31 ms·

WireGuard 1.0 for Linux 5.6

768 points by zx2c4 7y ago

rasengan 7y ago
We have all been waiting for this. Congratulations to Jason and the whole WireGuard team and community! And, thank you Linus!
deleted 7y ago
[deleted]
pkrumins 7y ago
Very exciting! Does anyone know a good howto or a tutorial about it?
- hectormalot 7y ago
  I used the Stavros one: https://www.stavros.io/posts/how-to-configure-wireguard/ https://www.stavros.io/posts/how-to-configure-wireguard/ Great to see 1.0.0 released. I’ve been using it for a VPN to my home network and have been really impressed with how fast it is (and how fast it connects!). The corporate VPNs I’ve used in the past we’re so much slower that it feels like a completely different league, although they support many more features of course.
- kertis 7y ago
  Actually WireGuard is pretty easy in configuration. You can try any documentation in Internet, it's not hard at all https://www.ckn.io/blog/2017/11/14/wireguard-vpn-typical-setup/ https://www.ckn.io/blog/2017/11/14/wireguard-vpn-typical-set... I advise you to try it on mobile devices or with unstable interested. It's a miracle!
- pricechild 7y ago
  Try https://www.wireguard.com/quickstart/ https://www.wireguard.com/quickstart/ For real world use, I'm a fan of https://wiki.debian.org/Wireguard https://wiki.debian.org/Wireguard
- newscracker 7y ago
  I’d recommend using Algo VPN. See my comment in this discussion here: https://news.ycombinator.com/item?id=22727713 https://news.ycombinator.com/item?id=22727713
- sccxy 7y ago
  Easiest way with pivpn: https://github.com/pivpn/pivpn https://github.com/pivpn/pivpn
- nikisweeting 7y ago
  https://github.com/pirate/wireguard-docs https://github.com/pirate/wireguard-docs There are a bunch linked from the links section at the bottom.
- angristan 7y ago
  I made this complete tutorial a while ago: https://angristan.xyz/2019/01/how-to-setup-vpn-server-wireguard-nat-ipv6/ https://angristan.xyz/2019/01/how-to-setup-vpn-server-wiregu...
xal 7y ago
Given the occasion, could someone write a paragraph about what downstream effects are expected by wireguard existing? So far I’ve seen mostly technical arguments for it. VPNs have become a more important piece of infrastructure now. The most significant approachability increase really came from mobile based solutions and auto pilot systems like Google’s Outline. Will WG make a marked difference in stability, speed, approachability for normal users, or what can we expect?
- myu701 7y ago
  Someone else can give a much better comparison than me, this is just to get you started. Compared to the 80% use case of OpenVPN, Wireguard is: 1. Much less code. A few thousand lines of code vs lots more for OpenVPN 2. Speedier. WG does UDP traffic so there is less overhead on the protocol level for syncs acks etc. 3. Easier on mobile battery life due to decreased complexity For one example use case comparing them side by side, see PiVPN, which I use to setup a Raspberry Pi Zero W on my home network, create a client key for my phone, open a single port forward to the pivpn server, download the wireguard app, scan the qr code the pivpn key generated, and poof, I can check a box and 'be' on my home network, behind my pihole, and with access to my LAN resources. OpenVPN can do that usecase with pivpn as well but its more processor intensive and a little more setup vs wireguard.
  - middleclick 7y ago
    On that note, I wish and hope Wireguard did TCP as well. Some countries block UDP traffic or at least throttle it.
    - jeltz 7y ago
      Maybe the best solution is to use a tool like https://github.com/wangyu-/udp2raw-tunnel https://github.com/wangyu-/udp2raw-tunnel.
      - middleclick 7y ago
        I know, but the performance takes a massive hit. Have you tried it? Maybe it was something I did wrong.
kertis 7y ago
My congratulations to Jason and team! I am very happy that your 6 years effort led to merging in mainline.
samgranieri 7y ago
Congratulations Jason! Wireguard is a joy to use.
newscracker 7y ago
For anyone wanting to try it, WireGuard with Algo VPN [1] to set it up on a server is a great combination. I found it quite easy to setup and use. Algo has built-in support for various cloud providers, where, when you run it from, day, your desktop, it can setup the VPN server for you based on answers to some questions (with sensible defaults) and some information on connecting to the provider (like an API key, for example). You also get QR code images that you can use to install a VPN profile on your phone. You can also run Algo from within a server and have it setup the VPN for you. [1]: https://github.com/trailofbits/algo https://github.com/trailofbits/algo
- rubenbe 7y ago
  Does the VPS have unencrypted access to the VPN? It's something I would want to avoid. (A VPS is a prime candidate to be compromised)
  - tw04 7y ago
    If you're subject to state level actors attacking you, a VPS is probably the least of your worries. If you're just trying to make sure some kiddiot in a coffee shop isn't doing mass collections, a VPS is perfectly secure.
    - chrisweekly 7y ago
      +1 for good points. Also, ty for "kiddiot" (much better than "script kiddie" term)
      - kitotik 7y ago
        Aka “skids”
        SkyMarshal 7y ago
        Or “skiddie”.
    - 7y ago
sirtoffski 7y ago
Congratulations and big thanks to all of the project developers and contributors!
tomcooks 7y ago
Should you want to try it on a cheap VPS and fail at it, make sure that your shared host has tun-tap and wireguard modules installed (open a ticket)
- jeltz 7y ago
  Yeah, I noticed that it failed on Hetzner when I tried it about a year ago. What I did instead was use boringtun from Cloudflare. Did not open any ticket though. I might want to try again and see if it works.
exabrial 7y ago
One thing I wish for wireguard: the ability to look up keys/ips in an external system like LDAP. I moved an entire call center [50+ people] fully remote last week. We're using wireguard. Key management stinks, and that is my only complaint! It is an incredible piece of software and I'm very thankful for it.
- eadmund 7y ago
  I think the idea is that you're supposed to build a system to manage WireGuard using that sort of information. I.e. WireGuard provides the basic primitives and second- or third-party tooling uses them. I like that idea, because it means that the actual WireGuard core is small and it's usable right now. It is annoying that someone hasn't yet developed neat integrations for WireGuard and stuff I might want to use, but — I'm someone! I (or you, or whoever) can build something, and as surely as day follows the night someone else will build some neat things in the future. It's early days yet!
  - exabrial 7y ago
    Yep, that's what I'm asking for... right now wireguard can only look at configuration text files AFAIK. If it had a way to invoke a command/script to lookup a key/ip, any number of external management systems could be created!
    - darkwater 7y ago
      You can already easily do the other way round: populate the config files with keys retrieved in an external system
      - igetspam 7y ago
        This is what I do. I have a small dynamo table and a Python script I run from cron. I grab all updates since the last run and apply all changes to the running service. I have the config option set to write out the config on service stop, so I don't lose anything on a restart and don't have to replay everything. I have lots of room for improvement but it's a quick hack that works for my needs. (Not sharing yet because it doesn't fully CRUD right now.)
lifty 7y ago
I really hope WireGuard becomes a standard and get's included in the macOS/iOS and Windows kernels as well. Key management and and other fancy features could be left to userspace applications but having the basic wg capability in the kernel would be great.
- kitotik 7y ago
  Seems like a very long shot to make it into Apple products both because of the license and the fact it wasn’t invented in Cupertino. FWIW the userspace implementations are quite good, and still out performs IPSec.
  - felipelemos 7y ago
    I don't think there license would be a problem, as it's GPLv2, not v3. But the 'not invented here' syndrome is very real.
