20 ms·

Getting Started with WireGuard

362 points by miguelmota 7y ago

greatjack613 7y ago
> It’s kernel-based which reduces attack surface and can be ran in virtually any device. Excuse my ignorance, but can someone explain why a kernel based networking stack has less of an attack surface then a user-space based stack? I mean logically user-space should be more secure no?
- traceroute66 7y ago
  I have been a bit weary of the WireGuard hype for much the same reason. Surely kernel mode is (a) the equivalent of running as root (b) opens up greater attack surface by virtue of running at kernel level
  - zerkten 7y ago
    I have only experimented a bit with WireGuard because I wanted to avoid OpenVPN. The argument seems to be that it's more secure because it's implementation is small (the implication being that it's easier to audit) and being in the kernel ensures mass adoption (ensuring even more likelihood of audits and quick patches.) I'm interested if there are other technical advantages for specific threat models.
- outworlder 7y ago
  This goes both ways. Userland systems are susceptible to a myriad of attacks that a kernel, being privileged code, is not. We rely on the kernel (plus CPU rings) for most of the security enforcement in a machine, after all. However, IF that code is compromised, the consequences are much more catastrophic.
  - greatjack613 7y ago
    That sounds interesting. Can you elaborate on which attacks userland system are susceptible to that a kernel is not?
    - eximius 7y ago
      A userland process can view/edit the memory of another userland process. Not so with kernel processes.
      - usr1106 7y ago
        Viewing/editing of another userland process is usually done using ptrace(2). Yama Linux security module prevents that unless you are root to disable it. It is active by default on Ubuntu. Also reading /proc/nnnn/mem does not work even for your own processes and even though file node protections seem to allow it, not sure where that security enhancement comes from.
- tpolzer 7y ago
  Indeed, the author is confusing things here: - It has a vastly smaller attack surface than e.g. OpenVPN, because it is much less complex. - Its performance is improved by being kernel based. - Compatibility is helped by it being in the mainline kernel, i.e. every device shipping a recent enough kernel will be able to have it (no need to deploy/version libraries etc). These don't have anything to do with each other.
  - kapilvt 7y ago
    re smaller surface area, adding some numbers, "WireGuard weighs in at around 4,000 lines of code; this compares to 600,000 total lines of code for OpenVPN + OpenSSL or 400,000 total lines of code for XFRM+StrongSwan for an IPSEC VPN. Two orders of magnitude fewer lines of code mean a lot less attack surface to find flaws in." https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review-fast-connections-amaze-but-windows-support-needs-to-happen/ https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review... note openvpn sans openssl is 70k (supports multiple crypto libs), but given Wireguard's code size is including crypto, it seems apt to compare totals. linus on a comparison, "Can I just once again state my love for it and hope it gets merged soon? Maybe the code isn't perfect, but I've skimmed it, and compared to the horrors that are OpenVPN and IPSec, it's a work of art." https://lwn.net/Articles/761939/ https://lwn.net/Articles/761939/
    - ignoramous 7y ago
      > ...compared to the horrors that are OpenVPN and IPSec, it's a work of art. https://wireguard.com/ https://wireguard.com/ should put that quote up as a, well, social proof.
      - lifepillar 7y ago
        WireGuard’s protocol was also formally verified by a third party [0]. That makes me more confident in using it than any social proof whatsoever :) [0] https://prosecco.gforge.inria.fr/personal/bblanche/cryptoverif/WireGuard/ https://prosecco.gforge.inria.fr/personal/bblanche/cryptover...
    - 7y ago
- wmf 7y ago
  BTW if people want to try userspace WireGuard: https://github.com/cloudflare/boringtun https://github.com/cloudflare/boringtun
platz 7y ago
Do you have to use the wireguard client or could say the VPN stack in Windows be used to connect to a wireguard server?
- tjohns 7y ago
  You have to use the Wireguard client. In that regard it's similar to OpenVPN. Wireguard uses a custom protocol that isn't supported by Windows' built-in VPN client. Most OSes only natively support IPsec/L2TP or PPTP.
