29 ms·

WireGuard Gives Linux a Faster, More Secure VPN

• nikisweeting 7y ago
  In case anyone wants some user-facing Wireguard docs with examples and further reading, I've compiled some here: https://github.com/pirate/wireguard-docs https://github.com/pirate/wireguard-docs
• jhurliman 7y ago
  Is there a version of Ubuntu that has GUI NetworkManager support for WireGuard? I’m missing the convenience of toggling the VPN on and off from the system menu.
  • gclawes 7y ago
    Or login management that doesn't involve pre-shared keys?
    • sk5t 7y ago
      A keypair is not a pre-shared key; but if you're looking for a tool to pull public keys (and peer AllowedIPs) from some other central source of truth, a script might be the right call for now.
  • kickout 7y ago
    Agreed. I have Wireguard installed, but am positive I don't have it configured properly.
    • kova12 7y ago
      it's pretty hard to misconfigure it, and then it either works or it doesn't.
  • 9cirno9 7y ago
    KDE does support configuring and enabling/disabling WireGuard over the GUI.
  • eleitl 7y ago
    They've backported Wireguard to the next LTS (20.04 aka Focal Fossa) kernel, so wait a bit. Officially, it's due 23rd April.
  • lbeltrame 7y ago
    Versions >= 1.20 have support for all the bits and pieces (including routing all traffic). Initial support landed in 1.18.
    • zoonosis 7y ago
      If that is the case, it looks like Ubuntu 19.10 and later have support. https://packages.ubuntu.com/search?keywords=network-manager&searchon=names https://packages.ubuntu.com/search?keywords=network-manager&...
      • kova12 7y ago
        if it does, I don't see "how"
        • tsukurimashou 7y ago
          I don't know try to type "Wireguard NetworkManager Ubuntu" in your favorite search engine? https://blogs.gnome.org/thaller/2019/03/15/wireguard-in-networkmanager/ https://blogs.gnome.org/thaller/2019/03/15/wireguard-in-netw...
          • tsar9x 7y ago
            I don't know try to read parent's comment again and see it's about GUI?
            • kova12 7y ago
              this doesn't even work for me in CLI. I'm able to create a connection from a wg0.conf file, but it's not coming up, while regular wireguard tools work just fine
  • heavyset_go 7y ago
    Plasma Desktop does.
• dragonsh 7y ago
  I hope WireGuard can come to feature parity with TincVPN will be nice. Especially automatic routing and mesh VPN formation, it can really help our multi-cloud container clusters connected using TincVPN to be bit more performant. The difference is WireGuard is part of Linux kernel so speed of processing packets is faster than TincVPN. Still experimenting with WireGuard and manually creating peer to peer mesh.
  • ahnick 7y ago
    Tailscale looks promising. (https://tailscale.com/ https://tailscale.com/)
    • johnmaguire2013 7y ago
      I was impressed how quickly I could go from 0 to VLAN with Tailscale on Windows. Unfortunately I did not have as nice of an experience with the AUR package on Arch. However, it looks like the maintainer replied with a link to instructions on their website with how to get it working!
      • techntoke 7y ago
        Is it the AUR package that is the problem or the Linux application itself?
      • dave_universetf 7y ago
        AUR package maintainer here (also tailscale employee). The poor experience was definitely on me. Relaynode's initial setup flow is a bit weird, and I didn't make the package explain anything. I think you were the first user of the Arch package other than me, so you got to experience the fun :) Next release will have a better daemon, with a more typical setup flow. If you want to test drive it, `tailscale-unstable-bin` is the AUR package for it.
    • nif2ee 7y ago
      I am sick of people shilling to this thing here. Stop exploiting HN for free advertising. Every Wireguard post here has become a free ad for this company. EDIT: Stop supporting parasites repackaging and rebranding open source and selling it while leaving the author who single handedly made this entire thing possible begging for donations on Patreon
• sbradford26 7y ago
  While I don't believe WireGuard is a drop in replacement for IPsec tunnels or OpenVPN I think it is a great solution to add a VPN tunnel back to your home network. I am running a WireGuard server on an Unraid server and it was trivial to setup and I can easily hit near gigabit speeds through it.
  • deepersprout 7y ago
    > While I don't believe WireGuard is a drop in replacement for IPsec tunnels or OpenVPN Why?
    • sbradford26 7y ago
      I am mostly talking about in a business setting. WireGuard hasn't even hit its first "official release". A company is not going to switch to something that has not been thoroughly vetted. Also a lot is going to have to wait on vendor support, like incorporating WireGuard into something like Cisco AnyConnect.
