior solutions have been found.
stamps 7y ago
Unfortunately Wireguard doesn't work on PFsense/FreeBSD otherwise I would be using it. OpenVPN is generally well supported.
- antxxxx 7y ago
  Its available in ports and works fine https://www.freshports.org/net/wireguard/ https://www.freshports.org/net/wireguard/
thefz 7y ago
Only thing stopping me from setting up an Rpi on wireguard as a VPN bridge (I'm using mullvad's excellent application) is that so far I haven't been able to successfully set up the firewall so that all traffic gets into wg0 except for ssh, with which I connect to in SOCKS5 proxy (from work). Some sort of split tunnel.
fs111 7y ago
OpenVPN can work over TCP 443 and that is sometimes necessary for really dumb wifi networks (like a café in my area). wireguard does not.

by pw6hv 7y ago

w0utert 7y ago

It's also way easier to setup, and it covers all basic VPN needs for almost all home-VPN use cases. I remember spending a whole day configuring OpenVPN, lots of packages, certificates, key files, no clue what half of the things I was doing were for. I also didn't particularly like the OpenVPN iOS client. Setting up WireGuard took less than an hour, every step of the process made sense, and it allowed me to remove a whole lot of cruft from my server.

sbarre 7y ago
Would you have a link to a good reference/tutorial for Wireguard?
- close04 7y ago
  These are pretty easy to follow (if you don't use something like dietPi): https://github.com/adrianmihalko/raspberrypiwireguard https://github.com/adrianmihalko/raspberrypiwireguard https://grh.am/2018/wireguard-setup-guide-for-ios/ https://grh.am/2018/wireguard-setup-guide-for-ios/
  - mbesto 7y ago
    Note https://github.com/adrianmihalko/raspberrypiwireguard https://github.com/adrianmihalko/raspberrypiwireguard has some outdated script responses in it. I learned this the hard way.
    - forgingahead 7y ago
      Are you able to submit a PR with the updated information? Thanks!
- catalogia 7y ago
  The "Unofficial Wireguard Documentation" was good when I went through it: https://github.com/pirate/wireguard-docs https://github.com/pirate/wireguard-docs https://news.ycombinator.com/item?id=20036194 https://news.ycombinator.com/item?id=20036194
- newman314 7y ago
  See trailofbits algo. If you can setup using that, things are super easy to get working after that.
milankragujevic 7y ago
I have the opposite experience. Setting up OpenVPN is as easy as: wget https://git.io/vpn https://git.io/vpn -O vpn.sh * inspect the file manually for malware etc.* sudo bash ./vpn.sh You enter your IP, port, protocol, client name and it generates a .ovpn file that you import into any client and it just works. If you need to revoke a client or add another one, re-run the script and it will ask you what to do. It can also uninstall itself safely. I still haven't managed to setup WireGuard. OpenVPN gets about 40 Mbps for me on the Pi, but my upload is less, so I don't need more. On a VPS, it gets about 90 Mbps.
- lifthrasiir 7y ago
  For me OpenVPN server was not that hard to manually set up, but clients were really messy. I had various problems with both OpenVPN for Android and Tunnelblick (for macOS), where the latter were problematic enough for me to switch to WireGuard with no regret.
  - milankragujevic 7y ago
    I had no problems with OpenVPN Connect which is the "official" client for Android. For a short time I used Mac OS X (before rebranding), Tunnelblick never worked properly. I forgot the exact problems, but mainly crashing of the software that locks up all network interfaces until reboot, constant disconnecting, and one text field which was unfillable.
- w0utert 7y ago
  For things that run on my home server I like to at least have the impression I know what I'm installing and how it is configured, so a magic script like you referred to is not really an option. I used this guide to configure OpenVPN [1], which you could almost publish as a paperback ;-) [1] https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-18-04 https://www.digitalocean.com/community/tutorials/how-to-set-...
  - milankragujevic 7y ago

SpikedCola 7y ago

Do you know if WireGuard supports DHCP yet? I can only find wg-dynamic[0] but it doesn't look like it's functional. [0] https://github.com/WireGuard/wg-dynamic/blob/master/docs/idea.md https://github.com/WireGuard/wg-dynamic/blob/master/docs/ide...

brokenfilez 7y ago

Seconding this, and that is one of my main points of irritation about the tech world, and the world in general. That we keep permeating outdated solutions in new articles and blog posts and elsewhere, when other actually superior solutions have been found.

stamps 7y ago

Unfortunately Wireguard doesn't work on PFsense/FreeBSD otherwise I would be using it. OpenVPN is generally well supported.

antxxxx 7y ago
Its available in ports and works fine https://www.freshports.org/net/wireguard/ https://www.freshports.org/net/wireguard/

thefz 7y ago

Only thing stopping me from setting up an Rpi on wireguard as a VPN bridge (I'm using mullvad's excellent application) is that so far I haven't been able to successfully set up the firewall so that all traffic gets into wg0 except for ssh, with which I connect to in SOCKS5 proxy (from work). Some sort of split tunnel.

fs111 7y ago

OpenVPN can work over TCP 443 and that is sometimes necessary for really dumb wifi networks (like a café in my area). wireguard does not.