21 ms·

WireGuard is now in Linus' tree

982 points by axiomdata316 7y ago

0xADEADBEE 7y ago
Glad to see it finally officially accepted. I've been using it on all my devices for over a year now and it's been rock solid. The ease of setup and initial connection speed alone blow any of the alternatives (that I'm aware of, at least) out of the water. Long may it continue!
- m-p-3 7y ago
  The only place where it falls shorts is that it doesn't go through as easily as SSL/IPSec on restrictive networks like corporate firewalls, but maybe that will go away when it becomes more common (and hopefully adopted in enterprises).
  - RL_Quine 7y ago
    I've honestly not had a lot of issues with that up until now. Real world it doesn't seem to be blocked by a whole lot of things, except where you only have port 80 and 443 anyway. I've actually seen it work in a lot of places I wouldn't have expected it to, like hotel wifi.
    - big_chungus 7y ago
      I've seen the same, likely because the DPI boxes haven't yet caught up.
    - deleted 7y ago
      [deleted]
  - therealmarv 7y ago
    Actually there are workarounds to get Wireguard running over TCP and port 80/443 described here (like udp tunnel). I also wanted to check them out for very restrictive networks in the near future: https://github.com/StreisandEffect/streisand/issues/1633 https://github.com/StreisandEffect/streisand/issues/1633
ronnier 7y ago
I’ve been nothing but happy with WireGuard. Connecting from my iPhone to my home and it works great, it’s fast and reliable. I’m never waiting to connect. Switching between WiFi, mobile, and sleeping go unnoticed.
- deleted 7y ago
  [deleted]
- koolba 7y ago
  What software do you use on the iPhone?
  - ronnier 7y ago
    The WireGuard app: https://apps.apple.com/us/app/wireguard/id1441195209 https://apps.apple.com/us/app/wireguard/id1441195209
  - deleted 7y ago
    [deleted]
- 3xblah 7y ago
  Your home has publicly accessible^1 IP address Or you are using a third party-controlled server with direct internet access to make home IP accessible 1. No ISP firewall blocking unsolicited incoming traffic Do you configure WG to use persistent keepalives
  - ronnier 7y ago
    I have a public IP.
    - 3xblah 7y ago
      A previous thread about WG had some discussion about obtaining a publicly reachable^1 IP address. No doubt many readers are interested Can you tell us anything about how you obtained one 1. No ISP firewall blocking unsolicited incoming traffic
samgranieri 7y ago
This is fantastic!
kennu 7y ago
If you're wondering what it is: WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. https://www.wireguard.com/ https://www.wireguard.com/
- numpad0 7y ago
  So like IPSec? e: I mean that doesn’t suck
  - simonh 7y ago
    In that it's “leaner, and more secure than IPSec”?
  - derefr 7y ago
    A major difference, besides WireGuard's simplicity, is that IPSec is a layer 4 protocol (ESP packets instead of TCP/UDP packets) whereas WireGuard is a layer 5 protocol (runs over UDP), so switches don't choke on it, and so a WireGuard peer doesn't need a public-routable IP address, but can be behind NAT.
    - sirtoffski 7y ago
      WireGuard operates at layer 3. The first sentence from the white paper by Jason A.: “ WireGuard is a secure network tunnel, operating at layer 3...”. [1] Regardless of the layer, in a few words WireGuard is a simple encrypted tunnel over UDP. Since it’s UDP - there’s no guarantee all packets will be delivered, BUT - what WireGuard places emphasis on is all packets delivered from the WireGuard interface will be authenticated and encrypted. Similarity if packets are received from a particular peer, replies to that IP address will be guaranteed to go to that same peer. The best feature of all imho is OpenSSH inspired authentication - makes configuring server/peers really straightforward. References [1] https://www.wireguard.com/papers/wireguard.pdf https://www.wireguard.com/papers/wireguard.pdf
rntksi 7y ago
Great news! Definitely going to be changing the landscape of VPN.
badrabbit 7y ago
So,curious here: I'v been reading about how the focus these days is to move networking code to userspace because you can squeeze out more PPS performance,does the fact that WC makes use of kernel code heavily give it a performance disadvantage?
- ahmedalsudani 7y ago
  I don’t know what PPS is, but that is an inaccurate sentiment. Running as a kernel module allows you to achieve higher throughout and lower latency.
  - lstamour 7y ago
    PPS means Packets Per Second. Here’s a press release from the FD.io project (“Fido”), take it as you will: https://fd.io/latest/singles/kubernetes/ https://fd.io/latest/singles/kubernetes/
    - dahfizz 7y ago
      FD.io uses the VPP stack under the hood, which ultimately uses DPDK[1] for the actual IO acceleration. The reason it's faster is because it's polling your hardware. You spend a lot of cpu time to buy the lower latency. [1] http://doc.dpdk.org/guides/prog_guide/overview.html http://doc.dpdk.org/guides/prog_guide/overview.html
      - lstamour 7y ago
        It's possible to write a driver that doesn't use polling - for example https://arxiv.org/pdf/1901.10664.pdf https://arxiv.org/pdf/1901.10664.pdf which discusses using vfio though doing so is apparently much harder than polling alone due to the complexity of the vfio interface and that most users care more about maximizing PPS performance at peak vs saving CPU cycles when less busy. Presumably one other option would be to try and tune the CPU to run slower when less demand is expected, and only run at faster peak performance when absolutely required. Also, it sounds like you might want to look at pinning cores to workloads, such that only one of your CPU cores is polling while the rest act as dynamic worker cores and could do other activities. Note that I'm largely speaking theoretically, for my use cases (mostly at home), the incompatibility of user space networking stacks often gets in the way.
jagger27 7y ago
I just started looking into WireGuard and was disappointed to find out that pfSense has no support for it. I don’t like messing around with packages outside of the pfSense repo, even if it’s kinda supported in FreeBSD.
- apearson 7y ago
  I run Wireguard on a freebsd server behind pfsense. Works well once you have a nat setup. What is stopping you from going that route?
  - jagger27 7y ago
    That's the direction I was headed, yeah. I do like the convenience of managing it all from the firewall web interface, however.
chrisbrandow 7y ago
Pedantic: Linus’s
- berbec 7y ago
  Lini?
  - _jal 7y ago
    The whole Linopod order.
- pfundstein 7y ago
  More pedantic: Linus' is correct because Linus is a proper noun.
  - macintux 7y ago
    Depends on which authority you consult.
  - keeganpoppen 7y ago
    ugh i personally just find that so hideous-- i literally mangle my sentences to avoid it
    - pfundstein 7y ago
      Literally, not metaphorically?
  - chrisbrandow 7y ago
    As far as I understand it, that's not the general rule. This is hardly a authoritative citation, but it cites a number of authority and comports with my understanding as someone whose name ends in `s`: "Nearly all authorities agree that if you want to make a possessive out of a singular noun like Kansas that ends in an s, you need to add ’s at the end. Just call it “Ross’s Rule.”" https://www.legalwritingpro.com/articles/feeling-possessive/ https://www.legalwritingpro.com/articles/feeling-possessive/
sdan 7y ago
