43 ms·

So when they say it will be embedded into the Linux Kernel, what does that mean exactly? Does that mean I will be able to open a terminal an type: WireGuard and

by Vysero 7y ago

So when they say it will be embedded into the Linux Kernel, what does that mean exactly? Does that mean I will be able to open a terminal an type: WireGuard and from then on my connection to the internet will be secure so long as I don't close the terminal or what?

blattimwind 7y ago
It's a kernel module. What you do in practice is to have a configuration file somewhere and then have a command line tool (wg(1)) read that file and have the wireguard kernel module create a wg0...n network device. The out of kernel alternative is how OpenVPN has always worked, by creating a TUN/TAP device, which basically creates a pipe<->network device bridge, and a user space process reading/writing from that pipe.
sigio 7y ago
If you have the right config-files setup, it's a matter of typing 'wg-quick up <configname>' ... and then you will have a VPN up. Bring it down again with 'wg-quick down <configname>'. The configs itself are basically just the IP's used, and the peers and keys used to communicate with those peers. (Running a 70+ node full-mesh vpn)
- Diederich 7y ago
  > 70+ node full-mesh vpn ~2^70 VPN connections?
  - HideousKojima 7y ago
    Wouldn't it only be 70^2 (or 69^2 or 69*70 maybe?)? Each of the 70 devices has a VPN connection to 69 other devices. So only ~5,000 total
    - rnestler 7y ago
      It would be (69*70) / 2, since connections are bi-directional, so only ~2500 connections.
    - Diederich 7y ago
      That's right, I got the two mixed up.
    - philsnow 7y ago
      wireguard uses UDP so they're not actual "connections"
      - nikisweeting 7y ago
        Yeah this is a critical point that the others are ignoring, it only sends packets when they're actual traffic. Maintaining 5000 connections is pretty easy when they're not big stateful TCP sockets.
  - blattimwind 7y ago
    Wireguard is not connection based, so a full-mesh VPN with n nodes essentially just means each node has n-1 peer keys and maintains a routing table with n-1 entries for the VPN.
    - mindslight 7y ago
      There are still 70x69/2 connections going on under the hood. You can't completely ignore that complexity - if there are underlying connectivity issues, specific host-host traffic will fail (eg due to NAT). My wireguard setup actually has n x (n-1) config files/instances (current n=8), as that's the only way to shuffle default-gateways over it. It's a little unwieldy, but still manageable. Whereas I can't imagine doing the same with OpenVPN.
e12e 7y ago
> Does that mean I will be able to open a terminal an type: WireGuard and from then on my connection to the internet will be secure It's more like how iptables/nftables is part of the kernel. You need a recent kernel along with user space tooling. But it will become part of virtually every Linux distribution. As for "my connection to the internet will be secure" - that's possible, but the main use case right now is "my connection to my vpn/server will be secure". Additional configuration is required to route all traffic through the wireguard tunnel, and make sure all other traffic is dropped - and to make sure all traffic is dropped, rather than sent in plaintext when the tunnel goes down (a "kill switch"). I'm sure we'll see many tools and scripts that will help automate such setups. But if you just want a udp routed VPN - you might want to look at zerotier or tinc.
- Vysero 7y ago
  This may sound like a newb question but.. is my connection to my vpn/server not already secure on Linux?
  - e12e 7y ago
    Wireguard is one way to secure your connection to another machine. That machine could be a "VPN server" - which typically mean one of two things: 1) By connecting to that server, you get access to private resources as if you were on the same network. Say, access to a printer, a web camera or a file server that aren't exposed to the Internet. 2) You gain access to the Internet through that server, so that your publically visible IP changes. This prevents anyone between you and the server to see the content of your traffic (eg: your isp, the hotel it staff that runs your free wifi). It can also grant you access to resources that are exposed to the internet - but filter access based on IP. Such as a CRM system, or webmail system. If you are connecting to a VPN server, then, by definition (virtual private network) - your connection should be secure. Wireguard is one way in which that access can be secured - and it's new/modern, simple and widely regarded as following best practices. Alternatives are ipsec via eg strongswan, OpenVPN and a bunch of nasty proprietary solutions constructed out of mixes of libssl and obscure hedge magic.