- kasey_junk 7y ago
  Wiregaurd uses its own protocol. There is a wire guard client for Windows.
enrichpu 7y ago
dedea
pkulak 7y ago
Just FYI, WireGuard is baked right into the Linux 6.x kernel. Unless you're on a rolling distro you won't see it yet, but very cool indeed.
- sandov 7y ago
  5.6
  - pkulak 7y ago
    haha, yes, apologies. Whatever the new one is.
- kapilvt 7y ago
  also available in ubuntu 20.04 (universe) via the dkms/module support thats been standard for use w/ wireguard for years. wireguard also just hit 1.0 from a stable api perspective.
e12e 7y ago
Hm. I guess no-one has bothered with nftables yet, even when dealing with network code that's becoming part of the new upstream kernel (not just this blog, AFAIK wireguard upstream doesn't have any examples on using nftables either, just iptables). I guess we need a new networking how-to? Anyone aware of some resources I might have missed? OK, I guess the nftables wiki is the "how-to": https://wiki.nftables.org/wiki-nftables/index.php/Main_Page https://wiki.nftables.org/wiki-nftables/index.php/Main_Page
- mindslight 7y ago
  IMO nftables is best used with your full ruleset defined in a file, and atomically loaded. nftables certainly does make your ruleset more grokkable than statefully appending ad-hoc rules everywhere, but you necessarily need the whole picture to gain from it. So unfortunately it makes less sense for one-liners. Case in point: to use the masquerade action in a postrouting/nat chain, you also have to register a (possibly empty) prerouting/nat chain.
  - crazy_hombre 7y ago
    So unfortunately it makes less sense for one-liners. Case in point: to use the masquerade action in a postrouting/nat chain, you also have to register a (possibly empty) prerouting/nat chain. You don't have to do that since Linux 4.18: https://wiki.nftables.org/wiki-nftables/index.php/Performing_Network_Address_Translation_(NAT)#Stateful_NAT https://wiki.nftables.org/wiki-nftables/index.php/Performing...
- dharmab 7y ago
  The community kind of skipped right over nftables to BPF. Simple use cases use iptables, complicated ones use BPF, nftables isn't flexible enough for the complicated use cases so everyone keeps using iptables.
  - thayne 7y ago
    even for simple cases, I prefer nftables. If for no other reason thn I think the syntax is simpler and easier to understand.
squarefoot 7y ago
Does wireguard have a noticeable overhead wrt data size compared to a unencrypted connection? I was thinking of setting up it on a small RPi-Like board at home, then on the laptop I carry around (when the lockdown is over). The purpose would be connecting to the Internet through the home broadband public IP which could be handy. However the laptop connects through a metered 4G connection which, although the data cap is more than reasonable, raises some concerns should the encryption require a lot more data than normal.
- nightfly 7y ago
  I just sent 200MiB of zeros over my wireguard connection to my VPS and my transmit counter on my wifi card went up by 238MB. Vs sending 1024MiB over just wifi to my Pi where the transmit counter went up by 1.04GiB.
  - squarefoot 7y ago
    Thanks, looks good for mobile metered connections too then.
  - afiori 7y ago
    Is this one of those cases where is Wireguard implemented traffic compression as a "feature" it would become a huge security flaw? I remember hearing that this is the case for naive HTTPS compression, but I never properly had insight in the how.
    - nightfly 7y ago
      https://community.openvpn.net/openvpn/wiki/VORACLE https://community.openvpn.net/openvpn/wiki/VORACLE
boromi 7y ago
Is there like a simpler configuration esp. for clients using windows / mac?
- leotaku 7y ago
  If you are just interested in configuring clients, Wireguard for Windows comes with a GUI that you can use. For Mac I'd suggest just using wg-quick[^1]. [^1]: https://manpages.debian.org/unstable/wireguard-tools/wg-quick.8.en.html https://manpages.debian.org/unstable/wireguard-tools/wg-quic...
- kccqzy 7y ago
  Mac clients can just download it from the App Store: https://apps.apple.com/us/app/wireguard/id1451685025?mt=12 https://apps.apple.com/us/app/wireguard/id1451685025?mt=12 It has a GUI, but you still need to understand its concepts to configure it.
- rubatuga 7y ago