WireGuard is absolutely fabulous. I route all my traffic from a couple servers at home to a small GCP instance (don’t want IP to be public) and I added my laptop to this WireGuard network (although technically a peer) and I can ssh into it remotely. I’m serving a 1,000,000+ page views a month through WireGuard and can’t say anything less about it it.
- tcas 7y ago
  Do you set up nginx or haproxy as a reverse proxy to the wireguard network, or something else? Been wondering if there's an easy way to expose an internal service like that. TCP seems easy, but UDP seems much more problematic.
  - oarsinsync 7y ago
    If you've followed standard / generic wireguard configuration, then 'client' peers are all able to route to each other via the server on their wireguard-local peer IPs.
  - sdan 7y ago
    Traefik. Recently they started supporting TCP so now I do both HTTP for websites and TCP for databases
    - sdan 7y ago
      If you need any help, let me know at hn@sdan.cc. I'm going to write a couple blog posts documenting how to do this (because it took me a full brain-wrecking week to figure out how to do this properly). WireGuard for networking and Traefik for loadbalancing is so easy to do (if you do it correctly).
      - wolfhumble 7y ago
        While waiting for your interesting blog post, I have a few questions if you don't mind :-) : So your setup is: * GCP Instance (i.e. VM on the Google infrastructure). - Traefik running on this instance. * GCP conntected to Wireguard => Is Wireguard run on a router/firewall, or directly on the DB, HTTP servers? If router, would be interesting to know which type of router? * Behind Wireguard: Two servers (DB and HTTP) + Laptop * You SSH to the two Servers (directly or via the GCP?) Thanks! :-)
oxplot 7y ago
Wrote a little post some time ago on how to set it up on linux and use it on android. Super simple. https://blog.oxplot.com/wireguard-vpn-on-android/ https://blog.oxplot.com/wireguard-vpn-on-android/
- wpietri 7y ago
  Nice! Any idea what the minimum system requirements are? I'm wondering how cheaply I could run this.
  - RL_Quine 7y ago
    Basically nothing for wireguard itself. I've run it on some seriously underpowered hardware and it seems to have basically no performance impact to speak of. I probably have it set up on around 30 machines presently and have used it in production environments.
  - oxplot 7y ago
    This thing should run fine just about anywhere, down to RPi Zero
edoceo 7y ago
Super cool. WG is a such a great tunnel tool. They've told me not to use in production but I've been ignoring that advice for months. My first test was using in as a replacement everywhere I still has stunnel. Then right after it was proved I started using this hammer for everything. AND! This part is critical: all of my interactions with the team and the community around it have been positive. Brilliant!
jchw 7y ago
I’m using WireGuard daily on Linux and iPhone. It’s hard to describe how much better of an experience this is than OpenVPN. Connections are reliable and durable, latency is pretty low, and you can actually understand the software.
- therealmarv 7y ago
  Same but Linux and Mac. I have the feeling that online live conferences/meetings are working with Wireguard very good. With OpenVPN I always had the feeling to turn the VPN off to reduce the latency overhead.
  - nemosaltat 7y ago
    I can’t install the official WireGuard on my Macs that are stuck on Sierra. Love WireGuard for Android and iOS. I think there’s a way to do it with brew.
    - scrps 7y ago
      In the same situation, it is indeed in brew. brew install wireguard-go wireguard-tools Pretty painless to use and I haven't experienced any issues.
- Diederich 7y ago
  I've been using WireGuard on my Android phone for a good while now using a free digital ocean droplet via https://github.com/trailofbits/algo https://github.com/trailofbits/algo It's fast. It's easy. You never have to think about it. It just works.
  - therealmarv 7y ago
    Using myself a Wireguard road warrior install script: https://github.com/l-n-s/wireguard-install https://github.com/l-n-s/wireguard-install
  - TimTheTinker 7y ago
MR4D 7y ago
If there was ever a use case for a raspberry pi, this is it!
ycombinete 7y ago
Nord VPN has added a Wireguard protocol-based option in their apps now. I'm not sure what to make of that.
numbsafari 7y ago
As someone who regularly deals with IPSec in conservative network environments, Wireguard can’t gain broad adoption soon enough, in my opinion. Now that it’s merged into Linus’s tree, any word on it getting an official release and the “this isn’t production ready, so no CVEs” disclaimer going away? EDIT: Further back in the thread, Donenfeld says “Please note that until Linux 5.6 is released, this snapshot is a snapshot rather than a secure final release.”, so perhaps real soon now? https://lists.zx2c4.com/pipermail/wireguard/2020-January/004905.html https://lists.zx2c4.com/pipermail/wireguard/2020-January/004... This is definitely big news!
- johnebgd 7y ago
  If you value WireGuard and can spare a few bucks the inventor/maintainer is getting about 1/10th what they publicly ask for to maintain: https://www.patreon.com/zx2c4 https://www.patreon.com/zx2c4
  - ZiiS 7y ago
    I do rely on Wireguard for some personal projects and I can spare a few bucks. However the reality is I can't get to $15/month the minimum tier. I rely on thousands of opensource projects. Upstreaming should help my arguments for adoption at work; they wouldn't think twice.
    - Monory 7y ago
      You can support on Patreon for less than the minimum tier. It is just the cut-off over which the rewards (such as stickers here) are given. Support for just $1! He'll still get it!
      - ZiiS 7y ago
        Thank you, they could make this clearer.
        sundarurfriend 7y ago
h4waii 7y ago
Very glad to see WireGuard getting more adoption. I've been using it while mobile and traveling and it's been absolutely rock solid. OpenWrt router back at home, multiple Android devices and Fedora machines connecting back that just work seamlessly between different networks. It's been such a treat to use and watch and help it mature. Just need more popular VPN providers to start supporting it -- NordVPN and PIA have provided "support" for it, and Nord allows using it as "NordLynx" on their Linux app.
- rochacon 7y ago
  Mullvad supports WireGuard tunnels, been using it for a couple of months now, pretty solid in any device, in all the regions I tried.
  - h4waii 7y ago
    I found the speeds to be lacking quite a bit and it was never completely reliable with both the WireGuard app and the official Android app, which also doesn't support split tunneling or allowing specific apps to bypass the interface. I will revisit when my subscription with current provider expires.
the_resistence 7y ago
heartbroken: doesn't work in mainland China
- huxflux 7y ago
  Yeah, no dice.
- shanxS 7y ago
  Care to explain? Unless underlying protocols (OSI layer) OR government policies don't stop WG from working, there should be no other variable to technically stop WG from working.
bitexploder 7y ago
WireGuard is cool and we really like it at our company (a bunch of infosec consultants). The management of it for an even small number (20) of users is a no-go. OpenVPN is ultra reliable and provides legit 2FA options when set up well. I look forward to legit management tools and improvements. For personal use it has been great. Much simpler than OpenVPN for a few (3) users.
- core-questions 7y ago