      • Hello71 7y ago
        this cisco anyconnect system? https://www.cvedetails.com/vulnerability-list/vendor_id-16/product_id-20904/Cisco-Anyconnect-Secure-Mobility-Client.html https://www.cvedetails.com/vulnerability-list/vendor_id-16/p... doesn't seem very secure to me.
        • sbradford26 7y ago
          CVEs mean that a company can take action to mitigate a vulnerability. Wireguard is not mature enough to have something like that. A known vulnerability is bad, but not nearly as bad as an unknown vulnerability. This is not a knock on Wireguard, I use wireguard and love it. It just has several hoops to jump through before it is ready for widespread adoption. Like NIST approving it to be used instead of IPsec or OpenVPN.
          • 7y ago
• niczem 7y ago
  Not so sure, as lonng as you can not disable logging: https://www.perfect-privacy.com/en/blog/wireguard-vpn-pros-and-cons https://www.perfect-privacy.com/en/blog/wireguard-vpn-pros-a...
  • Hikikomori 7y ago
    Their use case may require it, not true for others.
    • blattimwind 7y ago
      What they want to do, cannot be done by Wireguard, because Wireguard does not have the concept of "VPN sessions / connections". What they probably need to do is to assign each customer a fixed private IP for use within their VPN, e.g. from 10.0.0.0/8. When those are not enough any more, they need to segment their VPN, so they can re-use the private IP space in each segment. w.r.t. to "NeuroRouting and TrackStop not possible", they could route their stuff through a TUN interface to do whatever they want to do in user space. With a performance cost.
      • Znafon 7y ago
        This is a common critic of WireGuard, but it looks like those service are looking for excuses to explain why they don't propose WireGuard yet. As far as I understang it: > What they probably need to do is to assign each customer a fixed private IP for use within their VPN, e.g. from 10.0.0.0/8. Actually, they can set a different IP for each session and rotate them by given it to the client out of band, for example when it authenticates to the service. > When those are not enough any more, they need to segment their VPN Like with all other VPNs right? They could also distribute IPv6 for the tunnel and this would not be an issue.
        • blattimwind 7y ago
          > Actually, they can set a different IP for each session and rotate them by given it to the client out of band, for example when it authenticates to the service. Like I said, Wireguard does not have the concept of sessions. You could add your own proprietary "stuff" around Wireguard to add that concept, but then you don't need anything extra from Wireguard. You add the keys of the users as part of the session setup and remove them when the session is destroyed. Of course, this means that clients have to use a client tool provided by you.
• jandeboevrie 7y ago
  Freedombox makes wireguard so incredibly easy to deploy: https://raymii.org/s/tutorials/Wireguard_VPN_on_Freedombox.html https://raymii.org/s/tutorials/Wireguard_VPN_on_Freedombox.h...
• CountVonGuetzli 7y ago
  Can't wait to not have to faff about with configuring strongswan/ipsec for roadwarrior configurations anymore. Setting up WireGuard server and clients on notebooks and phones was a breeze. Really a huge leap for me in terms of usability.
• fivesixzero 7y ago
  Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall negative? Are we losing diversity in favor of a more vulnerable monoculture crop? Or both? Asking for real, not sarcastically. As a developer I’m a huge proponent of simpler, more opinionated frameworks for most projects but I’m also aware my perspective is more limited than many HN commenters.
  • Latty 7y ago
    It definitely depends on context. There are some cases where opinionated is just fundamentally better. I'd say that a good example of this is code formatting tools. These have been historically highly configurable, but that creates huge amounts of room for bikeshedding and conflict, where consistency is by far the most important thing and the actual style itself barely matters unless you start getting silly. I think it essentially becomes a sliding scale on how much consistency and "getting it right" are more important over having something be optimal or perfectly adapted to the situation. When it comes to security tools like VPNs, reducing the chances for users to shoot themselves in the foot is almost always more important than anything else, so it seems like another area that would be beneficial to have something more opinionated rather than more configurable, so the decisions are in the hands of people who have invested the time in understanding the problems at hand.
  • flyGuyOnTheSly 7y ago
    This is not some strange paradigm shift, it's the UNIX model 101 [0] [0] https://en.wikipedia.org/wiki/Unix_philosophy#Program_Design_in_the_UNIX_Environment https://en.wikipedia.org/wiki/Unix_philosophy#Program_Design...