    - stock_toaster 7y ago
      Boringtun is bsd licensed. clean room implementations and all that... https://github.com/cloudflare/boringtun https://github.com/cloudflare/boringtun
      - kitotik 7y ago
        Good point, but that’s still a userspace implementation. Apple would need to do the XNU work since their open source model is so broken, and they seemed to have deprioritized Unix nerds awhile back so…
  - deleted 7y ago
    [deleted]
- donaldihunter 7y ago
  This is a good guide to getting a WireGuard server working on macOS: https://barrowclift.me/post/wireguard-server-on-macos https://barrowclift.me/post/wireguard-server-on-macos
2OEH8eoCRo0 7y ago
This is good to hear. There is a lot of trendy junk that people seem to want in the linux kernel. I've been waiting for WireGuard to prove itself before I give it a shot.
huijzer 7y ago
For anyone wanting to set up WireGuard with the Pi-hole DNS blocker: I would advise https://github.com/racbart/wireguard-pihole https://github.com/racbart/wireguard-pihole. Just a simple shell script. No Docker or Kubernetes required. I installed it on the cheapest DigitalOcean VPS, and it has been running without issues for over a month now. (About 6 phones of me and my friends, and a few desktops are using it.)
saber6 7y ago
Can we please just ban any mention of TailScale and ZeroTier from any article containing WireGuard? This place is becoming fucking spam central.
willis936 7y ago
Now I really want to know when raspbian will get linux kernel 5.6. The most recent version of raspbian came out in February 2020 and uses linux kernel 4.19, which came out in late 2018. https://en.wikipedia.org/wiki/Linux_kernel_version_history https://en.wikipedia.org/wiki/Linux_kernel_version_history
- Medicalidiot 7y ago
  How does raspberry pi run on stock Ubuntu?
  - willis936 7y ago
    I am actually not sure. I know raspbian has modifications in it that take care of board specific issues in it, such as high power consumption/heat from some issue related to USB PD and/or power states. I am not too familiar with the inner workings of distros and how hardware-specific fixes are propagated, but I like the idea of sticking with officially supported OS/hardware combos for "set and forget" boxes. Wireguard was too alluring to not try though, and now I really like it. I would like to move away from my homemade pull, build, and install scripts, but not for any good/justified reason. I suppose I just like the idea of someone being responsible for a software stack that I rely on.
    - gen220 7y ago
      YMMV, but I was able to get https://archlinuxarm.org/ https://archlinuxarm.org/ running on my pis without too much head-scratching. arch is on 5.5.6 as of 3/1/2020 (https://www.archlinux.org/download/ https://www.archlinux.org/download/), and it seems like the ARM porters are pretty good about keeping their project in sync (two day delay): http://de3.mirror.archlinuxarm.org/os/rpi/ http://de3.mirror.archlinuxarm.org/os/rpi/. My best guess is that by April or May, Arch will do the minor version bump, and then a couple days later Arch ARM will get it. It doesn't have the same hardware/software synergy that you like, but it might be a fun weekend experiment.
      - 7y ago
jannes 7y ago
Unfortunately not in time for Ubuntu 20.04 which will be shipping with a 5.4 kernel. Can't wait for Ubuntu to have this builtin!
- jabl 7y ago
  Ubuntu 20.04 will have wireguard backported to their version of 5.4.
laktak 7y ago
I use WireGuard and it works perfectly fine as it is. Can someone explain why we need/want to put it into the Linux kernel?
- catalogia 7y ago
  If you've been using it on linux, you've almost certainly already been using the kernel version. Anecdotally, using it on my home LAN, the kernel implementation on linux performs much better than the userland implementation on MacOS. (Admittedly not the same hardware, the linux machine is a i5-3427U while the MacOS machine has an i5-5250U. I think the former might have an L2 cache advantage, but I'm not sure if that would explain the difference.)
- mikepurvis 7y ago
  If nothing else, the long term maintenance commitment is important for companies being willing to adopt and build on it.
- cyphar 7y ago
  WireGuard on Linux has always been implemented as a kernel module (a very small one at that). If you've used it on Linux, you've used the code that has been included in Linux 5.6. This is about the code being merged upstream into the main kernel repository which means that it'll likely be built-in to lots of distribution kernels and will no longer have the second-class status that most out-of-tree kernel modules have.
  - yjftsjthsd-h 7y ago
    Well, strictly you could use the userspace implementations on Linux (which I looked at because I wanted to try running it in a Docker container, which does work with openconnect).
    - cyphar 7y ago
      You could, and that's how the Android version works (at least, until Android has wireguard.ko built-in -- the WireGuard app supports both versions). But if you're using it on Linux you're almost certainly using the kernel module.
deleted 7y ago
[deleted]
ur-whale 7y ago
This is really good news. I've used a ton of VPN over the years, even some I wrote myself, and I've never seen anything that comes close to wireguard in terms of: ease of use, speed, cleanliness of code. The world just got a whole lot secure and flexible.
tandav 7y ago
still no good tutorial for complete beginners
- ac29 7y ago
  Yeah, the documentation on the webpage isn't great - there isn't actually an example that you can follow step by step to get a usable tunnel. That's unfortunate, because it isn't actually that hard. Much better documentation is here: https://github.com/pirate/wireguard-docs https://github.com/pirate/wireguard-docs
djsumdog 7y ago
I recently setup WireGuard on my new dedicated server and it is amazingly easier compared to OpenVPN. I've setup several site-to-site and client-to-site VPNs on OpenVPN so maybe I'm just use to all the iptables/route gotchas, but not needing to do the whole CA/easyrsa stuff is a huge bonus. I like how their official tutorial video shows all the raw ip commands and then shows their wg-quick configuration script. That way you understand what the script is doing and what commands its running. One big limitation is that it cannot bind to a specific IP address. The author states it shouldn't matter because it won't respond without the right auth key (and it doesn't support TCP so people can't tell if it's sitting there listening) but I found I did get into weird routing loops where packets will come in on one IP and go out on another one. The primary outgoing IP is what shows up when you run `wg show`. It is super weird to implement a brand new service and have a config option for the port, but not the IP address(es) to listen on.
- Florin_Andrei 7y ago
  > not needing to do the whole CA/easyrsa stuff is a huge bonus That's good to hear, but how does it handle authentication / authorization?
  - PureParadigm 7y ago
    Before connecting each client needs to be set up with (1) its own private key and (2) the server's public key. The server also needs to have each client's public key. Once you have securely shared this information out-of-band, there cannot be a man-in-the-middle attack because both sides know the expected public key of the other side, and can prove ownership of their own public key.
    - Godel_unicode 7y ago
      And no, out of the box there's no equivalent to "trust any cert issued by this CA and lookup the username in ldap based off of the cn". Enterprisey auth is left as an exercise for the reader.
  - tptacek 7y ago
Hamuko 7y ago
Has the codebase been audited now?
- tptacek 7y ago
  Multiple organizations have done both formal and semi-formal WireGuard audits.
- yjftsjthsd-h 7y ago
  I think you're getting downvoted because the post mentions the "codebase undergoing a quick security audit", which... I grant isn't the most in-depth and reassuring thing they could say, but certainly beats the previous "nobody has audited this, don't use it" (paraphrasing, but that's loosely what their front page used to say).