  I commented this earlier, here's an iOS/macOS client guide: https://www.naut.ca/blog/2020/02/17/setting-up-a-wireguard-vpn/ https://www.naut.ca/blog/2020/02/17/setting-up-a-wireguard-v...
mathieubordere 7y ago
I would suggest using Algo VPN to set up WireGuard https://github.com/trailofbits/algo https://github.com/trailofbits/algo
parshimers 7y ago
If you're using NetworkManager and wireguard, try out the integration between the two as well. It lets you treat the tunnel as any other VPN in nm, and also easily avoids some issues with routing loops if you roam back on to your home network. Before, I always had to manually use wg-quick when I came back home or left. http://blogs.gnome.org/thaller/2019/03/15/wireguard-in-networkmanager/ http://blogs.gnome.org/thaller/2019/03/15/wireguard-in-netwo...
- mqus 7y ago
  In my experience, this does work somewhat, but doesn't set up the routes properly[1] and doesn't provide an interface to the networkmanager applet, so you are still left with configuring the profiles in the terminal. There is much left to be desired. Sadly the third-party plugin isn't much better and seems to be discontinued[2]. [1] https://forum.manjaro.org/t/wireguard-with-networkmanager-1-16-how-to/81544/13 https://forum.manjaro.org/t/wireguard-with-networkmanager-1-... [2] https://github.com/max-moser/network-manager-wireguard/ https://github.com/max-moser/network-manager-wireguard/
  - franga2000 7y ago
    I seem to recall configuring it entirely (sans key generation) in KDE Plasma network settings. I'm guessing you're referring to another applet?
    - mqus 7y ago
      I'm not an expert in KDE but I mean this applet: https://gitlab.gnome.org/GNOME/network-manager-applet.git https://gitlab.gnome.org/GNOME/network-manager-applet.git I assume that I can't really install the KDE applet without installing the entire KDE suite, so this was my goto solution. Edit: I see that wireguard support is in the works but is not merged yet: https://gitlab.gnome.org/GNOME/network-manager-applet/-/merge_requests/78 https://gitlab.gnome.org/GNOME/network-manager-applet/-/merg...
  - parshimers 7y ago
    Interesting. I haven't had that happen because I do split-tunnel, but I will have to keep that in mind in scenarios when I try to forward everything thru the tunnel. All I needed to do for split tunnel was just adjust the route metric. (https://tujun.ga/2020/02/18/wireguard/ https://tujun.ga/2020/02/18/wireguard/) Agreed about the lack of GUI though, I do wish there was a GTK applet for it.
tazeg95 7y ago
I made an Ansible script for the server : https://github.com/Tazeg/ansible-wireguard https://github.com/Tazeg/ansible-wireguard. If it helps.
rubatuga 7y ago
I also made a guide for connecting with the official iOS and macOS WireGuard clients, as I originally found it a bit difficult with the current UI. https://www.naut.ca/blog/2020/02/17/setting-up-a-wireguard-vpn/ https://www.naut.ca/blog/2020/02/17/setting-up-a-wireguard-v...
jimmcslim 7y ago
I know its orthogonal to WireGuard itself, but I'd like to see these guides sometime provide some guidance around DNS, so that I can access services without having to remember the VPN client IP addresses.
ur-whale 7y ago
One thing that is imo downplayed about WireGuard as opposed to other VPNs is ease of use, specifically: - setup is easy - automated config of large setups is easy - it is extremely resilient under network temporary failure
borplk 7y ago
Does anyone have a guide for setting up server-to-server wireshark connection? Everything I have found so far is about consumer VPN stuff. I'm interested in possibly using wireshark for server-to-server as a less painful alternative to TLS.
- franga2000 7y ago
  Assuming you meant Wireguard both times, I have a small guide I wrote for my team that I can throw up on my site. If I don't post a link here in a couple hours, reply here so I get a notification.
  - borplk 7y ago
    Yes somehow I had wireshark in mind! :)
- jtvjan 7y ago
  It's not really different from what's shown here, only you set AllowedIPs to a single address instead of all addresses (0.0.0.0/0). Here's a short guide I just wrote: https://jtvjan.nl/documents/s2s-wireguard.md https://jtvjan.nl/documents/s2s-wireguard.md
- franga2000 7y ago
  Here's a (cleaned up) guide from our internal docs: https://miha.frangez.me/2020/04/08/wireguard-point-to-point-setup/ https://miha.frangez.me/2020/04/08/wireguard-point-to-point-...