by Vysero 7y ago

blattimwind 7y ago

It's a kernel module. What you do in practice is to have a configuration file somewhere and then have a command line tool (wg(1)) read that file and have the wireguard kernel module create a wg0...n network device. The out of kernel alternative is how OpenVPN has always worked, by creating a TUN/TAP device, which basically creates a pipe<->network device bridge, and a user space process reading/writing from that pipe.

sigio 7y ago

If you have the right config-files setup, it's a matter of typing 'wg-quick up <configname>' ... and then you will have a VPN up. Bring it down again with 'wg-quick down <configname>'. The configs itself are basically just the IP's used, and the peers and keys used to communicate with those peers. (Running a 70+ node full-mesh vpn)

Diederich 7y ago
> 70+ node full-mesh vpn ~2^70 VPN connections?
- HideousKojima 7y ago
  Wouldn't it only be 70^2 (or 69^2 or 69*70 maybe?)? Each of the 70 devices has a VPN connection to 69 other devices. So only ~5,000 total
  - rnestler 7y ago
    It would be (69*70) / 2, since connections are bi-directional, so only ~2500 connections.
  - Diederich 7y ago
    That's right, I got the two mixed up.
  - philsnow 7y ago
    wireguard uses UDP so they're not actual "connections"
    - nikisweeting 7y ago
      Yeah this is a critical point that the others are ignoring, it only sends packets when they're actual traffic. Maintaining 5000 connections is pretty easy when they're not big stateful TCP sockets.
- blattimwind 7y ago
  Wireguard is not connection based, so a full-mesh VPN with n nodes essentially just means each node has n-1 peer keys and maintains a routing table with n-1 entries for the VPN.
  - mindslight 7y ago
    There are still 70x69/2 connections going on under the hood. You can't completely ignore that complexity - if there are underlying connectivity issues, specific host-host traffic will fail (eg due to NAT). My wireguard setup actually has n x (n-1) config files/instances (current n=8), as that's the only way to shuffle default-gateways over it. It's a little unwieldy, but still manageable. Whereas I can't imagine doing the same with OpenVPN.

e12e 7y ago

> Does that mean I will be able to open a terminal an type: WireGuard and from then on my connection to the internet will be secure It's more like how iptables/nftables is part of the kernel. You need a recent kernel along with user space tooling. But it will become part of virtually every Linux distribution. As for "my connection to the internet will be secure" - that's possible, but the main use case right now is "my connection to my vpn/server will be secure". Additional configuration is required to route all traffic through the wireguard tunnel, and make sure all other traffic is dropped - and to make sure all traffic is dropped, rather than sent in plaintext when the tunnel goes down (a "kill switch"). I'm sure we'll see many tools and scripts that will help automate such setups. But if you just want a udp routed VPN - you might want to look at zerotier or tinc.

Vysero 7y ago
This may sound like a newb question but.. is my connection to my vpn/server not already secure on Linux?
- e12e 7y ago
  Wireguard is one way to secure your connection to another machine. That machine could be a "VPN server" - which typically mean one of two things: 1) By connecting to that server, you get access to private resources as if you were on the same network. Say, access to a printer, a web camera or a file server that aren't exposed to the Internet. 2) You gain access to the Internet through that server, so that your publically visible IP changes. This prevents anyone between you and the server to see the content of your traffic (eg: your isp, the hotel it staff that runs your free wifi). It can also grant you access to resources that are exposed to the internet - but filter access based on IP. Such as a CRM system, or webmail system. If you are connecting to a VPN server, then, by definition (virtual private network) - your connection should be secure. Wireguard is one way in which that access can be secured - and it's new/modern, simple and widely regarded as following best practices. Alternatives are ipsec via eg strongswan, OpenVPN and a bunch of nasty proprietary solutions constructed out of mixes of libssl and obscure hedge magic.