Glosster 7y ago
Do I understand correctly? You use WireGuard to set up your own VPN servers? Doing this is a lot more expensive than buying a VPN subscription, but it can be more secure if you know what you're doing, right?
- nessunodoro 7y ago
  A VPN is one use of a Wireguard tunnel. Wireguard establishes a stateless encrypted connection between two peers, and exposes it to the user as a network interface. Endpoints can roam as with mosh
- andrepew 7y ago
  I think it depends on what you're trying to achieve. If it is anonymity, setting it up yourself is probably not going to be a good idea. If you can't trust a VPN provider for some reason or are trying to secure a route to a specific network, setting it up yourself starts to make sense.
- outworlder 7y ago
  'Buying a VPN subscription' is just one use-case. Usually, those VPN services are intended to be used to circumvent geo restrictions. WireGuard is not only about that. Sure you could do it. But it is applicable for any use-case where you have two or more machines that need to talk over a secure tunnel, over an otherwise not proven to be secure network(which is usually, but not always, the Internet). This ranges from connecting to a machine you have at home, to exchanging data between two office branches, and so on.
deleted 7y ago
[deleted]
peterwwillis 7y ago
I like the idea of WireGuard as a simple tunnel, but I wish people would stop comparing it with VPNs. VPNs have lots of extra functionality that is necessary to support a variety of use cases, both functionally (like pushing routes or scripts to clients) and security-wise (like real key management and SSO). I literally can't replace any VPN I currently use with Wireguard because I would lose needed functionality. I could maybe replace the tunnel to a bastion host, but even then I would actually be worse off security wise, because I'd be losing cert-based key management. (ex. https://smallstep.com/blog/use-ssh-certificates/ https://smallstep.com/blog/use-ssh-certificates/)
- yencabulator 7y ago
  An an ex-OpenVPN user, I consider the ability of the server to push arbitrary scripts to the client an antifeature and a security problem that needs to be carefully mitigated every time.
tjoff 7y ago
Does anyone know of a decent bash-script (or even self-hosted page) that one could use to administer wireguard? Could go very far with trivial functionality, such as listing, adding, removing users and download a config file/qr-code.
- djclay 7y ago
  The PiVPN project makes installing / administering WireGuard on the raspberry pi super easy - it has some scripts that nicely wrap WireGuard [1]. I'm not sure how generally applicable they are, but it might be a good starting point. [1] https://github.com/pivpn/pivpn/tree/master/scripts/wireguard https://github.com/pivpn/pivpn/tree/master/scripts/wireguard
- BrandoElFollito 7y ago
  Please have a look at https://github.com/vx3r/wg-gen-web https://github.com/vx3r/wg-gen-web. It is great and the dev is very responsive. It was featured on Show HN but did not get enough traction.
- oedmarap 7y ago
  I forked such a script [0] and use it for setup/admin of my WireGuard server/users for my PCs and phone. [0] https://github.com/oedmarap/wg-install https://github.com/oedmarap/wg-install
- nikisweeting 7y ago
  There are a bunch listed here: https://github.com/pirate/wireguard-docs#wireguard-setup-tools https://github.com/pirate/wireguard-docs#wireguard-setup-too...
- angristan 7y ago
  I made this very basic script to setup a quick wg server and client: https://github.com/angristan/wireguard-install https://github.com/angristan/wireguard-install
MrStonedOne 7y ago
This is not an appropriate announcement post for a product, as it does not explain what the fuck a wireguard is, and given that it has been in beta up until now, the number of people who read hacker news and won't know what the fuck a wireguard is, is high enough to warrant only a proper announcement post for the product.
- dang 7y ago
  We assume HN readers are smart enough to figure things out. https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20%22smart%20enough%22&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... https://arstechnica.com/gadgets/2020/03/wireguard-vpn-makes-it-to-1-0-0-and-into-the-next-linux-kernel/ https://arstechnica.com/gadgets/2020/03/wireguard-vpn-makes-... is a related article, if that helps!
  - m4b0 7y ago
    Thanks for the link. I got this news through the following link https://www.phoronix.com/scan.php?page=news_item&px=Linux-5.6-Released https://www.phoronix.com/scan.php?page=news_item&px=Linux-5....
- navaati 7y ago
  Not everything is a product. This is a piece of work, do of it what you wish.
dang 7y ago
https://arstechnica.com/gadgets/2020/03/wireguard-vpn-makes-it-to-1-0-0-and-into-the-next-linux-kernel/ https://arstechnica.com/gadgets/2020/03/wireguard-vpn-makes-... is a related article. (Via https://news.ycombinator.com/item?id=22731279 https://news.ycombinator.com/item?id=22731279, but no comments there.)
kaylynb 7y ago
WireGuard is great, but I think it's really undersold when it's described as being just a vpn. It's really an encrypted tunnel that is configured like a network adapter in the Linux network stack. This lets you configure it with stuff like systemd-networkd and unit files, or easily spin up a tunnel with a few `ip` commands, and setup some simple nftables rules to do all sorts of stuff. I do use it as a vpn as well, but it's so much easier to setup than, say, OpenVPN, where you need to create tun/br interfaces and then tie them together with a service, etc. That said, OpenVPN and other actual VPN software does more than just a tunnel (like pushing routes, config settings, etc), so WireGuard cannot replace everything by itself. The documentation is rather sparse, but there isn't much to it either. The manpages have what you need to know and the rest is just general Linux network stack knowledge.
- DaniloDias 7y ago
  Is there an application for containers? E.g. a way to set up an encrypted tunneling interface between containers that would allow you to avoid using TLS between the containers?
  - eliaspro 7y ago
    There isn't really a need for a separate application to do this. Just create a WireGuard interface and move it to the container's namespace.
  - nielsole 7y ago
    There is a wireguard network plugin for kubernetes
    - terrywang 7y ago
      Gravitational has built something called wormhole (clashes with magic wormhole, bad naming, isn't? Some other hold can be better) https://github.com/gravitational/wormhole https://github.com/gravitational/wormhole It can be used to replace flannel if encryption in transit is required.
    - 7y ago
GolDDranks 7y ago
Any ideas how to get a client-server style VPN setup with WireGuard working with IPv6 so that it keeps working even if the public IP address of your VPN server changes? The configurations I've seen assign a statically configured IP address to a client. This works fine with NATted IPv4, but with IPv6, addresses are "public", so the client must basically know the prefix of the server to be able to configure a sane address, and if that changes, the configuration must be changed by hand.
- Znafon 7y ago
  You could use a domain name with an appropriate TTL.
justlexi93 7y ago
My understanding is that the standard Wireguard basically exposes all devices on LAN A to all devices on LAN B. A fair amount of software has to be added around it to use it for a single-machine-through-VPN-to-internet connection. Maybe commercial VPN providers have most of that software already, I don't know. But Wireguard by itself is not complete for that application.
borplk 7y ago
Could WireGuard be a good choice for server-to-server encryption instead of TLS? (for example between a TLS terminating load balancer to the application servers)
- kasey_junk 7y ago
  That’s precisely what my favorite “smart cdn” does https://fly.io/docs/architecture/ https://fly.io/docs/architecture/
- jblwps 7y ago
