4 ms·

Several of the criticisms in this article seem fair, some less so to me, but this does really hit the problem on the head: > It is not very hard for me to conc

Several of the criticisms in this article seem fair, some less so to me, but this does really hit the problem on the head: > It is not very hard for me to conclude that WireGuard is not ready - yet. > It has been drafted as a lightweight and fast solution to some problems of the existing solutions. Unfortunately it has sacrificed many features that will be relevant for many users and therefore will not be able to replace IPsec and OpenVPN. > For that we need to add at least IP address assignment, pushing configuration like DNS servers and routes. This has certainly been the case for me. My use case for a VPN is a typical road warrior set-up. In my experience Wireguard seems like it's probably great for people who are accustomed to setting up custom VPN configurations already, and in fact probably simplifies the steps in doing so. But as someone who just needs a set-it-and-forget-it configuration to remote in and forward my connections that just consistently works, trying to get Wireguard working was hours of misery. There's enough tooling built around OpenVPN that you can generate a simple .ovpn configuration that just works and does everything you want in a few minutes. You don't need to be a professional network admin or have a lot of experience configuring VPNs. I hope Wireguard gets to that point because I really do believe in its technical superiority.

vesinisa 7y ago
I see WireGuard as a very promising VPN protocol. It should be easy to build e.g. higher level configuration protocols for DNS and such on top of it. WireGuard itself seems to adhere well to the Unix philosophy of doing just one thing and doing it really well. With OpenVPN you have all the bells and whistles, and it's easy to get tripped up in the myriad of configuration options. With WireGuard you start with the fundamentals: establishing the tunnel interface. Then you start adding routing, DNS etc. to suite your specific scenario.
- bscphil 7y ago
  > I see WireGuard as a very promising VPN protocol. It should be easy to build e.g. higher level configuration protocols for DNS and such on top of it. You're 100% correct about this, but I think it's easy to miss that you could say very similar things about all sorts of very well designed, low-level technologies, that for years no one has bothered to build the necessary high level tooling around! Magic Wormhole is another great example: it's a brilliant system, it's even very easy to use from the terminal, but nobody has bothered to build a GUI around it or create any of the more complicated (but awesome!) tooling that the wormhole protocol allows. (At least as of the last time I looked into this.)
  - BiteCode_dev 7y ago
    There is a lot of overlap between wormhole and webrtc thought, and using it as a channel has been on the road map for a long time. So maybe people knowledgeable enough to build it just waited for it, or went to apply PAKE like rdv on top of webrtc.
StavrosK 7y ago
I was in the same boat as you, so I wrote stuff up so you don't have to wonder: https://www.stavros.io/posts/how-to-configure-wireguard/ https://www.stavros.io/posts/how-to-configure-wireguard/ It takes hours to set up if you don't know how (and the docs aren't amazing), but it should take you ten minutes using my article.
- ajosh 7y ago
  Thanks for writing this up - you did a great job. I came across it on a DDG search when I was exploring WireGuard and as a result, I found it easy to setup!
  - StavrosK 7y ago
    Thanks, I'm glad it helped!
- vxNsr 7y ago
  Do you know of anything like this available for windows? all the guides are for linux, but I use windows for my every day laptop, I'd also like to set this up for my phone and obviously iOS doesn't really have a cli. For what it's worth this did seem easy to follow, I just know that when I tried to follow a guide similar to this one a while back I couldn't get it to work for a windows client.
  - StavrosK 7y ago
    Hmm, no, I'm afraid I don't. Doesn't it use config files too?
  - TheKitchenSinc 7y ago
    Are you just looking to set it up with iOS and Windows clients? If the Wireguard server is running Linux, an easy way to copy the config over to an iOS or Android device is to use qrencode. For example, `qrencode -t ansiutf8 < $config_file` will output a QR code that can be scanned from the Wireguard app to automatically import as a new tunnel. I used StavrosK's guide (thank you!) to put together two scripts a while back, one for generating a new server config file, and one to generate a new client config, outputting the config to a file as well as to a QR code on stdout. You can copy the client.conf file over to the Windows machine and import the configuration via the "Import tunnel(s) from file..." option in the Wireguard client, or scan the QR code output from the mobile device clients via "Create from QR code". Here's my script for generating a client cert: https://cdn.seedno.de/txt/wireguard-certgen https://cdn.seedno.de/txt/wireguard-certgen. It assumes Wireguard is already configured on the server on interface wg0, and is using the default port of 51820/UDP, though both are configurable via variables. For reference, the accompanying setup script is https://cdn.seedno.de/txt/wireguard-setup https://cdn.seedno.de/txt/wireguard-setup. Both scripts require a bit of customization to match your environment (you may want to be particularly careful with the iptables firewall PostUp/PostDown commands), but hopefully they can serve as a starting point to figure out any issues you encountered last time you tried.
igetspam 7y ago
I setup a server and got three engineers connected in an afternoon. I've never been that successful with an IPSec deployment. The hardest part for me was coming up with a way to link IPs, keys and users. I wrote a small Python script and store the peer info in a small DB. Not super difficult and the engineers using it took less than 10m each. Mac, Linux and windows. Pretty impressed. What's missing for me: * a good "connected" indicator * session tracking/logging Pretty sure I can solve the tracking problem with iptablea or some not very clever network monitoring software.
- threentaway 7y ago
  > What's missing for me: * a good "connected" indicator * session tracking/logging Wireguard is (sort of) stateless by design, so this would be tough.

