8 ms·

I hope WireGuard can come to feature parity with TincVPN will be nice. Especially automatic routing and mesh VPN formation, it can really help our multi-cloud c

I hope WireGuard can come to feature parity with TincVPN will be nice. Especially automatic routing and mesh VPN formation, it can really help our multi-cloud container clusters connected using TincVPN to be bit more performant. The difference is WireGuard is part of Linux kernel so speed of processing packets is faster than TincVPN. Still experimenting with WireGuard and manually creating peer to peer mesh.

ahnick 7y ago
Tailscale looks promising. (https://tailscale.com/ https://tailscale.com/)
- johnmaguire2013 7y ago
  I was impressed how quickly I could go from 0 to VLAN with Tailscale on Windows. Unfortunately I did not have as nice of an experience with the AUR package on Arch. However, it looks like the maintainer replied with a link to instructions on their website with how to get it working!
  - techntoke 7y ago
    Is it the AUR package that is the problem or the Linux application itself?
  - dave_universetf 7y ago
    AUR package maintainer here (also tailscale employee). The poor experience was definitely on me. Relaynode's initial setup flow is a bit weird, and I didn't make the package explain anything. I think you were the first user of the Arch package other than me, so you got to experience the fun :) Next release will have a better daemon, with a more typical setup flow. If you want to test drive it, `tailscale-unstable-bin` is the AUR package for it.
- nif2ee 7y ago
  I am sick of people shilling to this thing here. Stop exploiting HN for free advertising. Every Wireguard post here has become a free ad for this company. EDIT: Stop supporting parasites repackaging and rebranding open source and selling it while leaving the author who single handedly made this entire thing possible begging for donations on Patreon
  - tptacek 7y ago
    Last time I talked to him about it, Jason Donenfeld was not upset about Tailscale. You'll have to find someone else to be vicariously outraged for.
    - nif2ee 7y ago
      Of course I am sure he is extremely happy spending 5 years developing the next big thing then others rebrand it for enterprise and become rich.
      - tptacek 7y ago
        Jason comments here all the time and is quite easy to talk to, and I think we're all better off hearing from real Jason, not some imaginary angry Jason you've invented. Not least because there are actual abuses in the WireGuard ecosystem, and your imaginary Jason is obscuring them behind fake abuses.
        nif2ee 7y ago
        I didn't say he is angry, my main point was not advertise for free for a company that is built off the work of a single man, especially when it's FOSS, especially when it's a technically piece of genius like WireGuard, while not supporting the man himself. There are known ways for companies to market their paid product, it's called ads.
      - StreamBright 7y ago
        This is not how opensource works.
- dragonsh 7y ago
  Is tailscale open source like Tinc? From the website cannot see it.
eximius 7y ago
I am not saying I don't want those features, but I do hope that a VPN in the kernel with one of its primary features being small, lean, auditable code, will think twice about adding a bunch of stuff. Have you considered Nebula?
- mindslight 7y ago
  Most of tinc's functionality could be implemented in userspace using the wireguard kernel module, and so wireguard itself won't really need to grow. The one thing I wish wireguard had was overlapping AllowedIPs with 'ip route via' to distinguish (although this isn't a tinc feature either, unless you run it as an ethernet segment). The same result can be achieved using a separate interface for every peer and 0/0 at each end, but it's a bit unwieldy.
eleitl 7y ago
k8s already uses Wireguard for the service mesh internally. For a globally routed overlay mesh, have a look at https://yggdrasil-network.github.io/ https://yggdrasil-network.github.io/ The latest version actually uses the Wireguard TUN library https://yggdrasil-network.github.io/2020/02/21/release-v0-3-13.html https://yggdrasil-network.github.io/2020/02/21/release-v0-3-...
- q3k 7y ago
  > k8s already uses Wireguard for the service mesh internally. No it doesn't. There are some CNI plugins that use Wireguard, but it's not standard in any way (like any other network plugin, really).
- thenewnewguy 7y ago
  > k8s already uses Wireguard for the service mesh internally. Kubernetes does not use anything for the service mesh internally - as it does not provide a service mesh. By this I can only assume you mean some popular CNI provider uses wireguard, but out of the ones I know of (flannel, weave, calico, canal, romana) I don't believe any use wireguard.
PhilippGille 7y ago
For WireGuard there's the official https://github.com/WireGuard/wg-dynamic https://github.com/WireGuard/wg-dynamic, or also this: https://github.com/costela/wesher https://github.com/costela/wesher. Or generally for mesh networks as others mentioned: Slack's Nebula, ZeroTier (wait for v2) or Tailscale.
LinuxBender 7y ago
One suggestion would be to submit a feature request to Tinc to add detection / support of Wireguard. Tinc could still handle the mesh routing and just hand off the encryption bits to WG. There have been some brief discussion in email threads [1] Probably more, have not checked all the archives. [1] - https://www.tinc-vpn.org/pipermail/tinc/2017-February/004755.html https://www.tinc-vpn.org/pipermail/tinc/2017-February/004755...
- linsomniac 7y ago
  Fascinating idea! I've been really interested in Tinc, but it seems to be languishing where WireGuard is really taking off. The meshing in Tinc seems quite interesting. Though, honestly, I'm pretty happy with OpenVPN.