  • saber6 7y ago
    I’ve configured IPSec vpns for the better part of 15 years. After using WireGuard for 5 minutes I knew this was going to be a big thing. IPsec has too many fucking knobs. It is it’s pitfall.
• Vysero 7y ago
  So when they say it will be embedded into the Linux Kernel, what does that mean exactly? Does that mean I will be able to open a terminal an type: WireGuard and from then on my connection to the internet will be secure so long as I don't close the terminal or what?
  • blattimwind 7y ago
    It's a kernel module. What you do in practice is to have a configuration file somewhere and then have a command line tool (wg(1)) read that file and have the wireguard kernel module create a wg0...n network device. The out of kernel alternative is how OpenVPN has always worked, by creating a TUN/TAP device, which basically creates a pipe<->network device bridge, and a user space process reading/writing from that pipe.
  • sigio 7y ago
    If you have the right config-files setup, it's a matter of typing 'wg-quick up <configname>' ... and then you will have a VPN up. Bring it down again with 'wg-quick down <configname>'. The configs itself are basically just the IP's used, and the peers and keys used to communicate with those peers. (Running a 70+ node full-mesh vpn)
    • Diederich 7y ago
      > 70+ node full-mesh vpn ~2^70 VPN connections?
      • HideousKojima 7y ago
        Wouldn't it only be 70^2 (or 69^2 or 69*70 maybe?)? Each of the 70 devices has a VPN connection to 69 other devices. So only ~5,000 total
        • rnestler 7y ago
          It would be (69*70) / 2, since connections are bi-directional, so only ~2500 connections.
• closeparen 7y ago
  What are the options right now for open source user/access management around WireGuard? I don’t love the idea of manually writing down keys in a config file. I’m thinking of writing something to template out configs for short term keys (and automatically reload) based on an OIDC authentication, but seems inelegant.
  • Hikikomori 7y ago
    Could create something where you authenticate to vpn.yourdomain.com in your browser using your preferred method that creates a temporary key and starts your wg client for you.
    • closeparen 7y ago
      Yeah that’s what I’m thinking, creating the temporary key by manipulating the config feels inelegant though.
• nif2ee 7y ago
  Don't forget to support Jason, WireGuard's author, on Patreon. https://www.patreon.com/zx2c4 https://www.patreon.com/zx2c4
  • GekkePrutser 7y ago
    Wow, 10k$/month is a lot more than a 'sustainable full-time job' would pay :) At least here in Europe. But of course what he's getting now ($1212) is nowhere near that.
    • nif2ee 7y ago
      This is more or less what a senior Frontend dev usually makes in the US. The author single handedly made the first serious FOSS VPN that can replace IPSec and OpenVPN
    • autarch 7y ago
      That's quite a bit less than someone with his skillset could earn in the US. He could easily earn 2-3x that amount in Silicon Valley, and possibly quite a bit more.
      • GekkePrutser 7y ago
        Ok I didn't know that. I heard IT wages in the US were good but I didn't think they were that good. Here in Spain you're doing well with $2200 and that's a senior position at a big multinational.
    • charlesu 7y ago
      $10k a month is a 'sustainable full-time job' for a senior developer once you factor in health insurance and the additional 7.65% self-employment tax. I prefer this model for opensource software. We get an awesome product and he gets enough money to sustain himself while maintaining it. Seems like a fair deal for all.
• 293984j29384 7y ago
  What makes Wireguard more secure? The article appears to make some weak claims about a smaller codebase and less configuration options but I don't think that translate directly into it being more secure?
  • fivesixzero 7y ago
    The main argument in the article (and other places I’ve seen WG discussed) is the relative ease of auditing the core code as well as auditing implementations. In that context it’s less of an augment that it’s “more secure” and more of an argument that it’s “more cost/time effective to assure that it (the core code or Any implementation) is secure”. That argument can be strong when considering that effective security in most projects comes down to whether assurance of security can be discerned effectively within a limited time window. Often very limited.
  • GekkePrutser 7y ago
    Smaller codebase means less chance of bugs. But I agree, it should really be audited properly before this statement can be made.