  What net benefits would you see that having? If I'm allowed to assume that you wouldn't use TLS because of PKI management concerns, I have a hard time seeing how using WireGuard in the large wouldn't have the same problems--you still have to build some kind of management platform on top that verifies host authenticity (ultimately including revocations and more). That is to say, WireGuard in the large will surely (right?) need supporting PKI.
  - borplk 7y ago
    Yes mainly because of proper PKI management overhead. Wouldn't Wireguard work with a simple shared secret on both ends?
place1 7y ago
I'm a big fan of Wireguard. I wrote wg-access-server [1] as an all-in-one wireguard VPN solution. I recently added some docs [2] and support for deploying with Helm. I'd love some feedback on here or on github. Give it a try. [1] https://github.com/place1/wg-access-server https://github.com/place1/wg-access-server [2] https://place1.github.io/wg-access-server/ https://place1.github.io/wg-access-server/
- ShamelessC 7y ago
  Looks nice. Is it possible to run this on a raspberry pi?
- terrywang 7y ago
  Thank you place1. I was looking for something like wg-access-server web UI when moving away from strongSwan. Found Subspace but id didn't work the way I wanted, settled pretty well with some shell scripting for my own use cases and happy lol I think wg-access-server makes a lot of sense to people who want to self-host VPN on cheap VPS like Vultr or DigitalOcean, Lightsail, etc., it is simple, easy to deploy and use, flexible and scalable (if deployed to k8s).
terrywang 7y ago
Very exciting news, indeed! Finally WireGuard is in the Linux kernel 5.6 onwoards (will arrive soon in the next few days for those who are on rolling releases). I've been using WireGuard to replace IPsec (strongSwan - the whole stack is way too complex, plus client configuration issues, outweighs the benefits) and OpenVPN (latency, bandwidth / performance is the biggest complaint) for remote access and mainly encrypting traffic from/to terminal devices when accessing the Internet via unknown hops/routes/path. On the other hand, WireGuard is simple (cryptokey routing), modern, elegant, easy to configure & use, fast, and most importantly, reliable over the past 2.5 years, now even better without DKMS headaches ;-) WireGuard clients for iOS (works as good as strongSwan for Android - which I missed a while ago) in terms of 1. on-demand 2. roaming between networks 3. power consumption / overhead. macOS and Windows ones also work very well. Problems: WireGuard does not scale well when used for global overlay network use cases (nebula does a much better job for this purpose). Another issue for VPN providers: each client has a static IP configuration, which contradicts with privacy and surveillance, curious to see how Cloudflare's 1.1.1.1 solves the problem. Last but not least: WireGuard protocol is easy to block. Therefore, I look forward to seeing obfuscation plugins / extensions for WireGuard, it will serve a much bigger purpose for people who live under censorship/surveillance (e.g. inside GFW) so as to protect privacy and get back their rights to access the `real` Internet. Many thanks to Jason and the WireGuard team behind the scene!
- zx2c4 7y ago
  Your first point: There's no part of WireGuard that inherently demands the use of a static IP address. You can run whatever dynamic IP protocol you want inside of it or outside of it. The entire interface configuration is dynamically configurable at runtime. We're working on one called wg-dynamic, but others have done others. Your second point: Obfuscation protocols can encapsulate WireGuard just fine.
  - terrywang 7y ago
    Really appreciate your input (and congrats!), Jason ;-) I have been running 2 simple standalone WireGuard VPN servers for remote access and encrypting traffic (2 EC2 instances inside a VPC, scripted configuration). Admittedly I didn't dig deep enough to think about or leverage VPC's DHCP and/or DHCP servers running on other EC2 instances in the same VPC over the last 2+ years (facepalm), which also means, WireGuard has been set & forget (reliably working ;-) Will dive into obfuscation and compare with (known to work) solution V2Ray (WebSocket + TLS + Web) / Trojan for next battle with the GFW. BTW: Gravitational has built a WireGuard based overlay network CNI for k8s called wormhole [1] which can be used to replace flannel when encryption is required for in-cluster traffic across the overlay. [1]: https://github.com/gravitational/wormhole https://github.com/gravitational/wormhole
pierreprinetti 7y ago
Congratulations!
twic 7y ago
I'm a bit baffled by WireGuard. From 10 000 feet, the protocol is similar to IPSec - encrypt packets, and send them over the internet using a connectionless protocol. So why is it so much better? Is it because it's a new and simpler implementation than what we have for IPSec? Is it because the protocol, being newer, is simpler and cleaner than IPSec? Is it because, being newer, it can use a modern ciphersuite? Are there fundamental advances in the design? One of the nice things about IPSec is that it's a standard. There's a reasonable chance that two endpoints written by separate parties will be able to communicate. Introducing a whole new protocol whose main implementation is its definition seems like a step backwards.
- benjojo12 7y ago
  > One of the nice things about IPSec is that it's a standard. There's a reasonable chance that two endpoints written by separate parties will be able to communicate. Having deployed IPSec between vendors, this is only "sorta" true. IPSec can be an immense fiddle to actually get running between two vendors for the first time. One of the other issues when using IPSec between vendors (or even just be default) is that the actual overlapping ciphers/hashes that are supported or even just work are normally the lowest possible. > Are there fundamental advances in the design? First party roaming makes dealing with mobile and CGNAT much nicer, anyone behind a IPSec VPN on a home CGNAT network will have a bad time (often it won't connect at all) Finally. It's code base is actually pretty small, allowing sane audits to take place. In my eyes thats a huge win. People who have seen the sheer size of strongswan or openvpn might appreciate wireguard in comparison.
- terrywang 7y ago
  IPsec is industry standard, but the whole IPsec stack and surrounding technology stack are very complex, different implementations (e.g. those Swans), configuration combos (phase 1,2 or in strongSwan sense - IKE, ESP, route-based, policy-based, etc.) and clients for different platform makes the whole thing a headache to deal with at large scale. I've been using / working [1] [2] with strongSwan since early 2014, admittedly, the hands-on experience lifted my Linux / Networking skills to a whole new level, but at cost (countless hours burnt). It requires a broad range of skills, has a relatively steep learning curve. > The company I've worked for (in pre-IPO stage), had 800+ strongSwan instances served as site-to-site VPN gateways inside AWS VPCs, they were single point of failure from a design PoV but that simple design (with health check and recovery mechanism of course) worked surprisingly very well over a period of 3 years (thanks to simple design and stability & quality of strongSwan). Personally I've been using strongSwan based VPN gateways to punch holes in GFW and encrypt network traffic until mid 2018, happy with it (<10 strongSwan instances to manage). WireGuard is totally different design when I first migrated from strongSwan, simple, visible (interface, route-based), cryptokey routing, built-in roaming, small code base (minimal attack surface), performance (in kernel). Over time scalability and usability (all sorts of web UIs or GUIs) will improve, for large scale overlay we may better off with something else (nebula). For now officially it offers native client for most of the popular platforms. For any new typical VPN (remote access, encryption in transit, site-to-site may not be as flexible as IPsec as I haven't done that, I used nebula instead to created an overlay) use cases, I'll pick WireGuard to start with ;-) [1]: https://news.ycombinator.com/item?id=13654412 https://news.ycombinator.com/item?id=13654412 [2]: https://news.ycombinator.com/item?id=13434417 https://news.ycombinator.com/item?id=13434417