  I got the feeling that it's presently aimed more as a replacement for IPSEC site-to-site VPN, which is annoying as hell to configure considering the number of implementations and likelihood that one messed up setting will cause an inscrutable problem. Cipher suite incompatibility, subnet export and routing issues, and there's always the delightful fact that it never seems completely clear that you've got a tunnel up and running. I welcome a clear alternative.
- tptacek 7y ago
  The way you're managing WireGuard today is like directly configuring KAME IPSEC. The Linux WireGuard implementation is low-level and, from a systems perspective, unopinionated, which is as it should be. Getting a secure transport integrated safely into the kernel shouldn't be rocket surgery, but it is. That part is done. Getting IdP-managed WireGuard is not rocket surgery, and lots of teams will presumably do it. Those teams, by the way, stand to make a lot more money than Jason will off WireGuard, which is a very good reason to donate. Nobody who can reasonably avoid it should be using OpenVPN anymore. I get that it's burrowed far into some organizations and am not OpenVPN-shaming anyone. But WireGuard is leagues beyond OpenVPN in terms of nuts-and-bolts protocol and implementation security.
  - zbrozek 7y ago
    I would dearly love to see it make its way into pfsense, at which point I could reasonably execute on that vision. Right now I'm using both OpenVPN and Wireguard, and I'd rather not be.
  - pferde 7y ago
eteo96 7y ago
glad to see wireguard improving!
thrwaway69 7y ago
That's good news. I have been using wireguard via telegram and discord. Bot generates a config, whip it up and send generated QR code/file/instructions. It changes the DNS to the proxy pihole so whenever I connect to vpn, most ads stop bothering me. It's been great because I can easily give access to others via the bot too. They only need to scan the QR code or download the file, import it in the official app and it works. :D
place1 7y ago
This is awesome news. I’ve been using my self written access server deployed as a docker container at my home for ages now with no problems at all. Wg is a pleasure to use and their apps for iOS and desktop are great. The QR code feature in the mobile app is really good. I can’t wait for better adoption amongst businesses for corporate VPNs. https://github.com/Place1/wg-access-server https://github.com/Place1/wg-access-server
intc 7y ago
This is really great news! Soon we can finally start to deploy our global WG/IPv6 based management VPN.
deleted 7y ago
[deleted]
ta999999171 7y ago
Check your place very carefully for mold. And/or ease up on the alcohol. Just a hunch, nothing intended
- Buge 7y ago
  If you suspect mind altering chemicals, how about the classic carbon monoxide: https://old.reddit.com/r/legaladvice/comments/34l7vo/ma_postit_notes_left_in_apartment/ https://old.reddit.com/r/legaladvice/comments/34l7vo/ma_post...
- cpach 7y ago
  “And/or ease up on the alcohol.” Say what...? This is just rude. I assume you don’t even know 'Diederich. Don’t post stuff like this here, it is against the site’s guidelines. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
ta999999171 7y ago
Congratulations to Jason, super cool! - pHreak
Panino 7y ago
I use WireGuard on OpenBSD and Linux and it is just simply beautiful. THANK YOU Jason for writing it and to everyone else who has contributed code, testing, money, whatever. I believe WireGuard will become the most widely used VPN above IPsec and OpenVPN. There will still be use cases for them (especially IPsec) but both will lose marketshare dramatically.
- yardstick 7y ago
  WireGuard is nice but needs 2FA support. Until then it can’t be used in various corporate road warrior scenarios. Also until Cisco, Juniper, etc add WireGuard support and enough devices are deployed with it, IPsec will remain the corporate tool of choice when connecting between different organisations. Within the same org, where you have greater control of the equipment used, WireGuard is a bit more feasible.
  - treesknees 7y ago
    What you're describing (authentication/2FA) should be handled by a client application. VPN client software should handle authentication/authorization with the corporate VPN server. Once it's authenticated, it can exchange/generate the public-private keys used for the WireGuard tunnel. The VPN client then installs those keys and starts the tunnel. After that, it's up to the client and server VPN software to handle session timeouts, reconnections, host machine security policies, etc etc. None of that is the job of WireGuard itself.
    - yardstick 7y ago
      That’s still just one factor on the tunnel itself, which is the problem. If the keypair is discovered somehow, attackers could connect to your network without 2FA. Or am I missing something? So what software can I use now to make 2FA work with WireGuard that’s simple to use - as simple as OpenVPN (cert+user/pass is trivial in OpenVPN and supported in their clients).
0ld 7y ago
Since a couple of years I've been running iked [0] on my VPSed OpenBSD. It took me around 5 minutes to setup and it "just works" since then with my iPhone and MacOS clients out of the box, not requiring any additional software. But since WG is getting so high praise here, I'm now interested what are WG advantages and what does WG have to justify the effort to move away from iked and install/setup the client software everywhere? I'm certainly going to find out and test it myself, but would really appreciate just a quick answer/explanation [0] https://man.openbsd.org/iked.8 https://man.openbsd.org/iked.8
- mb7733 7y ago
  Same question here but using iked on on linux
- hwh 7y ago
  For me it's just easier to get my head around having a new network interface presented rather than this pile of security associations and transform configurations. I can just re-use my firewalling and routing knowledge and do not have to put my mind into IPsec mode to manage this. That aside, I think it's still quite a lot easier to use IPsec tooling when you want something that plays along with certificate based multi-level trust models.
tus88 7y ago
Is this like WireShark?
- kronholm 7y ago
  Not at all. Wireshark is for monitoring and analysis of network+hardware stuff, and WireGuard is for VPN stuff.
DictumMortuum 7y ago
Just yesterday I was looking at tinc [1] and wireguard was mentioned briefly. I'd like a way to access my home computers via ssh to keep them updated via ansible, even if they are on different networks (parents' laptops, my laptop, my raspberry servers, etc). Does anyone with more knowledge care to comment on security issues with tinc vs wireguard? Too bad that you need to use an external droplet for discovering the hosts with this one :( 1 - http://tinc-vpn.org/ http://tinc-vpn.org/
- deleted 7y ago
  [deleted]
- QasimK 7y ago
  I cannot comment on tinc, but I use WireGuard to do the same thing as you, and it works brilliantly. It was “easy” to set up and use. I wrote up what I did for my Raspberry PI server that I have at home [0]. The only other component that may be necessary is Dynamic DNS if you have a dynamic home IP address, or at the very least a way to find out your home IP at any time. [0]: https://qasimk.gitbooks.io/piserver-book/content/personal-vpn-wireguard.html https://qasimk.gitbooks.io/piserver-book/content/personal-vp...
imiric 7y ago
