4 ms·
I use WireGuard on OpenBSD and Linux and it is just simply beautiful. THANK YOU Jason for writing it and to everyone else who has contributed code, testing, mo
by Panino 7y ago
I use WireGuard on OpenBSD and Linux and it is just simply beautiful.
THANK YOU Jason for writing it and to everyone else who has contributed code, testing, money, whatever.
I believe WireGuard will become the most widely used VPN above IPsec and OpenVPN. There will still be use cases for them (especially IPsec) but both will lose marketshare dramatically.
- yardstick 7y agoWireGuard is nice but needs 2FA support. Until then it can’t be used in various corporate road warrior scenarios. Also until Cisco, Juniper, etc add WireGuard support and enough devices are deployed with it, IPsec will remain the corporate tool of choice when connecting between different organisations. Within the same org, where you have greater control of the equipment used, WireGuard is a bit more feasible.
- treesknees 7y agoWhat you're describing (authentication/2FA) should be handled by a client application. VPN client software should handle authentication/authorization with the corporate VPN server. Once it's authenticated, it can exchange/generate the public-private keys used for the WireGuard tunnel. The VPN client then installs those keys and starts the tunnel. After that, it's up to the client and server VPN software to handle session timeouts, reconnections, host machine security policies, etc etc. None of that is the job of WireGuard itself.
- yardstick 7y agoThat’s still just one factor on the tunnel itself, which is the problem. If the keypair is discovered somehow, attackers could connect to your network without 2FA. Or am I missing something? So what software can I use now to make 2FA work with WireGuard that’s simple to use - as simple as OpenVPN (cert+user/pass is trivial in OpenVPN and supported in their clients).