    • cyphar 7y ago
      WireGuard has been extensively audited many times for the past 4-5 years, including several formal proofs[1]. I would argue no other VPN has been as thoroughly audited (not to mention that the codebase size means that an entire-codebase audit is actually possible). That doesn't mean it's perfect (and it has had bugs), but it's definitely exceptionally well designed and written code. In addition, the crypto design (beyond it being opinionated and thus no way to misconfigure into using the "null cipher") is arguably much more secure by design than other systems. For instance, WireGuard eliminates entire classes of vulnerabilities through careful protocol design while also adding fairly neat features (such as being impossible to port scan) -- the author explains this much more eloquently than I can[2]. [1]: https://www.wireguard.com/formal-verification/ https://www.wireguard.com/formal-verification/ [2]: https://www.youtube.com/watch?v=CejbCQ5wS7Q https://www.youtube.com/watch?v=CejbCQ5wS7Q (about 23 minutes in)
  • 7y ago
• deleted 7y ago
  [deleted]
• peterwwillis 7y ago
  What I don't like about WireGuard: - Basically no real user or admin-oriented docs. There's some example configs and some getting started guides, and then some crypto-nerd look-how-secure-our-algorithms-are docs, but no real guidance on how to set up a reasonably simple network of hosts. - Authentication/authorization is just IP addresses and public keys? What about users and service accounts that you want to rotate the credentials of? What about SSO? What about fine-grained access control? What about <insert all of the enterprise things>? Big static keys and open-ended authorization by default are really not where we should be going with modern security practices. If I just want a layer 3/4 tunnel with public keys, SSH already does that. Sure, WireGuard is basically "SSH plus some easier routing", but I don't need an iteration on SSH, I need an iteration on OpenVPN, which can actually support most enterprise needs. The SSH (and WireGuard) model doesn't scale, due to a lack of functionality.
  • q3k 7y ago
    Very much agreed. While for simple use cases static keys are more than fine, a proper PKI is basically the only sane way to deploy a VPN in an enterprise or even small company setting.
    • megous 7y ago
      What do you mean by static keys? All keys are changeable at runtime and wireguard uses public key cryptography.
      • q3k 7y ago
        That all clients have to be configured on each server.
        • megous 7y ago
          Server has to know what clients to accept in any VPN solution. I still don't see the point.
• aeyes 7y ago
  Are there any official plans for 2FA in Wireguard?
  • slim 7y ago
    there is no authentication that would need a second factor in wireguard. in wireguard you authenticate the host, not a user
    • slim 7y ago
      actually there is no athentication in wireguard. only identification
      • megous 7y ago
        Each node has a list of public keys of nodes that it authorizes to communicate with it. Those nodes authenticate (provide proof of their identity) themselves via the exclusive ownership of their private keys. So I don't see yout point.
  • tptacek 7y ago
    My understanding is that the plan for WireGuard is to nail the engine and present a clean interface to system integrators, who will build their own authentication systems on top of it. The most sensible way to do MFA for WireGuard is probably though an IdP.
  • jasonjayr 7y ago
    I think at this time, the only option you'd have is a captive portal for the 2FA, and then unfirewall the in-VPN IP. WG has no provision for "connection state", only "handshake happened X seconds ago". If there's no traffic, there's no handshake.
  • zhte415 7y ago
    What would the point of 2FA be? Interested as a use-case I don't quite follow.
• danielneri 7y ago
  Been using this thru Streisand [https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand] and can honestly say it is an excellent experience. Would highly recommend deploying through Streisand / Ubuntu 16 if you'd like to experiment (and run a production setup!)
• josteink 7y ago
  WireGuard is nice and fast indeed, but unusable for me at work, because pretty much all outbound UDP-traffic is filtered. Having a TCP-based option sure would be nice.
  • julesallen 7y ago
    Yes, this is a concern as as I'm testing it as a daily driver there are quite a few public networks it won't work with. For non technical end users it's a show stopper. Without TCP/IP you're back to running dual wg and ovpn services and pretty much where we are with ip4 vs. 6. One is 'better' but the other works everywhere.
  • xxpor 7y ago
    I'd be fairly confident your work doesn't want people making random VPN tunnels from their work laptops.
    • deleted 7y ago
      [deleted]
    • zamadatix 7y ago
      Probably not but nobody said it was the work laptop just at work. It'd be pretty hard to get WG installed on a work laptop in the first place. My work does the same kind of thing on the guest SSID, drives me nuts.
  • RcrdBrt 7y ago
    I use wireguard on top of udp2raw to power through UDP-blocking firewalls all the time https://github.com/wangyu-/udp2raw-tunnel https://github.com/wangyu-/udp2raw-tunnel Added bonus: it's not TCP
    • hendersoon 7y ago
      What a cool solution! Thanks for linking it.
  • netflixandkill 7y ago
• Dirlewanger 7y ago
  They quote Mullvad in the article...aren't they now basically fucked with that new invasive Swedish law that was passed recently? Sorry, don't have a source but saw it the other day.