This is great news, and I'm looking forward to giving it a try once it's released as part of the kernel. I've been using tinc[1] for several years now, and it's been very simple to configure and use. Similarly to WG, it can tunnel over UDP, but also over TCP, supports router or switch modes, NAT traversal, etc. It's a great project, but not very popular and I'm concerned about its maintenance and security issues moving forward. To someone who's used both projects: can WG today be a drop-in replacement for tinc? [1]: https://tinc-vpn.org/ https://tinc-vpn.org/
- ZoomZoomZoom 7y ago
  As far as I understand, the killer feature of Tinc is automatic mesh routing. You can add a node to one instance and the information spreads through the network, wireguard doesn't do that. Also, I heard maintainers were contemplating replacing the protocol with Wireguard. https://www.tinc-vpn.org/pipermail/tinc/2017-February/004755.html https://www.tinc-vpn.org/pipermail/tinc/2017-February/004755...
  - tomberek 7y ago
    Tinc as a manger of a mesh of Wireguard connections would be incredible.
  - fulafel 7y ago
    IPsec also supports this - give certs signed by a mutually tusted CA to all nodes and they can all communicate host-to-host in a full mesh without needing to reconfigure when adding a host etc.
    - hwh 7y ago
      Can you please elaborate? As far as I see it, IPsec is encrypting traffic. IKE is for setup of security associations. What part of IPsec would do routing, and in this case: potentially multi-hop mesh routing?
      - fulafel 7y ago
mderazon 7y ago
Does anyone know of a way to add Wireguard to Gnome NetworkManager gui ?
- mqus 7y ago
  https://aur.archlinux.org/packages/networkmanager-wireguard-git/ https://aur.archlinux.org/packages/networkmanager-wireguard-... for archlinux, for other distros, you should probably look at the upstream source linked there
adevx 7y ago
Fantastic news. I deploy WireGuard to provide a private network (mesh) between VPS servers. Each VPS instance has each other vps as peer. So no single source of failure. I run PostgreSQL with Patroni and GlusterFS over this mesh with no issues. When I add or destroy a VPS with Ansible all VPS nodes get an updated config and reload. This way I don't rely on a single cloud provider because I do not use their private network service.
- ghthor 7y ago
  That's really interesting. So you essentially implemented a Virtual Private Cloud(VPC) on top of the "PHY" network of your hosts? Does that mean that all your nodes have to be accessible to the public internet?
  - mongrelion 7y ago
    Not necessarily, no. All hosts talk to each other on their private (v)NIC.
  - adevx 7y ago
    In my case yes and yes, but mostly because I spread out over two cloud providers.
    - kevin_nisbet 7y ago
      But it only needs to be accessible on the port WireGuard uses for communications, and WireGuard also has a nice property where it acts passively for non-wireguard packets. So someone on the internet doesn't necessarily know the node is reachable from the internet if they try and scan it for example. Edit: IIRC only one end of the connection needs a stable endpoint as well. IIRC WireGuard supports mobility (changing IP addresses) for one end of the connection.
      - monkeybutt 7y ago
        afaik, both ends can move, they just send packets to the latest IP they received a valid packet from.
ZoomZoomZoom 7y ago
Does anyone know anything about Wireguard-p2p? It's a tool for automatic management of endpoints and NAT-traversal for wireguard. It was announced on FOSDEM 2018[0]. Main repo[1] is stale, unfortunately. Some tool that would augment WG with more features a-la Tinc would be awesome. [0] https://archive.fosdem.org/2018/schedule/event/bulletinboard_dht/ https://archive.fosdem.org/2018/schedule/event/bulletinboard... [1] https://github.com/manuels/wireguard-p2p https://github.com/manuels/wireguard-p2p
ss3000 7y ago
Anyone aware of a VPN provider that offers WireGuard and supports more than 5 simultaneous connections? I've been using Mullvad but the 5 connections limit is starting to feel really restrictive.
- A_No_Name_Mouse 7y ago
  I set up a home router that I can connect to through Wireguard from all my devices, and it forwards all traffic to Mullvad. Bonus: I use PiHole on the same instance so all my devices get transparent ad- and tracker blocking
- burnaway 7y ago
  IVPN Pro = 7 connections limit
- muldvarp 7y ago
  Does mullvad allow five connections at the same time or five different keys overall?
terrywang 7y ago
Good news (rare) in Jan 2020 ;-) Using WireGuard to establish a mesh network seems good to start with but it does not scale well (even with the help of subspace web UI). Nebula (from Slack) seems to be a better option which is simple, secure and scales well so far, docs are not that well at this stage but usable. My main use case of WireGuard is to secure network traffic on Laptop/Workstations, replacing old-school complicated IPsec (strongSwan) and OpenVPN, can't be happier with its simplicity, user experience (seamless switching networks like strongSwan client for Android, per network on-demand, etc) and performance, battery life on mobile devices, etc. Anyway, non of the traditional VPN solutions (including WireGuard) work inside the Chinese GFW when travelling to China Mainland (won't go there until the 2019-nCoV is under control or a vaccine is available). So I am exploring V2ray (TLS + WebSocket + Web) and Trojan at this stage (working ones to my knowledge). Gravitational folks even implemented a WireGuard based overlay network plugin for k8s, super excited to replace flannel with wormhole (I have to admit it is a bad name) in use cases where encryption is required for overlay networking, which flannel does not offer. Many thanks to the WireGuard development team for the good work! Jason and many others, wow, I see the name of a long-time-no-see frined Herbert Xu (crypto subsystem maintainer).
- terrywang 7y ago
  Forgot to mention a potential problem with WireGuard, server keeps the list of clients' virtual IPs (AllowedIPs used for routing/ACLs), not ideal for VPN service providers in terms of privacy. It's not a problem for overlay network (e.g. Nebula) though, as it is considered a `requirement`.
zeveb 7y ago
Wireguard is really, really awesome. I've been using it for a bit now and it almost completely Just Works™. I've only had two issues, one of which is known and the other of which I think is probably my fault somehow. The first is that for some reason I sometimes need to ping machine B from A in order to get to C via B (in my case B sits in a VPS, while A is a laptop and C is a desktop). The other is that I would love to be able to connect directly over the LAN from A to C and vice versa, only going via B when A is mobile. I'm pretty sure that I could fix this with more IPv6 addresses and routing tables, but so far no joy.
alibert 7y ago
Is the Windows client offering better now? I'm still using the old alternative Tunsafe client on Windows because it is more stable than the official client on my laptop (got several bugs with sleep/resume/hibernation/long lived session). Well... I just tried to install the latest official Windows client and got an error about Wintun missing when activating a tunnel :/
- axiomdata316 7y ago
  I thought the Wintun driver was bundled with the WireGuard installation but if you need to install it separately I believe you can do it from https://www.wintun.net/ https://www.wintun.net/ Hope it helps. The Windows client is very stable now.
  - alibert 7y ago
    Thank you for your help. Unfortunately, the files available on wintun.net can't be used.
freedomben 7y ago
Apologies if I've missed it, but which kernel version will be first to ship with Wireguard? Looks like 5.5-rc7 is already out, so will Wireguard be included in 5.6?

