3 ms·

I recently setup WireGuard on my new dedicated server and it is amazingly easier compared to OpenVPN. I've setup several site-to-site and client-to-site VPNs on

I recently setup WireGuard on my new dedicated server and it is amazingly easier compared to OpenVPN. I've setup several site-to-site and client-to-site VPNs on OpenVPN so maybe I'm just use to all the iptables/route gotchas, but not needing to do the whole CA/easyrsa stuff is a huge bonus. I like how their official tutorial video shows all the raw ip commands and then shows their wg-quick configuration script. That way you understand what the script is doing and what commands its running. One big limitation is that it cannot bind to a specific IP address. The author states it shouldn't matter because it won't respond without the right auth key (and it doesn't support TCP so people can't tell if it's sitting there listening) but I found I did get into weird routing loops where packets will come in on one IP and go out on another one. The primary outgoing IP is what shows up when you run `wg show`. It is super weird to implement a brand new service and have a config option for the port, but not the IP address(es) to listen on.

Florin_Andrei 7y ago
> not needing to do the whole CA/easyrsa stuff is a huge bonus That's good to hear, but how does it handle authentication / authorization?
- PureParadigm 7y ago
  Before connecting each client needs to be set up with (1) its own private key and (2) the server's public key. The server also needs to have each client's public key. Once you have securely shared this information out-of-band, there cannot be a man-in-the-middle attack because both sides know the expected public key of the other side, and can prove ownership of their own public key.
  - Godel_unicode 7y ago
    And no, out of the box there's no equivalent to "trust any cert issued by this CA and lookup the username in ldap based off of the cn". Enterprisey auth is left as an exercise for the reader.
- tptacek 7y ago
  Pretty much the same way vanilla SSH does, without the trust-on-first-use bit.

Florin_Andrei 7y ago

> not needing to do the whole CA/easyrsa stuff is a huge bonus That's good to hear, but how does it handle authentication / authorization?

PureParadigm 7y ago
Before connecting each client needs to be set up with (1) its own private key and (2) the server's public key. The server also needs to have each client's public key. Once you have securely shared this information out-of-band, there cannot be a man-in-the-middle attack because both sides know the expected public key of the other side, and can prove ownership of their own public key.
- Godel_unicode 7y ago
  And no, out of the box there's no equivalent to "trust any cert issued by this CA and lookup the username in ldap based off of the cn". Enterprisey auth is left as an exercise for the reader.
tptacek 7y ago
Pretty much the same way vanilla SSH does, without the trust-on-first-use bit.