768 points by zx2c4 7y ago

We have all been waiting for this. Congratulations to Jason and the whole WireGuard team and community! And, thank you Linus!

deleted 7y ago

[deleted]

pkrumins 7y ago

Very exciting! Does anyone know a good howto or a tutorial about it?

hectormalot 7y ago
I used the Stavros one: https://www.stavros.io/posts/how-to-configure-wireguard/ https://www.stavros.io/posts/how-to-configure-wireguard/ Great to see 1.0.0 released. I’ve been using it for a VPN to my home network and have been really impressed with how fast it is (and how fast it connects!). The corporate VPNs I’ve used in the past we’re so much slower that it feels like a completely different league, although they support many more features of course.
kertis 7y ago
Actually WireGuard is pretty easy in configuration. You can try any documentation in Internet, it's not hard at all https://www.ckn.io/blog/2017/11/14/wireguard-vpn-typical-setup/ https://www.ckn.io/blog/2017/11/14/wireguard-vpn-typical-set... I advise you to try it on mobile devices or with unstable interested. It's a miracle!
pricechild 7y ago
Try https://www.wireguard.com/quickstart/ https://www.wireguard.com/quickstart/ For real world use, I'm a fan of https://wiki.debian.org/Wireguard https://wiki.debian.org/Wireguard
newscracker 7y ago
I’d recommend using Algo VPN. See my comment in this discussion here: https://news.ycombinator.com/item?id=22727713 https://news.ycombinator.com/item?id=22727713
sccxy 7y ago
Easiest way with pivpn: https://github.com/pivpn/pivpn https://github.com/pivpn/pivpn
nikisweeting 7y ago
https://github.com/pirate/wireguard-docs https://github.com/pirate/wireguard-docs There are a bunch linked from the links section at the bottom.
angristan 7y ago
I made this complete tutorial a while ago: https://angristan.xyz/2019/01/how-to-setup-vpn-server-wireguard-nat-ipv6/ https://angristan.xyz/2019/01/how-to-setup-vpn-server-wiregu...

xal 7y ago

Given the occasion, could someone write a paragraph about what downstream effects are expected by wireguard existing? So far I’ve seen mostly technical arguments for it. VPNs have become a more important piece of infrastructure now. The most significant approachability increase really came from mobile based solutions and auto pilot systems like Google’s Outline. Will WG make a marked difference in stability, speed, approachability for normal users, or what can we expect?

myu701 7y ago
Someone else can give a much better comparison than me, this is just to get you started. Compared to the 80% use case of OpenVPN, Wireguard is: 1. Much less code. A few thousand lines of code vs lots more for OpenVPN 2. Speedier. WG does UDP traffic so there is less overhead on the protocol level for syncs acks etc. 3. Easier on mobile battery life due to decreased complexity For one example use case comparing them side by side, see PiVPN, which I use to setup a Raspberry Pi Zero W on my home network, create a client key for my phone, open a single port forward to the pivpn server, download the wireguard app, scan the qr code the pivpn key generated, and poof, I can check a box and 'be' on my home network, behind my pihole, and with access to my LAN resources. OpenVPN can do that usecase with pivpn as well but its more processor intensive and a little more setup vs wireguard.
- middleclick 7y ago
  On that note, I wish and hope Wireguard did TCP as well. Some countries block UDP traffic or at least throttle it.
  - jeltz 7y ago
    Maybe the best solution is to use a tool like https://github.com/wangyu-/udp2raw-tunnel https://github.com/wangyu-/udp2raw-tunnel.
    - middleclick 7y ago
      I know, but the performance takes a massive hit. Have you tried it? Maybe it was something I did wrong.

kertis 7y ago

My congratulations to Jason and team! I am very happy that your 6 years effort led to merging in mainline.

samgranieri 7y ago

Congratulations Jason! Wireguard is a joy to use.

newscracker 7y ago

For anyone wanting to try it, WireGuard with Algo VPN [1] to set it up on a server is a great combination. I found it quite easy to setup and use. Algo has built-in support for various cloud providers, where, when you run it from, day, your desktop, it can setup the VPN server for you based on answers to some questions (with sensible defaults) and some information on connecting to the provider (like an API key, for example). You also get QR code images that you can use to install a VPN profile on your phone. You can also run Algo from within a server and have it setup the VPN for you. [1]: https://github.com/trailofbits/algo https://github.com/trailofbits/algo

rubenbe 7y ago
Does the VPS have unencrypted access to the VPN? It's something I would want to avoid. (A VPS is a prime candidate to be compromised)
- tw04 7y ago
  If you're subject to state level actors attacking you, a VPS is probably the least of your worries. If you're just trying to make sure some kiddiot in a coffee shop isn't doing mass collections, a VPS is perfectly secure.
  - chrisweekly 7y ago
    +1 for good points. Also, ty for "kiddiot" (much better than "script kiddie" term)
    - kitotik 7y ago
      Aka “skids”
      - SkyMarshal 7y ago
        Or “skiddie”.
  - 7y ago

sirtoffski 7y ago

Congratulations and big thanks to all of the project developers and contributors!

tomcooks 7y ago

Should you want to try it on a cheap VPS and fail at it, make sure that your shared host has tun-tap and wireguard modules installed (open a ticket)

jeltz 7y ago
Yeah, I noticed that it failed on Hetzner when I tried it about a year ago. What I did instead was use boringtun from Cloudflare. Did not open any ticket though. I might want to try again and see if it works.

exabrial 7y ago

One thing I wish for wireguard: the ability to look up keys/ips in an external system like LDAP. I moved an entire call center [50+ people] fully remote last week. We're using wireguard. Key management stinks, and that is my only complaint! It is an incredible piece of software and I'm very thankful for it.

eadmund 7y ago
I think the idea is that you're supposed to build a system to manage WireGuard using that sort of information. I.e. WireGuard provides the basic primitives and second- or third-party tooling uses them. I like that idea, because it means that the actual WireGuard core is small and it's usable right now. It is annoying that someone hasn't yet developed neat integrations for WireGuard and stuff I might want to use, but — I'm someone! I (or you, or whoever) can build something, and as surely as day follows the night someone else will build some neat things in the future. It's early days yet!
- exabrial 7y ago
  Yep, that's what I'm asking for... right now wireguard can only look at configuration text files AFAIK. If it had a way to invoke a command/script to lookup a key/ip, any number of external management systems could be created!
  - darkwater 7y ago
    You can already easily do the other way round: populate the config files with keys retrieved in an external system
    - igetspam 7y ago
      This is what I do. I have a small dynamo table and a Python script I run from cron. I grab all updates since the last run and apply all changes to the running service. I have the config option set to write out the config on service stop, so I don't lose anything on a restart and don't have to replay everything. I have lots of room for improvement but it's a quick hack that works for my needs. (Not sharing yet because it doesn't fully CRUD right now.)

lifty 7y ago

I really hope WireGuard becomes a standard and get's included in the macOS/iOS and Windows kernels as well. Key management and and other fancy features could be left to userspace applications but having the basic wg capability in the kernel would be great.