982 points by axiomdata316 7y ago

Glad to see it finally officially accepted. I've been using it on all my devices for over a year now and it's been rock solid. The ease of setup and initial connection speed alone blow any of the alternatives (that I'm aware of, at least) out of the water. Long may it continue!

m-p-3 7y ago
The only place where it falls shorts is that it doesn't go through as easily as SSL/IPSec on restrictive networks like corporate firewalls, but maybe that will go away when it becomes more common (and hopefully adopted in enterprises).
- RL_Quine 7y ago
  I've honestly not had a lot of issues with that up until now. Real world it doesn't seem to be blocked by a whole lot of things, except where you only have port 80 and 443 anyway. I've actually seen it work in a lot of places I wouldn't have expected it to, like hotel wifi.
  - big_chungus 7y ago
    I've seen the same, likely because the DPI boxes haven't yet caught up.
  - deleted 7y ago
    [deleted]
- therealmarv 7y ago
  Actually there are workarounds to get Wireguard running over TCP and port 80/443 described here (like udp tunnel). I also wanted to check them out for very restrictive networks in the near future: https://github.com/StreisandEffect/streisand/issues/1633 https://github.com/StreisandEffect/streisand/issues/1633

ronnier 7y ago

I’ve been nothing but happy with WireGuard. Connecting from my iPhone to my home and it works great, it’s fast and reliable. I’m never waiting to connect. Switching between WiFi, mobile, and sleeping go unnoticed.

deleted 7y ago
[deleted]
koolba 7y ago
What software do you use on the iPhone?
- ronnier 7y ago
  The WireGuard app: https://apps.apple.com/us/app/wireguard/id1441195209 https://apps.apple.com/us/app/wireguard/id1441195209
- deleted 7y ago
  [deleted]
3xblah 7y ago
Your home has publicly accessible^1 IP address Or you are using a third party-controlled server with direct internet access to make home IP accessible 1. No ISP firewall blocking unsolicited incoming traffic Do you configure WG to use persistent keepalives
- ronnier 7y ago
  I have a public IP.
  - 3xblah 7y ago
    A previous thread about WG had some discussion about obtaining a publicly reachable^1 IP address. No doubt many readers are interested Can you tell us anything about how you obtained one 1. No ISP firewall blocking unsolicited incoming traffic

samgranieri 7y ago

This is fantastic!

kennu 7y ago

If you're wondering what it is: WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. https://www.wireguard.com/ https://www.wireguard.com/

numpad0 7y ago
So like IPSec? e: I mean that doesn’t suck
- simonh 7y ago
  In that it's “leaner, and more secure than IPSec”?
- derefr 7y ago
  A major difference, besides WireGuard's simplicity, is that IPSec is a layer 4 protocol (ESP packets instead of TCP/UDP packets) whereas WireGuard is a layer 5 protocol (runs over UDP), so switches don't choke on it, and so a WireGuard peer doesn't need a public-routable IP address, but can be behind NAT.
  - sirtoffski 7y ago
    WireGuard operates at layer 3. The first sentence from the white paper by Jason A.: “ WireGuard is a secure network tunnel, operating at layer 3...”. [1] Regardless of the layer, in a few words WireGuard is a simple encrypted tunnel over UDP. Since it’s UDP - there’s no guarantee all packets will be delivered, BUT - what WireGuard places emphasis on is all packets delivered from the WireGuard interface will be authenticated and encrypted. Similarity if packets are received from a particular peer, replies to that IP address will be guaranteed to go to that same peer. The best feature of all imho is OpenSSH inspired authentication - makes configuring server/peers really straightforward. References [1] https://www.wireguard.com/papers/wireguard.pdf https://www.wireguard.com/papers/wireguard.pdf

rntksi 7y ago

Great news! Definitely going to be changing the landscape of VPN.

badrabbit 7y ago

So,curious here: I'v been reading about how the focus these days is to move networking code to userspace because you can squeeze out more PPS performance,does the fact that WC makes use of kernel code heavily give it a performance disadvantage?

ahmedalsudani 7y ago
I don’t know what PPS is, but that is an inaccurate sentiment. Running as a kernel module allows you to achieve higher throughout and lower latency.
- lstamour 7y ago
  PPS means Packets Per Second. Here’s a press release from the FD.io project (“Fido”), take it as you will: https://fd.io/latest/singles/kubernetes/ https://fd.io/latest/singles/kubernetes/
  - dahfizz 7y ago
    FD.io uses the VPP stack under the hood, which ultimately uses DPDK[1] for the actual IO acceleration. The reason it's faster is because it's polling your hardware. You spend a lot of cpu time to buy the lower latency. [1] http://doc.dpdk.org/guides/prog_guide/overview.html http://doc.dpdk.org/guides/prog_guide/overview.html
    - lstamour 7y ago
      It's possible to write a driver that doesn't use polling - for example https://arxiv.org/pdf/1901.10664.pdf https://arxiv.org/pdf/1901.10664.pdf which discusses using vfio though doing so is apparently much harder than polling alone due to the complexity of the vfio interface and that most users care more about maximizing PPS performance at peak vs saving CPU cycles when less busy. Presumably one other option would be to try and tune the CPU to run slower when less demand is expected, and only run at faster peak performance when absolutely required. Also, it sounds like you might want to look at pinning cores to workloads, such that only one of your CPU cores is polling while the rest act as dynamic worker cores and could do other activities. Note that I'm largely speaking theoretically, for my use cases (mostly at home), the incompatibility of user space networking stacks often gets in the way.

jagger27 7y ago

I just started looking into WireGuard and was disappointed to find out that pfSense has no support for it. I don’t like messing around with packages outside of the pfSense repo, even if it’s kinda supported in FreeBSD.

apearson 7y ago
I run Wireguard on a freebsd server behind pfsense. Works well once you have a nat setup. What is stopping you from going that route?
- jagger27 7y ago
  That's the direction I was headed, yeah. I do like the convenience of managing it all from the firewall web interface, however.

chrisbrandow 7y ago

Pedantic: Linus’s

berbec 7y ago
Lini?
- _jal 7y ago
  The whole Linopod order.
pfundstein 7y ago
More pedantic: Linus' is correct because Linus is a proper noun.
- macintux 7y ago
  Depends on which authority you consult.
- keeganpoppen 7y ago
  ugh i personally just find that so hideous-- i literally mangle my sentences to avoid it
  - pfundstein 7y ago
    Literally, not metaphorically?
- chrisbrandow 7y ago
  As far as I understand it, that's not the general rule. This is hardly a authoritative citation, but it cites a number of authority and comports with my understanding as someone whose name ends in `s`: "Nearly all authorities agree that if you want to make a possessive out of a singular noun like Kansas that ends in an s, you need to add ’s at the end. Just call it “Ross’s Rule.”" https://www.legalwritingpro.com/articles/feeling-possessive/ https://www.legalwritingpro.com/articles/feeling-possessive/

sdan 7y ago

WireGuard is absolutely fabulous. I route all my traffic from a couple servers at home to a small GCP instance (don’t want IP to be public) and I added my laptop to this WireGuard network (although technically a peer) and I can ssh into it remotely. I’m serving a 1,000,000+ page views a month through WireGuard and can’t say anything less about it it.