• hectorm 7y ago
  In the case that someone has any trouble configuring WireGuard, I would like to share my automatic deployment of WireGuard and Unbound with full IPv4 and IPv6 support with Packer and Terraform in Hetzner Cloud (although it can be easily adapted to other providers) [1]. In the case that no automatic deployment is necessary, it may also be useful to look directly at the WireGuard configuration [2]. Since WireGuard supports scripts in "PostUp" and "PostDown", I have automated the configuration of iptables, including some useful rules to redirect 53/UDP port traffic from the public interface to WireGuard, which helps in some cases to bypass some firewalls. [1]: https://github.com/hectorm/wireguard-setup https://github.com/hectorm/wireguard-setup [2]: https://github.com/hectorm/wireguard-setup/blob/master/packer/rootfs/etc/wireguard/wg0.conf https://github.com/hectorm/wireguard-setup/blob/master/packe...
  • LilBytes 7y ago
    This is awesome, I'll be giving it a go this week. Thanks!
  • saber6 7y ago
    Very nice! I just finished a very similar home project consisting of WireGuard in CentOS VM, built via Packer, deployed via Terraform to an on-prem vCenter cluster (vSphere/ESXi Host). All of the software/tools are inside a Docker container (for versioning). Next, I plan on doing AWS, Azure, Google, and Packet. I'll send you a note when I put my stuff on GitHub as you may be interested in some of the tooling (specifically, Makefiles to help speed up workflows).
• sccxy 7y ago
  pivpn is easiest way to set it up. Great tool for newbies like me. QR setup for mobile also available. https://github.com/pivpn/pivpn https://github.com/pivpn/pivpn
• smush 7y ago
  TL;DR: Should I keep fussing with PiVPN or try something like TincVPN? Semi-OT: So I just installed PiVPN to use with this protocol to try and do a small vpn at home (all I want is to go to my domain, auth, and be on my LAN so I can RDP / VNC) and the wireguard bits worked great, and the install process was buttery smooth, even on a Raspbery Pi Zero W. But - my network lack of knowledge is probably hamstringing me. I opened the WG port on my router and confirmed the dns hostname I'm using corresponds to the public IP, but I'm not able to get the wireguard clients to connect. The tcpdump doesn't show any incoming traffic on the port at all. Should I keep fussing with PiVPN or try something like TincVPN or Tailscale? I have not been able to get a VNC or RDP session going over tailscale even though all my machines are able to connect to the Tailscale network. I want to use wireguard, everyone says it is so good, and OpenVPN does seem a bit boring, but ultimately I'm just hitting a wall when it comes to the use case of 'auth, you are on your home lan, connect as if you are at home connected to wifi'
  • andreareina 7y ago
    Have you tried using the tailscale interface IPs (100.x.x.x)? I've been able to use VNC over those addresses.
    • smush 7y ago
      I have, but I've not been able to VNC over them. I've made sure the FW rules let tailscale do anything and have even tried turning both firewalls off entirely but at least for TightVNC it doesn't like it, nor RDP (RDP enabled in System settings). But this does give me hope that it can be done in the first place, I just have some setting goofed up somewhere. I will restart my tailscale stuff now that I know someone out there has done it. Thanks!
  • bubersson 7y ago
    Make sure that the port is correct and it is UDP (not TCP). (I just did the same setup with PiVPN. Somehow I got a wrong port number first, but then it worked)
    • 7y ago
• tosh 7y ago
  I think Tailscale [1] can be to WireGuard what Github and Gitlab are to git. If you haven’t checked them out yet: worth taking a look! [1] https://tailscale.com https://tailscale.com
  • ytechie 7y ago
    Is that like Hamachi? https://vpn.net/ https://vpn.net/
  • cprecioso 7y ago
    What is the difference between this and ZeroTier? https://www.zerotier.com/ https://www.zerotier.com/
    • perryh2 7y ago
      https://twitter.com/perry_huang/status/1223393351845548032 https://twitter.com/perry_huang/status/1223393351845548032
  • nif2ee 7y ago
    What do you gain by shilling for alpha-tier for-profit software for free? Are they your friends? do they pay you for that?
    • tssva 7y ago
      Accusing someone of shilling is contrary to HN comment guidelines. "Please don't post insinuations about astroturfing, shilling, brigading, foreign agents and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email us and we'll look at the data."