kitotik 7y ago
Seems like a very long shot to make it into Apple products both because of the license and the fact it wasn’t invented in Cupertino. FWIW the userspace implementations are quite good, and still out performs IPSec.
- felipelemos 7y ago
  I don't think there license would be a problem, as it's GPLv2, not v3. But the 'not invented here' syndrome is very real.
  - stock_toaster 7y ago
    Boringtun is bsd licensed. clean room implementations and all that... https://github.com/cloudflare/boringtun https://github.com/cloudflare/boringtun
    - kitotik 7y ago
      Good point, but that’s still a userspace implementation. Apple would need to do the XNU work since their open source model is so broken, and they seemed to have deprioritized Unix nerds awhile back so…
- deleted 7y ago
  [deleted]
donaldihunter 7y ago
This is a good guide to getting a WireGuard server working on macOS: https://barrowclift.me/post/wireguard-server-on-macos https://barrowclift.me/post/wireguard-server-on-macos

2OEH8eoCRo0 7y ago

This is good to hear. There is a lot of trendy junk that people seem to want in the linux kernel. I've been waiting for WireGuard to prove itself before I give it a shot.

huijzer 7y ago

For anyone wanting to set up WireGuard with the Pi-hole DNS blocker: I would advise https://github.com/racbart/wireguard-pihole https://github.com/racbart/wireguard-pihole. Just a simple shell script. No Docker or Kubernetes required. I installed it on the cheapest DigitalOcean VPS, and it has been running without issues for over a month now. (About 6 phones of me and my friends, and a few desktops are using it.)

saber6 7y ago

Can we please just ban any mention of TailScale and ZeroTier from any article containing WireGuard? This place is becoming fucking spam central.

willis936 7y ago

Now I really want to know when raspbian will get linux kernel 5.6. The most recent version of raspbian came out in February 2020 and uses linux kernel 4.19, which came out in late 2018. https://en.wikipedia.org/wiki/Linux_kernel_version_history https://en.wikipedia.org/wiki/Linux_kernel_version_history

Medicalidiot 7y ago
How does raspberry pi run on stock Ubuntu?
- willis936 7y ago
  I am actually not sure. I know raspbian has modifications in it that take care of board specific issues in it, such as high power consumption/heat from some issue related to USB PD and/or power states. I am not too familiar with the inner workings of distros and how hardware-specific fixes are propagated, but I like the idea of sticking with officially supported OS/hardware combos for "set and forget" boxes. Wireguard was too alluring to not try though, and now I really like it. I would like to move away from my homemade pull, build, and install scripts, but not for any good/justified reason. I suppose I just like the idea of someone being responsible for a software stack that I rely on.
  - gen220 7y ago
    YMMV, but I was able to get https://archlinuxarm.org/ https://archlinuxarm.org/ running on my pis without too much head-scratching. arch is on 5.5.6 as of 3/1/2020 (https://www.archlinux.org/download/ https://www.archlinux.org/download/), and it seems like the ARM porters are pretty good about keeping their project in sync (two day delay): http://de3.mirror.archlinuxarm.org/os/rpi/ http://de3.mirror.archlinuxarm.org/os/rpi/. My best guess is that by April or May, Arch will do the minor version bump, and then a couple days later Arch ARM will get it. It doesn't have the same hardware/software synergy that you like, but it might be a fun weekend experiment.
    - 7y ago

jannes 7y ago

Unfortunately not in time for Ubuntu 20.04 which will be shipping with a 5.4 kernel. Can't wait for Ubuntu to have this builtin!

jabl 7y ago
Ubuntu 20.04 will have wireguard backported to their version of 5.4.

laktak 7y ago

I use WireGuard and it works perfectly fine as it is. Can someone explain why we need/want to put it into the Linux kernel?

catalogia 7y ago
If you've been using it on linux, you've almost certainly already been using the kernel version. Anecdotally, using it on my home LAN, the kernel implementation on linux performs much better than the userland implementation on MacOS. (Admittedly not the same hardware, the linux machine is a i5-3427U while the MacOS machine has an i5-5250U. I think the former might have an L2 cache advantage, but I'm not sure if that would explain the difference.)
mikepurvis 7y ago
If nothing else, the long term maintenance commitment is important for companies being willing to adopt and build on it.
cyphar 7y ago
WireGuard on Linux has always been implemented as a kernel module (a very small one at that). If you've used it on Linux, you've used the code that has been included in Linux 5.6. This is about the code being merged upstream into the main kernel repository which means that it'll likely be built-in to lots of distribution kernels and will no longer have the second-class status that most out-of-tree kernel modules have.
- yjftsjthsd-h 7y ago
  Well, strictly you could use the userspace implementations on Linux (which I looked at because I wanted to try running it in a Docker container, which does work with openconnect).
  - cyphar 7y ago
    You could, and that's how the Android version works (at least, until Android has wireguard.ko built-in -- the WireGuard app supports both versions). But if you're using it on Linux you're almost certainly using the kernel module.

deleted 7y ago

[deleted]

ur-whale 7y ago

This is really good news. I've used a ton of VPN over the years, even some I wrote myself, and I've never seen anything that comes close to wireguard in terms of: ease of use, speed, cleanliness of code. The world just got a whole lot secure and flexible.

tandav 7y ago

still no good tutorial for complete beginners

ac29 7y ago
Yeah, the documentation on the webpage isn't great - there isn't actually an example that you can follow step by step to get a usable tunnel. That's unfortunate, because it isn't actually that hard. Much better documentation is here: https://github.com/pirate/wireguard-docs https://github.com/pirate/wireguard-docs

djsumdog 7y ago

I recently setup WireGuard on my new dedicated server and it is amazingly easier compared to OpenVPN. I've setup several site-to-site and client-to-site VPNs on OpenVPN so maybe I'm just use to all the iptables/route gotchas, but not needing to do the whole CA/easyrsa stuff is a huge bonus. I like how their official tutorial video shows all the raw ip commands and then shows their wg-quick configuration script. That way you understand what the script is doing and what commands its running. One big limitation is that it cannot bind to a specific IP address. The author states it shouldn't matter because it won't respond without the right auth key (and it doesn't support TCP so people can't tell if it's sitting there listening) but I found I did get into weird routing loops where packets will come in on one IP and go out on another one. The primary outgoing IP is what shows up when you run `wg show`. It is super weird to implement a brand new service and have a config option for the port, but not the IP address(es) to listen on.

Florin_Andrei 7y ago
> not needing to do the whole CA/easyrsa stuff is a huge bonus That's good to hear, but how does it handle authentication / authorization?
- PureParadigm 7y ago
  Before connecting each client needs to be set up with (1) its own private key and (2) the server's public key. The server also needs to have each client's public key. Once you have securely shared this information out-of-band, there cannot be a man-in-the-middle attack because both sides know the expected public key of the other side, and can prove ownership of their own public key.
  - Godel_unicode 7y ago
    And no, out of the box there's no equivalent to "trust any cert issued by this CA and lookup the username in ldap based off of the cn". Enterprisey auth is left as an exercise for the reader.
- tptacek 7y ago

Hamuko 7y ago

Has the codebase been audited now?

tptacek 7y ago
Multiple organizations have done both formal and semi-formal WireGuard audits.
yjftsjthsd-h 7y ago
I think you're getting downvoted because the post mentions the "codebase undergoing a quick security audit", which... I grant isn't the most in-depth and reassuring thing they could say, but certainly beats the previous "nobody has audited this, don't use it" (paraphrasing, but that's loosely what their front page used to say).