tcas 7y ago
Do you set up nginx or haproxy as a reverse proxy to the wireguard network, or something else? Been wondering if there's an easy way to expose an internal service like that. TCP seems easy, but UDP seems much more problematic.
- oarsinsync 7y ago
  If you've followed standard / generic wireguard configuration, then 'client' peers are all able to route to each other via the server on their wireguard-local peer IPs.
- sdan 7y ago
  Traefik. Recently they started supporting TCP so now I do both HTTP for websites and TCP for databases
  - sdan 7y ago
    If you need any help, let me know at hn@sdan.cc. I'm going to write a couple blog posts documenting how to do this (because it took me a full brain-wrecking week to figure out how to do this properly). WireGuard for networking and Traefik for loadbalancing is so easy to do (if you do it correctly).
    - wolfhumble 7y ago
      While waiting for your interesting blog post, I have a few questions if you don't mind :-) : So your setup is: * GCP Instance (i.e. VM on the Google infrastructure). - Traefik running on this instance. * GCP conntected to Wireguard => Is Wireguard run on a router/firewall, or directly on the DB, HTTP servers? If router, would be interesting to know which type of router? * Behind Wireguard: Two servers (DB and HTTP) + Laptop * You SSH to the two Servers (directly or via the GCP?) Thanks! :-)

oxplot 7y ago

Wrote a little post some time ago on how to set it up on linux and use it on android. Super simple. https://blog.oxplot.com/wireguard-vpn-on-android/ https://blog.oxplot.com/wireguard-vpn-on-android/

wpietri 7y ago
Nice! Any idea what the minimum system requirements are? I'm wondering how cheaply I could run this.
- RL_Quine 7y ago
  Basically nothing for wireguard itself. I've run it on some seriously underpowered hardware and it seems to have basically no performance impact to speak of. I probably have it set up on around 30 machines presently and have used it in production environments.
- oxplot 7y ago
  This thing should run fine just about anywhere, down to RPi Zero

edoceo 7y ago

Super cool. WG is a such a great tunnel tool. They've told me not to use in production but I've been ignoring that advice for months. My first test was using in as a replacement everywhere I still has stunnel. Then right after it was proved I started using this hammer for everything. AND! This part is critical: all of my interactions with the team and the community around it have been positive. Brilliant!

jchw 7y ago

I’m using WireGuard daily on Linux and iPhone. It’s hard to describe how much better of an experience this is than OpenVPN. Connections are reliable and durable, latency is pretty low, and you can actually understand the software.

therealmarv 7y ago
Same but Linux and Mac. I have the feeling that online live conferences/meetings are working with Wireguard very good. With OpenVPN I always had the feeling to turn the VPN off to reduce the latency overhead.
- nemosaltat 7y ago
  I can’t install the official WireGuard on my Macs that are stuck on Sierra. Love WireGuard for Android and iOS. I think there’s a way to do it with brew.
  - scrps 7y ago
    In the same situation, it is indeed in brew. brew install wireguard-go wireguard-tools Pretty painless to use and I haven't experienced any issues.
Diederich 7y ago
I've been using WireGuard on my Android phone for a good while now using a free digital ocean droplet via https://github.com/trailofbits/algo https://github.com/trailofbits/algo It's fast. It's easy. You never have to think about it. It just works.
- therealmarv 7y ago
  Using myself a Wireguard road warrior install script: https://github.com/l-n-s/wireguard-install https://github.com/l-n-s/wireguard-install
- TimTheTinker 7y ago

MR4D 7y ago

If there was ever a use case for a raspberry pi, this is it!

ycombinete 7y ago

Nord VPN has added a Wireguard protocol-based option in their apps now. I'm not sure what to make of that.

numbsafari 7y ago

As someone who regularly deals with IPSec in conservative network environments, Wireguard can’t gain broad adoption soon enough, in my opinion. Now that it’s merged into Linus’s tree, any word on it getting an official release and the “this isn’t production ready, so no CVEs” disclaimer going away? EDIT: Further back in the thread, Donenfeld says “Please note that until Linux 5.6 is released, this snapshot is a snapshot rather than a secure final release.”, so perhaps real soon now? https://lists.zx2c4.com/pipermail/wireguard/2020-January/004905.html https://lists.zx2c4.com/pipermail/wireguard/2020-January/004... This is definitely big news!

johnebgd 7y ago
If you value WireGuard and can spare a few bucks the inventor/maintainer is getting about 1/10th what they publicly ask for to maintain: https://www.patreon.com/zx2c4 https://www.patreon.com/zx2c4
- ZiiS 7y ago
  I do rely on Wireguard for some personal projects and I can spare a few bucks. However the reality is I can't get to $15/month the minimum tier. I rely on thousands of opensource projects. Upstreaming should help my arguments for adoption at work; they wouldn't think twice.
  - Monory 7y ago
    You can support on Patreon for less than the minimum tier. It is just the cut-off over which the rewards (such as stickers here) are given. Support for just $1! He'll still get it!
    - ZiiS 7y ago
      Thank you, they could make this clearer.
      - sundarurfriend 7y ago

h4waii 7y ago

Very glad to see WireGuard getting more adoption. I've been using it while mobile and traveling and it's been absolutely rock solid. OpenWrt router back at home, multiple Android devices and Fedora machines connecting back that just work seamlessly between different networks. It's been such a treat to use and watch and help it mature. Just need more popular VPN providers to start supporting it -- NordVPN and PIA have provided "support" for it, and Nord allows using it as "NordLynx" on their Linux app.

rochacon 7y ago
Mullvad supports WireGuard tunnels, been using it for a couple of months now, pretty solid in any device, in all the regions I tried.
- h4waii 7y ago
  I found the speeds to be lacking quite a bit and it was never completely reliable with both the WireGuard app and the official Android app, which also doesn't support split tunneling or allowing specific apps to bypass the interface. I will revisit when my subscription with current provider expires.

the_resistence 7y ago

heartbroken: doesn't work in mainland China

huxflux 7y ago
Yeah, no dice.
shanxS 7y ago
Care to explain? Unless underlying protocols (OSI layer) OR government policies don't stop WG from working, there should be no other variable to technically stop WG from working.

bitexploder 7y ago

WireGuard is cool and we really like it at our company (a bunch of infosec consultants). The management of it for an even small number (20) of users is a no-go. OpenVPN is ultra reliable and provides legit 2FA options when set up well. I look forward to legit management tools and improvements. For personal use it has been great. Much simpler than OpenVPN for a few (3) users.