362 points by miguelmota 7y ago

> It’s kernel-based which reduces attack surface and can be ran in virtually any device. Excuse my ignorance, but can someone explain why a kernel based networking stack has less of an attack surface then a user-space based stack? I mean logically user-space should be more secure no?

traceroute66 7y ago
I have been a bit weary of the WireGuard hype for much the same reason. Surely kernel mode is (a) the equivalent of running as root (b) opens up greater attack surface by virtue of running at kernel level
- zerkten 7y ago
  I have only experimented a bit with WireGuard because I wanted to avoid OpenVPN. The argument seems to be that it's more secure because it's implementation is small (the implication being that it's easier to audit) and being in the kernel ensures mass adoption (ensuring even more likelihood of audits and quick patches.) I'm interested if there are other technical advantages for specific threat models.
outworlder 7y ago
This goes both ways. Userland systems are susceptible to a myriad of attacks that a kernel, being privileged code, is not. We rely on the kernel (plus CPU rings) for most of the security enforcement in a machine, after all. However, IF that code is compromised, the consequences are much more catastrophic.
- greatjack613 7y ago
  That sounds interesting. Can you elaborate on which attacks userland system are susceptible to that a kernel is not?
  - eximius 7y ago
    A userland process can view/edit the memory of another userland process. Not so with kernel processes.
    - usr1106 7y ago
      Viewing/editing of another userland process is usually done using ptrace(2). Yama Linux security module prevents that unless you are root to disable it. It is active by default on Ubuntu. Also reading /proc/nnnn/mem does not work even for your own processes and even though file node protections seem to allow it, not sure where that security enhancement comes from.
tpolzer 7y ago
Indeed, the author is confusing things here: - It has a vastly smaller attack surface than e.g. OpenVPN, because it is much less complex. - Its performance is improved by being kernel based. - Compatibility is helped by it being in the mainline kernel, i.e. every device shipping a recent enough kernel will be able to have it (no need to deploy/version libraries etc). These don't have anything to do with each other.
- kapilvt 7y ago
  re smaller surface area, adding some numbers, "WireGuard weighs in at around 4,000 lines of code; this compares to 600,000 total lines of code for OpenVPN + OpenSSL or 400,000 total lines of code for XFRM+StrongSwan for an IPSEC VPN. Two orders of magnitude fewer lines of code mean a lot less attack surface to find flaws in." https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review-fast-connections-amaze-but-windows-support-needs-to-happen/ https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review... note openvpn sans openssl is 70k (supports multiple crypto libs), but given Wireguard's code size is including crypto, it seems apt to compare totals. linus on a comparison, "Can I just once again state my love for it and hope it gets merged soon? Maybe the code isn't perfect, but I've skimmed it, and compared to the horrors that are OpenVPN and IPSec, it's a work of art." https://lwn.net/Articles/761939/ https://lwn.net/Articles/761939/
  - ignoramous 7y ago
    > ...compared to the horrors that are OpenVPN and IPSec, it's a work of art. https://wireguard.com/ https://wireguard.com/ should put that quote up as a, well, social proof.
    - lifepillar 7y ago
      WireGuard’s protocol was also formally verified by a third party [0]. That makes me more confident in using it than any social proof whatsoever :) [0] https://prosecco.gforge.inria.fr/personal/bblanche/cryptoverif/WireGuard/ https://prosecco.gforge.inria.fr/personal/bblanche/cryptover...
  - 7y ago
wmf 7y ago
BTW if people want to try userspace WireGuard: https://github.com/cloudflare/boringtun https://github.com/cloudflare/boringtun

platz 7y ago

Do you have to use the wireguard client or could say the VPN stack in Windows be used to connect to a wireguard server?

tjohns 7y ago
You have to use the Wireguard client. In that regard it's similar to OpenVPN. Wireguard uses a custom protocol that isn't supported by Windows' built-in VPN client. Most OSes only natively support IPsec/L2TP or PPTP.
kasey_junk 7y ago
Wiregaurd uses its own protocol. There is a wire guard client for Windows.