Glosster 7y ago

Do I understand correctly? You use WireGuard to set up your own VPN servers? Doing this is a lot more expensive than buying a VPN subscription, but it can be more secure if you know what you're doing, right?

nessunodoro 7y ago
A VPN is one use of a Wireguard tunnel. Wireguard establishes a stateless encrypted connection between two peers, and exposes it to the user as a network interface. Endpoints can roam as with mosh
andrepew 7y ago
I think it depends on what you're trying to achieve. If it is anonymity, setting it up yourself is probably not going to be a good idea. If you can't trust a VPN provider for some reason or are trying to secure a route to a specific network, setting it up yourself starts to make sense.
outworlder 7y ago
'Buying a VPN subscription' is just one use-case. Usually, those VPN services are intended to be used to circumvent geo restrictions. WireGuard is not only about that. Sure you could do it. But it is applicable for any use-case where you have two or more machines that need to talk over a secure tunnel, over an otherwise not proven to be secure network(which is usually, but not always, the Internet). This ranges from connecting to a machine you have at home, to exchanging data between two office branches, and so on.

deleted 7y ago

[deleted]

peterwwillis 7y ago

I like the idea of WireGuard as a simple tunnel, but I wish people would stop comparing it with VPNs. VPNs have lots of extra functionality that is necessary to support a variety of use cases, both functionally (like pushing routes or scripts to clients) and security-wise (like real key management and SSO). I literally can't replace any VPN I currently use with Wireguard because I would lose needed functionality. I could maybe replace the tunnel to a bastion host, but even then I would actually be worse off security wise, because I'd be losing cert-based key management. (ex. https://smallstep.com/blog/use-ssh-certificates/ https://smallstep.com/blog/use-ssh-certificates/)

yencabulator 7y ago
An an ex-OpenVPN user, I consider the ability of the server to push arbitrary scripts to the client an antifeature and a security problem that needs to be carefully mitigated every time.

tjoff 7y ago

Does anyone know of a decent bash-script (or even self-hosted page) that one could use to administer wireguard? Could go very far with trivial functionality, such as listing, adding, removing users and download a config file/qr-code.

djclay 7y ago
The PiVPN project makes installing / administering WireGuard on the raspberry pi super easy - it has some scripts that nicely wrap WireGuard [1]. I'm not sure how generally applicable they are, but it might be a good starting point. [1] https://github.com/pivpn/pivpn/tree/master/scripts/wireguard https://github.com/pivpn/pivpn/tree/master/scripts/wireguard
BrandoElFollito 7y ago
Please have a look at https://github.com/vx3r/wg-gen-web https://github.com/vx3r/wg-gen-web. It is great and the dev is very responsive. It was featured on Show HN but did not get enough traction.
oedmarap 7y ago
I forked such a script [0] and use it for setup/admin of my WireGuard server/users for my PCs and phone. [0] https://github.com/oedmarap/wg-install https://github.com/oedmarap/wg-install
nikisweeting 7y ago
There are a bunch listed here: https://github.com/pirate/wireguard-docs#wireguard-setup-tools https://github.com/pirate/wireguard-docs#wireguard-setup-too...
angristan 7y ago
I made this very basic script to setup a quick wg server and client: https://github.com/angristan/wireguard-install https://github.com/angristan/wireguard-install

MrStonedOne 7y ago

This is not an appropriate announcement post for a product, as it does not explain what the fuck a wireguard is, and given that it has been in beta up until now, the number of people who read hacker news and won't know what the fuck a wireguard is, is high enough to warrant only a proper announcement post for the product.

dang 7y ago
We assume HN readers are smart enough to figure things out. https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20%22smart%20enough%22&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... https://arstechnica.com/gadgets/2020/03/wireguard-vpn-makes-it-to-1-0-0-and-into-the-next-linux-kernel/ https://arstechnica.com/gadgets/2020/03/wireguard-vpn-makes-... is a related article, if that helps!
- m4b0 7y ago
  Thanks for the link. I got this news through the following link https://www.phoronix.com/scan.php?page=news_item&px=Linux-5.6-Released https://www.phoronix.com/scan.php?page=news_item&px=Linux-5....
navaati 7y ago
Not everything is a product. This is a piece of work, do of it what you wish.

dang 7y ago

https://arstechnica.com/gadgets/2020/03/wireguard-vpn-makes-it-to-1-0-0-and-into-the-next-linux-kernel/ https://arstechnica.com/gadgets/2020/03/wireguard-vpn-makes-... is a related article. (Via https://news.ycombinator.com/item?id=22731279 https://news.ycombinator.com/item?id=22731279, but no comments there.)

kaylynb 7y ago

WireGuard is great, but I think it's really undersold when it's described as being just a vpn. It's really an encrypted tunnel that is configured like a network adapter in the Linux network stack. This lets you configure it with stuff like systemd-networkd and unit files, or easily spin up a tunnel with a few `ip` commands, and setup some simple nftables rules to do all sorts of stuff. I do use it as a vpn as well, but it's so much easier to setup than, say, OpenVPN, where you need to create tun/br interfaces and then tie them together with a service, etc. That said, OpenVPN and other actual VPN software does more than just a tunnel (like pushing routes, config settings, etc), so WireGuard cannot replace everything by itself. The documentation is rather sparse, but there isn't much to it either. The manpages have what you need to know and the rest is just general Linux network stack knowledge.

DaniloDias 7y ago
Is there an application for containers? E.g. a way to set up an encrypted tunneling interface between containers that would allow you to avoid using TLS between the containers?
- eliaspro 7y ago
  There isn't really a need for a separate application to do this. Just create a WireGuard interface and move it to the container's namespace.
- nielsole 7y ago
  There is a wireguard network plugin for kubernetes
  - terrywang 7y ago
    Gravitational has built something called wormhole (clashes with magic wormhole, bad naming, isn't? Some other hold can be better) https://github.com/gravitational/wormhole https://github.com/gravitational/wormhole It can be used to replace flannel if encryption in transit is required.
  - 7y ago

GolDDranks 7y ago

Any ideas how to get a client-server style VPN setup with WireGuard working with IPv6 so that it keeps working even if the public IP address of your VPN server changes? The configurations I've seen assign a statically configured IP address to a client. This works fine with NATted IPv4, but with IPv6, addresses are "public", so the client must basically know the prefix of the server to be able to configure a sane address, and if that changes, the configuration must be changed by hand.