core-questions 7y ago
I got the feeling that it's presently aimed more as a replacement for IPSEC site-to-site VPN, which is annoying as hell to configure considering the number of implementations and likelihood that one messed up setting will cause an inscrutable problem. Cipher suite incompatibility, subnet export and routing issues, and there's always the delightful fact that it never seems completely clear that you've got a tunnel up and running. I welcome a clear alternative.
tptacek 7y ago
The way you're managing WireGuard today is like directly configuring KAME IPSEC. The Linux WireGuard implementation is low-level and, from a systems perspective, unopinionated, which is as it should be. Getting a secure transport integrated safely into the kernel shouldn't be rocket surgery, but it is. That part is done. Getting IdP-managed WireGuard is not rocket surgery, and lots of teams will presumably do it. Those teams, by the way, stand to make a lot more money than Jason will off WireGuard, which is a very good reason to donate. Nobody who can reasonably avoid it should be using OpenVPN anymore. I get that it's burrowed far into some organizations and am not OpenVPN-shaming anyone. But WireGuard is leagues beyond OpenVPN in terms of nuts-and-bolts protocol and implementation security.
- zbrozek 7y ago
  I would dearly love to see it make its way into pfsense, at which point I could reasonably execute on that vision. Right now I'm using both OpenVPN and Wireguard, and I'd rather not be.
- pferde 7y ago

eteo96 7y ago

glad to see wireguard improving!

thrwaway69 7y ago

That's good news. I have been using wireguard via telegram and discord. Bot generates a config, whip it up and send generated QR code/file/instructions. It changes the DNS to the proxy pihole so whenever I connect to vpn, most ads stop bothering me. It's been great because I can easily give access to others via the bot too. They only need to scan the QR code or download the file, import it in the official app and it works. :D

place1 7y ago

This is awesome news. I’ve been using my self written access server deployed as a docker container at my home for ages now with no problems at all. Wg is a pleasure to use and their apps for iOS and desktop are great. The QR code feature in the mobile app is really good. I can’t wait for better adoption amongst businesses for corporate VPNs. https://github.com/Place1/wg-access-server https://github.com/Place1/wg-access-server

intc 7y ago

This is really great news! Soon we can finally start to deploy our global WG/IPv6 based management VPN.

deleted 7y ago

[deleted]

ta999999171 7y ago

Check your place very carefully for mold. And/or ease up on the alcohol. Just a hunch, nothing intended

Buge 7y ago
If you suspect mind altering chemicals, how about the classic carbon monoxide: https://old.reddit.com/r/legaladvice/comments/34l7vo/ma_postit_notes_left_in_apartment/ https://old.reddit.com/r/legaladvice/comments/34l7vo/ma_post...
cpach 7y ago
“And/or ease up on the alcohol.” Say what...? This is just rude. I assume you don’t even know 'Diederich. Don’t post stuff like this here, it is against the site’s guidelines. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

ta999999171 7y ago

Congratulations to Jason, super cool! - pHreak

Panino 7y ago

I use WireGuard on OpenBSD and Linux and it is just simply beautiful. THANK YOU Jason for writing it and to everyone else who has contributed code, testing, money, whatever. I believe WireGuard will become the most widely used VPN above IPsec and OpenVPN. There will still be use cases for them (especially IPsec) but both will lose marketshare dramatically.

yardstick 7y ago
WireGuard is nice but needs 2FA support. Until then it can’t be used in various corporate road warrior scenarios. Also until Cisco, Juniper, etc add WireGuard support and enough devices are deployed with it, IPsec will remain the corporate tool of choice when connecting between different organisations. Within the same org, where you have greater control of the equipment used, WireGuard is a bit more feasible.
- treesknees 7y ago
  What you're describing (authentication/2FA) should be handled by a client application. VPN client software should handle authentication/authorization with the corporate VPN server. Once it's authenticated, it can exchange/generate the public-private keys used for the WireGuard tunnel. The VPN client then installs those keys and starts the tunnel. After that, it's up to the client and server VPN software to handle session timeouts, reconnections, host machine security policies, etc etc. None of that is the job of WireGuard itself.
  - yardstick 7y ago
    That’s still just one factor on the tunnel itself, which is the problem. If the keypair is discovered somehow, attackers could connect to your network without 2FA. Or am I missing something? So what software can I use now to make 2FA work with WireGuard that’s simple to use - as simple as OpenVPN (cert+user/pass is trivial in OpenVPN and supported in their clients).

0ld 7y ago

Since a couple of years I've been running iked [0] on my VPSed OpenBSD. It took me around 5 minutes to setup and it "just works" since then with my iPhone and MacOS clients out of the box, not requiring any additional software. But since WG is getting so high praise here, I'm now interested what are WG advantages and what does WG have to justify the effort to move away from iked and install/setup the client software everywhere? I'm certainly going to find out and test it myself, but would really appreciate just a quick answer/explanation [0] https://man.openbsd.org/iked.8 https://man.openbsd.org/iked.8

mb7733 7y ago
Same question here but using iked on on linux
hwh 7y ago
For me it's just easier to get my head around having a new network interface presented rather than this pile of security associations and transform configurations. I can just re-use my firewalling and routing knowledge and do not have to put my mind into IPsec mode to manage this. That aside, I think it's still quite a lot easier to use IPsec tooling when you want something that plays along with certificate based multi-level trust models.

tus88 7y ago

Is this like WireShark?

kronholm 7y ago
Not at all. Wireshark is for monitoring and analysis of network+hardware stuff, and WireGuard is for VPN stuff.

DictumMortuum 7y ago

Just yesterday I was looking at tinc [1] and wireguard was mentioned briefly. I'd like a way to access my home computers via ssh to keep them updated via ansible, even if they are on different networks (parents' laptops, my laptop, my raspberry servers, etc). Does anyone with more knowledge care to comment on security issues with tinc vs wireguard? Too bad that you need to use an external droplet for discovering the hosts with this one :( 1 - http://tinc-vpn.org/ http://tinc-vpn.org/

deleted 7y ago
[deleted]
QasimK 7y ago
I cannot comment on tinc, but I use WireGuard to do the same thing as you, and it works brilliantly. It was “easy” to set up and use. I wrote up what I did for my Raspberry PI server that I have at home [0]. The only other component that may be necessary is Dynamic DNS if you have a dynamic home IP address, or at the very least a way to find out your home IP at any time. [0]: https://qasimk.gitbooks.io/piserver-book/content/personal-vpn-wireguard.html https://qasimk.gitbooks.io/piserver-book/content/personal-vp...