enrichpu 7y ago

dedea

pkulak 7y ago

Just FYI, WireGuard is baked right into the Linux 6.x kernel. Unless you're on a rolling distro you won't see it yet, but very cool indeed.

sandov 7y ago
5.6
- pkulak 7y ago
  haha, yes, apologies. Whatever the new one is.
kapilvt 7y ago
also available in ubuntu 20.04 (universe) via the dkms/module support thats been standard for use w/ wireguard for years. wireguard also just hit 1.0 from a stable api perspective.

e12e 7y ago

Hm. I guess no-one has bothered with nftables yet, even when dealing with network code that's becoming part of the new upstream kernel (not just this blog, AFAIK wireguard upstream doesn't have any examples on using nftables either, just iptables). I guess we need a new networking how-to? Anyone aware of some resources I might have missed? OK, I guess the nftables wiki is the "how-to": https://wiki.nftables.org/wiki-nftables/index.php/Main_Page https://wiki.nftables.org/wiki-nftables/index.php/Main_Page

mindslight 7y ago
IMO nftables is best used with your full ruleset defined in a file, and atomically loaded. nftables certainly does make your ruleset more grokkable than statefully appending ad-hoc rules everywhere, but you necessarily need the whole picture to gain from it. So unfortunately it makes less sense for one-liners. Case in point: to use the masquerade action in a postrouting/nat chain, you also have to register a (possibly empty) prerouting/nat chain.
- crazy_hombre 7y ago
  So unfortunately it makes less sense for one-liners. Case in point: to use the masquerade action in a postrouting/nat chain, you also have to register a (possibly empty) prerouting/nat chain. You don't have to do that since Linux 4.18: https://wiki.nftables.org/wiki-nftables/index.php/Performing_Network_Address_Translation_(NAT)#Stateful_NAT https://wiki.nftables.org/wiki-nftables/index.php/Performing...
dharmab 7y ago
The community kind of skipped right over nftables to BPF. Simple use cases use iptables, complicated ones use BPF, nftables isn't flexible enough for the complicated use cases so everyone keeps using iptables.
- thayne 7y ago
  even for simple cases, I prefer nftables. If for no other reason thn I think the syntax is simpler and easier to understand.

squarefoot 7y ago

Does wireguard have a noticeable overhead wrt data size compared to a unencrypted connection? I was thinking of setting up it on a small RPi-Like board at home, then on the laptop I carry around (when the lockdown is over). The purpose would be connecting to the Internet through the home broadband public IP which could be handy. However the laptop connects through a metered 4G connection which, although the data cap is more than reasonable, raises some concerns should the encryption require a lot more data than normal.

nightfly 7y ago
I just sent 200MiB of zeros over my wireguard connection to my VPS and my transmit counter on my wifi card went up by 238MB. Vs sending 1024MiB over just wifi to my Pi where the transmit counter went up by 1.04GiB.
- squarefoot 7y ago
  Thanks, looks good for mobile metered connections too then.
- afiori 7y ago
  Is this one of those cases where is Wireguard implemented traffic compression as a "feature" it would become a huge security flaw? I remember hearing that this is the case for naive HTTPS compression, but I never properly had insight in the how.
  - nightfly 7y ago
    https://community.openvpn.net/openvpn/wiki/VORACLE https://community.openvpn.net/openvpn/wiki/VORACLE

boromi 7y ago

Is there like a simpler configuration esp. for clients using windows / mac?

leotaku 7y ago
If you are just interested in configuring clients, Wireguard for Windows comes with a GUI that you can use. For Mac I'd suggest just using wg-quick[^1]. [^1]: https://manpages.debian.org/unstable/wireguard-tools/wg-quick.8.en.html https://manpages.debian.org/unstable/wireguard-tools/wg-quic...
kccqzy 7y ago
Mac clients can just download it from the App Store: https://apps.apple.com/us/app/wireguard/id1451685025?mt=12 https://apps.apple.com/us/app/wireguard/id1451685025?mt=12 It has a GUI, but you still need to understand its concepts to configure it.
rubatuga 7y ago
I commented this earlier, here's an iOS/macOS client guide: https://www.naut.ca/blog/2020/02/17/setting-up-a-wireguard-vpn/ https://www.naut.ca/blog/2020/02/17/setting-up-a-wireguard-v...