    • tosh 7y ago
      I was setting up a Raspberry Pi (3B+) at the office and wanted to connect to it from home. Researching various approaches lead me to a hn thread recommending Tailscale, signed up, worked for me & now I’m a happy user and planning to get 2 additional new Pis tomorrow (still deciding between the 2G and the 4G model). edit: I regularly recommend things I find useful to others (especially those that took me some effort to discover) independent of whether they are bits of insight (try x instead of y), open source software or for profit software. Just thought others might find this useful as well, that’s all.
• z3t4 7y ago
  I reviewed vpn solutions on Linux a few weeks ago and Wireguard was the easiest to setup among the secure protocols.
• twentyloops 7y ago
  Check out Algo [0] if you're interested in setting up a personal WireGuard VPN server. It's simple and hassle-free, especially if you are not familiar with server administration and don't want to be bogged down by details. I have one deployed on Digital Ocean ($5/mo droplet). All you need to do is run the setup script, answer a few yes/no questions (optional features), paste in your API key, and update the firewall setting on Digital Ocean's dashboard. If anything goes wrong, deploying a new one only takes minutes. [0] https://github.com/trailofbits/algo https://github.com/trailofbits/algo
  • nikisweeting 7y ago
    +1 for Algo, it's better than Streissand imo.
    • danielneri 7y ago
      What makes it better? I've been using Streisand quite successfully, and the setup appears easier from the little I've read about Algo (haven't implemented myself yet)
      • nikisweeting 7y ago
        Personally I like Algo because it also handles provisioning a dedicated VPS with some sane system defaults. It also sets up IKEv2 and Wireguard together, which makes it easier to have a multi-platform VPN out of the box without having to set up Wireguard & IPsec separately. It may not be what everyone wants though, Streissand is great in its own ways too.
  • cpach 7y ago
    I honestly had no idea that DigitalOcean has a ”built-in” firewall. That’s awesome. Thank you!
    • wuunderbar 7y ago
      Don't all cloud providers have these for their compute VMs? (e.g,. AWS security groups)
• lapinot 7y ago
  I really like wireguard, but one thing that bugs me is the fact that it's layer 3 (an ip tunnel) and has no code to support layer 2 (ethernet MAC tunnel). The downside for me is that you have to manage static ips in the configurations (specifically it's not compatible with ipv6 slaac and NDP). There is https://git.zx2c4.com/wg-dynamic https://git.zx2c4.com/wg-dynamic but it's very experimental at the moment. The level 3-only tunnel is motivated as "the cleanest approach for ensuring authenticity and attributability of the packets" (in the whitepaper), but in fact every claim and routing algorithm described (needed since the tunnel is many-to-one) would work equally well substituting "ip address" with "mac address" (i may be missing something, but for sure it's not explicit anywhere). And indeed imho it would be less surprising to have an "allowed mac address" option in the configuration than an "allowed ip address": it's already common practice to white-list mac address of physical endpoints (in office). I'm toying with the idea of forking the driver code to adapt it to ethernet frames as i don't think it would need any big rewrite but i'm realizing my inexperience in writing kernel code.
  • jbverschoor 7y ago
    Zerotier does a perfect job ..
    • EmoSupportEmu 7y ago
      Agreed. That's my daily driver. No pun intended.
    • v0tary 7y ago
      I disagree - spent a considerable amount of time with zerotier as a possible replacement of a small sized ipsec mesh (4 sites) and it failed horribly. Had commercial support, different hardware and even virtualized it. Latency was a major issue and quality of the links were erratic to say the least. Don't get me wrong, I think zerotier is great, but it's not prime time.
      • grumblez 7y ago
        Your physical network settings likely didn't allow direct connections between peers. Fix that and it'll work fine.
• upofadown 7y ago
  Recentish negative article about Wireguard: * https://blog.ipfire.org/post/why-not-wireguard https://blog.ipfire.org/post/why-not-wireguard
  • labawi 7y ago
    > Is WireGuard faster than other VPN solutions? > ChaCha20 is a stream cipher which are easier to implement in software. They encrypt one bit at a time. Block ciphers like AES encrypt a block of 128 bits at a time. .. Wow. I'm avoiding wireguard for other reasons, but there is a lot of FUD in that article.
  • drummer 7y ago
    Very interesting read.
• app4soft 7y ago
  $ systemd $ wired
• Havoc 7y ago
  Will be great when this becomes mainstream & hopefully common place. A ton of links are conceptually point to point but not encrypted as such because existing means are a pain in the ass
• holmberd 7y ago
  I've used IVPN for years and it works flawlessly.