imiric 7y ago

This is great news, and I'm looking forward to giving it a try once it's released as part of the kernel. I've been using tinc[1] for several years now, and it's been very simple to configure and use. Similarly to WG, it can tunnel over UDP, but also over TCP, supports router or switch modes, NAT traversal, etc. It's a great project, but not very popular and I'm concerned about its maintenance and security issues moving forward. To someone who's used both projects: can WG today be a drop-in replacement for tinc? [1]: https://tinc-vpn.org/ https://tinc-vpn.org/

ZoomZoomZoom 7y ago
As far as I understand, the killer feature of Tinc is automatic mesh routing. You can add a node to one instance and the information spreads through the network, wireguard doesn't do that. Also, I heard maintainers were contemplating replacing the protocol with Wireguard. https://www.tinc-vpn.org/pipermail/tinc/2017-February/004755.html https://www.tinc-vpn.org/pipermail/tinc/2017-February/004755...
- tomberek 7y ago
  Tinc as a manger of a mesh of Wireguard connections would be incredible.
- fulafel 7y ago
  IPsec also supports this - give certs signed by a mutually tusted CA to all nodes and they can all communicate host-to-host in a full mesh without needing to reconfigure when adding a host etc.
  - hwh 7y ago
    Can you please elaborate? As far as I see it, IPsec is encrypting traffic. IKE is for setup of security associations. What part of IPsec would do routing, and in this case: potentially multi-hop mesh routing?
    - fulafel 7y ago

mderazon 7y ago

Does anyone know of a way to add Wireguard to Gnome NetworkManager gui ?

mqus 7y ago
https://aur.archlinux.org/packages/networkmanager-wireguard-git/ https://aur.archlinux.org/packages/networkmanager-wireguard-... for archlinux, for other distros, you should probably look at the upstream source linked there

adevx 7y ago

Fantastic news. I deploy WireGuard to provide a private network (mesh) between VPS servers. Each VPS instance has each other vps as peer. So no single source of failure. I run PostgreSQL with Patroni and GlusterFS over this mesh with no issues. When I add or destroy a VPS with Ansible all VPS nodes get an updated config and reload. This way I don't rely on a single cloud provider because I do not use their private network service.

ghthor 7y ago
That's really interesting. So you essentially implemented a Virtual Private Cloud(VPC) on top of the "PHY" network of your hosts? Does that mean that all your nodes have to be accessible to the public internet?
- mongrelion 7y ago
  Not necessarily, no. All hosts talk to each other on their private (v)NIC.
- adevx 7y ago
  In my case yes and yes, but mostly because I spread out over two cloud providers.
  - kevin_nisbet 7y ago
    But it only needs to be accessible on the port WireGuard uses for communications, and WireGuard also has a nice property where it acts passively for non-wireguard packets. So someone on the internet doesn't necessarily know the node is reachable from the internet if they try and scan it for example. Edit: IIRC only one end of the connection needs a stable endpoint as well. IIRC WireGuard supports mobility (changing IP addresses) for one end of the connection.
    - monkeybutt 7y ago
      afaik, both ends can move, they just send packets to the latest IP they received a valid packet from.

ZoomZoomZoom 7y ago

Does anyone know anything about Wireguard-p2p? It's a tool for automatic management of endpoints and NAT-traversal for wireguard. It was announced on FOSDEM 2018[0]. Main repo[1] is stale, unfortunately. Some tool that would augment WG with more features a-la Tinc would be awesome. [0] https://archive.fosdem.org/2018/schedule/event/bulletinboard_dht/ https://archive.fosdem.org/2018/schedule/event/bulletinboard... [1] https://github.com/manuels/wireguard-p2p https://github.com/manuels/wireguard-p2p

ss3000 7y ago

Anyone aware of a VPN provider that offers WireGuard and supports more than 5 simultaneous connections? I've been using Mullvad but the 5 connections limit is starting to feel really restrictive.

A_No_Name_Mouse 7y ago
I set up a home router that I can connect to through Wireguard from all my devices, and it forwards all traffic to Mullvad. Bonus: I use PiHole on the same instance so all my devices get transparent ad- and tracker blocking
burnaway 7y ago
IVPN Pro = 7 connections limit
muldvarp 7y ago
Does mullvad allow five connections at the same time or five different keys overall?

terrywang 7y ago

Good news (rare) in Jan 2020 ;-) Using WireGuard to establish a mesh network seems good to start with but it does not scale well (even with the help of subspace web UI). Nebula (from Slack) seems to be a better option which is simple, secure and scales well so far, docs are not that well at this stage but usable. My main use case of WireGuard is to secure network traffic on Laptop/Workstations, replacing old-school complicated IPsec (strongSwan) and OpenVPN, can't be happier with its simplicity, user experience (seamless switching networks like strongSwan client for Android, per network on-demand, etc) and performance, battery life on mobile devices, etc. Anyway, non of the traditional VPN solutions (including WireGuard) work inside the Chinese GFW when travelling to China Mainland (won't go there until the 2019-nCoV is under control or a vaccine is available). So I am exploring V2ray (TLS + WebSocket + Web) and Trojan at this stage (working ones to my knowledge). Gravitational folks even implemented a WireGuard based overlay network plugin for k8s, super excited to replace flannel with wormhole (I have to admit it is a bad name) in use cases where encryption is required for overlay networking, which flannel does not offer. Many thanks to the WireGuard development team for the good work! Jason and many others, wow, I see the name of a long-time-no-see frined Herbert Xu (crypto subsystem maintainer).

terrywang 7y ago
Forgot to mention a potential problem with WireGuard, server keeps the list of clients' virtual IPs (AllowedIPs used for routing/ACLs), not ideal for VPN service providers in terms of privacy. It's not a problem for overlay network (e.g. Nebula) though, as it is considered a `requirement`.

zeveb 7y ago

Wireguard is really, really awesome. I've been using it for a bit now and it almost completely Just Works™. I've only had two issues, one of which is known and the other of which I think is probably my fault somehow. The first is that for some reason I sometimes need to ping machine B from A in order to get to C via B (in my case B sits in a VPS, while A is a laptop and C is a desktop). The other is that I would love to be able to connect directly over the LAN from A to C and vice versa, only going via B when A is mobile. I'm pretty sure that I could fix this with more IPv6 addresses and routing tables, but so far no joy.

alibert 7y ago

Is the Windows client offering better now? I'm still using the old alternative Tunsafe client on Windows because it is more stable than the official client on my laptop (got several bugs with sleep/resume/hibernation/long lived session). Well... I just tried to install the latest official Windows client and got an error about Wintun missing when activating a tunnel :/

axiomdata316 7y ago
I thought the Wintun driver was bundled with the WireGuard installation but if you need to install it separately I believe you can do it from https://www.wintun.net/ https://www.wintun.net/ Hope it helps. The Windows client is very stable now.
- alibert 7y ago
  Thank you for your help. Unfortunately, the files available on wintun.net can't be used.

freedomben 7y ago

Apologies if I've missed it, but which kernel version will be first to ship with Wireguard? Looks like 5.5-rc7 is already out, so will Wireguard be included in 5.6?