ahnick 7y ago

Tailscale looks promising. (https://tailscale.com/ https://tailscale.com/)

johnmaguire2013 7y ago
I was impressed how quickly I could go from 0 to VLAN with Tailscale on Windows. Unfortunately I did not have as nice of an experience with the AUR package on Arch. However, it looks like the maintainer replied with a link to instructions on their website with how to get it working!
- techntoke 7y ago
  Is it the AUR package that is the problem or the Linux application itself?
- dave_universetf 7y ago
  AUR package maintainer here (also tailscale employee). The poor experience was definitely on me. Relaynode's initial setup flow is a bit weird, and I didn't make the package explain anything. I think you were the first user of the Arch package other than me, so you got to experience the fun :) Next release will have a better daemon, with a more typical setup flow. If you want to test drive it, `tailscale-unstable-bin` is the AUR package for it.
nif2ee 7y ago
I am sick of people shilling to this thing here. Stop exploiting HN for free advertising. Every Wireguard post here has become a free ad for this company. EDIT: Stop supporting parasites repackaging and rebranding open source and selling it while leaving the author who single handedly made this entire thing possible begging for donations on Patreon
- tptacek 7y ago
  Last time I talked to him about it, Jason Donenfeld was not upset about Tailscale. You'll have to find someone else to be vicariously outraged for.
  - nif2ee 7y ago
    Of course I am sure he is extremely happy spending 5 years developing the next big thing then others rebrand it for enterprise and become rich.
    - tptacek 7y ago
      Jason comments here all the time and is quite easy to talk to, and I think we're all better off hearing from real Jason, not some imaginary angry Jason you've invented. Not least because there are actual abuses in the WireGuard ecosystem, and your imaginary Jason is obscuring them behind fake abuses.
      - nif2ee 7y ago
        I didn't say he is angry, my main point was not advertise for free for a company that is built off the work of a single man, especially when it's FOSS, especially when it's a technically piece of genius like WireGuard, while not supporting the man himself. There are known ways for companies to market their paid product, it's called ads.
    - StreamBright 7y ago
      This is not how opensource works.
dragonsh 7y ago
Is tailscale open source like Tinc? From the website cannot see it.

eximius 7y ago

I am not saying I don't want those features, but I do hope that a VPN in the kernel with one of its primary features being small, lean, auditable code, will think twice about adding a bunch of stuff. Have you considered Nebula?

mindslight 7y ago
Most of tinc's functionality could be implemented in userspace using the wireguard kernel module, and so wireguard itself won't really need to grow. The one thing I wish wireguard had was overlapping AllowedIPs with 'ip route via' to distinguish (although this isn't a tinc feature either, unless you run it as an ethernet segment). The same result can be achieved using a separate interface for every peer and 0/0 at each end, but it's a bit unwieldy.

eleitl 7y ago

k8s already uses Wireguard for the service mesh internally. For a globally routed overlay mesh, have a look at https://yggdrasil-network.github.io/ https://yggdrasil-network.github.io/ The latest version actually uses the Wireguard TUN library https://yggdrasil-network.github.io/2020/02/21/release-v0-3-13.html https://yggdrasil-network.github.io/2020/02/21/release-v0-3-...

q3k 7y ago
> k8s already uses Wireguard for the service mesh internally. No it doesn't. There are some CNI plugins that use Wireguard, but it's not standard in any way (like any other network plugin, really).
thenewnewguy 7y ago
> k8s already uses Wireguard for the service mesh internally. Kubernetes does not use anything for the service mesh internally - as it does not provide a service mesh. By this I can only assume you mean some popular CNI provider uses wireguard, but out of the ones I know of (flannel, weave, calico, canal, romana) I don't believe any use wireguard.

PhilippGille 7y ago

For WireGuard there's the official https://github.com/WireGuard/wg-dynamic https://github.com/WireGuard/wg-dynamic, or also this: https://github.com/costela/wesher https://github.com/costela/wesher. Or generally for mesh networks as others mentioned: Slack's Nebula, ZeroTier (wait for v2) or Tailscale.

LinuxBender 7y ago

One suggestion would be to submit a feature request to Tinc to add detection / support of Wireguard. Tinc could still handle the mesh routing and just hand off the encryption bits to WG. There have been some brief discussion in email threads [1] Probably more, have not checked all the archives. [1] - https://www.tinc-vpn.org/pipermail/tinc/2017-February/004755.html https://www.tinc-vpn.org/pipermail/tinc/2017-February/004755...

linsomniac 7y ago
Fascinating idea! I've been really interested in Tinc, but it seems to be languishing where WireGuard is really taking off. The meshing in Tinc seems quite interesting. Though, honestly, I'm pretty happy with OpenVPN.