vesinisa 7y ago

I see WireGuard as a very promising VPN protocol. It should be easy to build e.g. higher level configuration protocols for DNS and such on top of it. WireGuard itself seems to adhere well to the Unix philosophy of doing just one thing and doing it really well. With OpenVPN you have all the bells and whistles, and it's easy to get tripped up in the myriad of configuration options. With WireGuard you start with the fundamentals: establishing the tunnel interface. Then you start adding routing, DNS etc. to suite your specific scenario.

bscphil 7y ago
> I see WireGuard as a very promising VPN protocol. It should be easy to build e.g. higher level configuration protocols for DNS and such on top of it. You're 100% correct about this, but I think it's easy to miss that you could say very similar things about all sorts of very well designed, low-level technologies, that for years no one has bothered to build the necessary high level tooling around! Magic Wormhole is another great example: it's a brilliant system, it's even very easy to use from the terminal, but nobody has bothered to build a GUI around it or create any of the more complicated (but awesome!) tooling that the wormhole protocol allows. (At least as of the last time I looked into this.)
- BiteCode_dev 7y ago
  There is a lot of overlap between wormhole and webrtc thought, and using it as a channel has been on the road map for a long time. So maybe people knowledgeable enough to build it just waited for it, or went to apply PAKE like rdv on top of webrtc.

StavrosK 7y ago

I was in the same boat as you, so I wrote stuff up so you don't have to wonder: https://www.stavros.io/posts/how-to-configure-wireguard/ https://www.stavros.io/posts/how-to-configure-wireguard/ It takes hours to set up if you don't know how (and the docs aren't amazing), but it should take you ten minutes using my article.

ajosh 7y ago
Thanks for writing this up - you did a great job. I came across it on a DDG search when I was exploring WireGuard and as a result, I found it easy to setup!
- StavrosK 7y ago
  Thanks, I'm glad it helped!
vxNsr 7y ago
Do you know of anything like this available for windows? all the guides are for linux, but I use windows for my every day laptop, I'd also like to set this up for my phone and obviously iOS doesn't really have a cli. For what it's worth this did seem easy to follow, I just know that when I tried to follow a guide similar to this one a while back I couldn't get it to work for a windows client.
- StavrosK 7y ago
  Hmm, no, I'm afraid I don't. Doesn't it use config files too?
- TheKitchenSinc 7y ago
  Are you just looking to set it up with iOS and Windows clients? If the Wireguard server is running Linux, an easy way to copy the config over to an iOS or Android device is to use qrencode. For example, `qrencode -t ansiutf8 < $config_file` will output a QR code that can be scanned from the Wireguard app to automatically import as a new tunnel. I used StavrosK's guide (thank you!) to put together two scripts a while back, one for generating a new server config file, and one to generate a new client config, outputting the config to a file as well as to a QR code on stdout. You can copy the client.conf file over to the Windows machine and import the configuration via the "Import tunnel(s) from file..." option in the Wireguard client, or scan the QR code output from the mobile device clients via "Create from QR code". Here's my script for generating a client cert: https://cdn.seedno.de/txt/wireguard-certgen https://cdn.seedno.de/txt/wireguard-certgen. It assumes Wireguard is already configured on the server on interface wg0, and is using the default port of 51820/UDP, though both are configurable via variables. For reference, the accompanying setup script is https://cdn.seedno.de/txt/wireguard-setup https://cdn.seedno.de/txt/wireguard-setup. Both scripts require a bit of customization to match your environment (you may want to be particularly careful with the iptables firewall PostUp/PostDown commands), but hopefully they can serve as a starting point to figure out any issues you encountered last time you tried.

igetspam 7y ago

I setup a server and got three engineers connected in an afternoon. I've never been that successful with an IPSec deployment. The hardest part for me was coming up with a way to link IPs, keys and users. I wrote a small Python script and store the peer info in a small DB. Not super difficult and the engineers using it took less than 10m each. Mac, Linux and windows. Pretty impressed. What's missing for me: * a good "connected" indicator * session tracking/logging Pretty sure I can solve the tracking problem with iptablea or some not very clever network monitoring software.

threentaway 7y ago
> What's missing for me: * a good "connected" indicator * session tracking/logging Wireguard is (sort of) stateless by design, so this would be tough.