Znafon 7y ago
You could use a domain name with an appropriate TTL.

justlexi93 7y ago

My understanding is that the standard Wireguard basically exposes all devices on LAN A to all devices on LAN B. A fair amount of software has to be added around it to use it for a single-machine-through-VPN-to-internet connection. Maybe commercial VPN providers have most of that software already, I don't know. But Wireguard by itself is not complete for that application.

borplk 7y ago

Could WireGuard be a good choice for server-to-server encryption instead of TLS? (for example between a TLS terminating load balancer to the application servers)

kasey_junk 7y ago
That’s precisely what my favorite “smart cdn” does https://fly.io/docs/architecture/ https://fly.io/docs/architecture/
jblwps 7y ago
What net benefits would you see that having? If I'm allowed to assume that you wouldn't use TLS because of PKI management concerns, I have a hard time seeing how using WireGuard in the large wouldn't have the same problems--you still have to build some kind of management platform on top that verifies host authenticity (ultimately including revocations and more). That is to say, WireGuard in the large will surely (right?) need supporting PKI.
- borplk 7y ago
  Yes mainly because of proper PKI management overhead. Wouldn't Wireguard work with a simple shared secret on both ends?

place1 7y ago

I'm a big fan of Wireguard. I wrote wg-access-server [1] as an all-in-one wireguard VPN solution. I recently added some docs [2] and support for deploying with Helm. I'd love some feedback on here or on github. Give it a try. [1] https://github.com/place1/wg-access-server https://github.com/place1/wg-access-server [2] https://place1.github.io/wg-access-server/ https://place1.github.io/wg-access-server/

ShamelessC 7y ago
Looks nice. Is it possible to run this on a raspberry pi?
terrywang 7y ago
Thank you place1. I was looking for something like wg-access-server web UI when moving away from strongSwan. Found Subspace but id didn't work the way I wanted, settled pretty well with some shell scripting for my own use cases and happy lol I think wg-access-server makes a lot of sense to people who want to self-host VPN on cheap VPS like Vultr or DigitalOcean, Lightsail, etc., it is simple, easy to deploy and use, flexible and scalable (if deployed to k8s).

terrywang 7y ago

Very exciting news, indeed! Finally WireGuard is in the Linux kernel 5.6 onwoards (will arrive soon in the next few days for those who are on rolling releases). I've been using WireGuard to replace IPsec (strongSwan - the whole stack is way too complex, plus client configuration issues, outweighs the benefits) and OpenVPN (latency, bandwidth / performance is the biggest complaint) for remote access and mainly encrypting traffic from/to terminal devices when accessing the Internet via unknown hops/routes/path. On the other hand, WireGuard is simple (cryptokey routing), modern, elegant, easy to configure & use, fast, and most importantly, reliable over the past 2.5 years, now even better without DKMS headaches ;-) WireGuard clients for iOS (works as good as strongSwan for Android - which I missed a while ago) in terms of 1. on-demand 2. roaming between networks 3. power consumption / overhead. macOS and Windows ones also work very well. Problems: WireGuard does not scale well when used for global overlay network use cases (nebula does a much better job for this purpose). Another issue for VPN providers: each client has a static IP configuration, which contradicts with privacy and surveillance, curious to see how Cloudflare's 1.1.1.1 solves the problem. Last but not least: WireGuard protocol is easy to block. Therefore, I look forward to seeing obfuscation plugins / extensions for WireGuard, it will serve a much bigger purpose for people who live under censorship/surveillance (e.g. inside GFW) so as to protect privacy and get back their rights to access the `real` Internet. Many thanks to Jason and the WireGuard team behind the scene!

zx2c4 7y ago
Your first point: There's no part of WireGuard that inherently demands the use of a static IP address. You can run whatever dynamic IP protocol you want inside of it or outside of it. The entire interface configuration is dynamically configurable at runtime. We're working on one called wg-dynamic, but others have done others. Your second point: Obfuscation protocols can encapsulate WireGuard just fine.
- terrywang 7y ago
  Really appreciate your input (and congrats!), Jason ;-) I have been running 2 simple standalone WireGuard VPN servers for remote access and encrypting traffic (2 EC2 instances inside a VPC, scripted configuration). Admittedly I didn't dig deep enough to think about or leverage VPC's DHCP and/or DHCP servers running on other EC2 instances in the same VPC over the last 2+ years (facepalm), which also means, WireGuard has been set & forget (reliably working ;-) Will dive into obfuscation and compare with (known to work) solution V2Ray (WebSocket + TLS + Web) / Trojan for next battle with the GFW. BTW: Gravitational has built a WireGuard based overlay network CNI for k8s called wormhole [1] which can be used to replace flannel when encryption is required for in-cluster traffic across the overlay. [1]: https://github.com/gravitational/wormhole https://github.com/gravitational/wormhole

pierreprinetti 7y ago

Congratulations!

twic 7y ago

I'm a bit baffled by WireGuard. From 10 000 feet, the protocol is similar to IPSec - encrypt packets, and send them over the internet using a connectionless protocol. So why is it so much better? Is it because it's a new and simpler implementation than what we have for IPSec? Is it because the protocol, being newer, is simpler and cleaner than IPSec? Is it because, being newer, it can use a modern ciphersuite? Are there fundamental advances in the design? One of the nice things about IPSec is that it's a standard. There's a reasonable chance that two endpoints written by separate parties will be able to communicate. Introducing a whole new protocol whose main implementation is its definition seems like a step backwards.

benjojo12 7y ago
> One of the nice things about IPSec is that it's a standard. There's a reasonable chance that two endpoints written by separate parties will be able to communicate. Having deployed IPSec between vendors, this is only "sorta" true. IPSec can be an immense fiddle to actually get running between two vendors for the first time. One of the other issues when using IPSec between vendors (or even just be default) is that the actual overlapping ciphers/hashes that are supported or even just work are normally the lowest possible. > Are there fundamental advances in the design? First party roaming makes dealing with mobile and CGNAT much nicer, anyone behind a IPSec VPN on a home CGNAT network will have a bad time (often it won't connect at all) Finally. It's code base is actually pretty small, allowing sane audits to take place. In my eyes thats a huge win. People who have seen the sheer size of strongswan or openvpn might appreciate wireguard in comparison.
terrywang 7y ago
IPsec is industry standard, but the whole IPsec stack and surrounding technology stack are very complex, different implementations (e.g. those Swans), configuration combos (phase 1,2 or in strongSwan sense - IKE, ESP, route-based, policy-based, etc.) and clients for different platform makes the whole thing a headache to deal with at large scale. I've been using / working [1] [2] with strongSwan since early 2014, admittedly, the hands-on experience lifted my Linux / Networking skills to a whole new level, but at cost (countless hours burnt). It requires a broad range of skills, has a relatively steep learning curve. > The company I've worked for (in pre-IPO stage), had 800+ strongSwan instances served as site-to-site VPN gateways inside AWS VPCs, they were single point of failure from a design PoV but that simple design (with health check and recovery mechanism of course) worked surprisingly very well over a period of 3 years (thanks to simple design and stability & quality of strongSwan). Personally I've been using strongSwan based VPN gateways to punch holes in GFW and encrypt network traffic until mid 2018, happy with it (<10 strongSwan instances to manage). WireGuard is totally different design when I first migrated from strongSwan, simple, visible (interface, route-based), cryptokey routing, built-in roaming, small code base (minimal attack surface), performance (in kernel). Over time scalability and usability (all sorts of web UIs or GUIs) will improve, for large scale overlay we may better off with something else (nebula). For now officially it offers native client for most of the popular platforms. For any new typical VPN (remote access, encryption in transit, site-to-site may not be as flexible as IPsec as I haven't done that, I used nebula instead to created an overlay) use cases, I'll pick WireGuard to start with ;-) [1]: https://news.ycombinator.com/item?id=13654412 https://news.ycombinator.com/item?id=13654412 [2]: https://news.ycombinator.com/item?id=13434417 https://news.ycombinator.com/item?id=13434417