mathieubordere 7y ago

I would suggest using Algo VPN to set up WireGuard https://github.com/trailofbits/algo https://github.com/trailofbits/algo

parshimers 7y ago

If you're using NetworkManager and wireguard, try out the integration between the two as well. It lets you treat the tunnel as any other VPN in nm, and also easily avoids some issues with routing loops if you roam back on to your home network. Before, I always had to manually use wg-quick when I came back home or left. http://blogs.gnome.org/thaller/2019/03/15/wireguard-in-networkmanager/ http://blogs.gnome.org/thaller/2019/03/15/wireguard-in-netwo...

mqus 7y ago
In my experience, this does work somewhat, but doesn't set up the routes properly[1] and doesn't provide an interface to the networkmanager applet, so you are still left with configuring the profiles in the terminal. There is much left to be desired. Sadly the third-party plugin isn't much better and seems to be discontinued[2]. [1] https://forum.manjaro.org/t/wireguard-with-networkmanager-1-16-how-to/81544/13 https://forum.manjaro.org/t/wireguard-with-networkmanager-1-... [2] https://github.com/max-moser/network-manager-wireguard/ https://github.com/max-moser/network-manager-wireguard/
- franga2000 7y ago
  I seem to recall configuring it entirely (sans key generation) in KDE Plasma network settings. I'm guessing you're referring to another applet?
  - mqus 7y ago
    I'm not an expert in KDE but I mean this applet: https://gitlab.gnome.org/GNOME/network-manager-applet.git https://gitlab.gnome.org/GNOME/network-manager-applet.git I assume that I can't really install the KDE applet without installing the entire KDE suite, so this was my goto solution. Edit: I see that wireguard support is in the works but is not merged yet: https://gitlab.gnome.org/GNOME/network-manager-applet/-/merge_requests/78 https://gitlab.gnome.org/GNOME/network-manager-applet/-/merg...
- parshimers 7y ago
  Interesting. I haven't had that happen because I do split-tunnel, but I will have to keep that in mind in scenarios when I try to forward everything thru the tunnel. All I needed to do for split tunnel was just adjust the route metric. (https://tujun.ga/2020/02/18/wireguard/ https://tujun.ga/2020/02/18/wireguard/) Agreed about the lack of GUI though, I do wish there was a GTK applet for it.

tazeg95 7y ago

I made an Ansible script for the server : https://github.com/Tazeg/ansible-wireguard https://github.com/Tazeg/ansible-wireguard. If it helps.

rubatuga 7y ago

I also made a guide for connecting with the official iOS and macOS WireGuard clients, as I originally found it a bit difficult with the current UI. https://www.naut.ca/blog/2020/02/17/setting-up-a-wireguard-vpn/ https://www.naut.ca/blog/2020/02/17/setting-up-a-wireguard-v...

jimmcslim 7y ago

I know its orthogonal to WireGuard itself, but I'd like to see these guides sometime provide some guidance around DNS, so that I can access services without having to remember the VPN client IP addresses.

ur-whale 7y ago

One thing that is imo downplayed about WireGuard as opposed to other VPNs is ease of use, specifically: - setup is easy - automated config of large setups is easy - it is extremely resilient under network temporary failure

borplk 7y ago

Does anyone have a guide for setting up server-to-server wireshark connection? Everything I have found so far is about consumer VPN stuff. I'm interested in possibly using wireshark for server-to-server as a less painful alternative to TLS.

franga2000 7y ago
Assuming you meant Wireguard both times, I have a small guide I wrote for my team that I can throw up on my site. If I don't post a link here in a couple hours, reply here so I get a notification.
- borplk 7y ago
  Yes somehow I had wireshark in mind! :)
jtvjan 7y ago
It's not really different from what's shown here, only you set AllowedIPs to a single address instead of all addresses (0.0.0.0/0). Here's a short guide I just wrote: https://jtvjan.nl/documents/s2s-wireguard.md https://jtvjan.nl/documents/s2s-wireguard.md
franga2000 7y ago
Here's a (cleaned up) guide from our internal docs: https://miha.frangez.me/2020/04/08/wireguard-point-to-point-setup/ https://miha.frangez.me/2020/04/08/wireguard-point-to-point-...