7 ms·

List of software and things that use or support WireGuard

109 points by z0mbie42 7y ago

jorvi 7y ago
> It is recommended to use official WireGuard software whenever possible. I don't agree with his sentiment at all. With OpenVPN Viscosity is by far the best OpenVPN client and both the 'official' client (OpenVPN) and the open source alternative (Tunnelblick) are buggy and have crappy UI. I'm hoping Sparklabs either repurpose Viscosity to include WireGuard as well, or write a new client specifically for WireGuard (which I'd happily buy). Edit: wow, what the hell. I guess HN hates improved clients with a violent passion.
- catalogia 7y ago
  What does OpenVPN having a shitty official client have to do with wireguard?
  - kylek 7y ago
    I think it's less about openvpn and more about having the protocol integrated with existing enterprise products/infrastructure/paradigms.
    - oneplane 7y ago
      Imagine having WireGuard wrapped up in PulseSecure or one of the other 'enterprise' solutions. We'd see silly exploits in no-time. Not that WireGuard in itself is perfect, but those enterprise products have not shown any benefit over 'the rest' so far. (except more money moving around and giving sales people jobs) It's often not the protocol that has the problem, as with OpenVPN, it's whatever gets layered around it usually causes the issues (as was with those 'SSL VPN' solutions and stuff like Citrix).
      - kylek 7y ago
        It's almost beside the point. Enterprises want to pay someone for support (and, more importantly, someone to blame when things go wrong) rather than (rightfully) attempt to put something together with duct tape and bailing wire.
        oneplane 7y ago
        The point was that 'enterprise' is not any less 'duct tape and bailing wire'. Unless you get value out of shifting blame to a vendor or some contract thing, there really isn't much use throwing money at it. In some sectors that's probably still a requirement. I hope I never get to the point where I have to go back to that.
  - jorvi 7y ago
    Both the iOS and macOS Wireguard client are functional but they aren't shining examples of great UI, UX or feature richness. Often 3rd party clients (as happened with OpenVPN) will fill that gap.
    - catalogia 7y ago
      Hmm, I can't say I've noticed much UI/UX issue with the MacOS wireguard client; it seems very straight forward to me. As for feature richness, wireguard not having a bunch of knobs and buttons to tweak is one of its nicer features I think.
- ecnahc515 7y ago
  All of the "clients" you mentioned are just "frontends". They all just produce openvpn configuration files and run the official OpenVPN client. Some of them (Viscosity) use the remote control daemon protocol, to more directly integrate with the openvpn client, but it's still the standard openvpn client doing the bulk of the work. These frontends are just UIs, not full fledged clients.
  - jorvi 7y ago
    I obviously mean the clients as in the GUI clients, not the core binary. For OpenVPN that would be OpenVPN-GUI[0] [0] https://openvpn.net/community-downloads/ https://openvpn.net/community-downloads/
    - xnyan 7y ago
      Some of the clients mentioned, for example TunSafe, are not GUIs for Wireguard but rather their own third-party implementations of a client to the Wireguard protocol. In context of the linked text, it was not in fact obvious what you meant.
leeoniya 7y ago
> OPNsense 19.7 supports WireGuard yep, can confirm :) currently running on this passively-cooled thing: https://www.amazon.com/Firewall-Micro-Appliance-Gigabit-AES-NI/dp/B0742Q3NT6 https://www.amazon.com/Firewall-Micro-Appliance-Gigabit-AES-...
- oneplane 7y ago
  That's pretty expensive for what is essentially a rebranded Qotom. On the other hand, if you are in the USA, it's probably a good choice. OPNSense 20+ also support WireGuard just in case someone gets confused about that specific version reference.
  - leeoniya 7y ago
    i think still in the ballpark for an Atom, 8GB RAM, 128GB mSATA config. could not find exactly that model, but this one's close: https://www.aliexpress.com/item/32740319382.html https://www.aliexpress.com/item/32740319382.html anyways, the price difference is not terribly relevant at this pricepoint for a qty of 1 upgraded every 5-10 years.
    - oneplane 7y ago
      I was thinking more in line with the actual ODM: https://aliexpress.com/item/32955679364.html https://aliexpress.com/item/32955679364.html But it does indeed not matter, paying 50 or 100 more over 5 years is a rather small amount.
  - mech422 7y ago
    I really like the Odroid H2's... https://ameridroid.com/products/odroid-h2 https://ameridroid.com/products/odroid-h2 On backorder atm - but I have 3 currently tricked out with 16G RAM and 2x200G SATA SSD. Total cost was less then $250/unit.
  - jms703 7y ago
    The ProtectLi boxes might cost a little bit more, but they seem to be really well made and of good quality. I moved from a PCEngines APU to a ProtectLi because I needed faster packet forwarding performance when I upgraded my home internet connection to 1 Gbps.
kgersen 7y ago
managed wieguard: https://tailscale.com/ https://tailscale.com/
- ornornor 7y ago
  I’d like to try it but why force users to login with either gmail or Microsoft? What’s wrong with a plain old username/any other email provider and password?
  - cpuguy83 7y ago
    They addressed this in another post on HN. Basically they don't want to manage U/P. They are looking at other services as well (such as github).
- microtherion 7y ago
  Yes, its omission from the article seemed like an important oversight to me.
  - v8engine 7y ago
    I see it in the "Other WireGuard goodies" section.
    - microtherion 7y ago
      I stand corrected, or it was added after I looked at the page (which appears to have been updated on April 8).
clairity 7y ago
> "wireguard-vanity-address[0] — generate Wireguard keypairs with a given prefix string" generating 4-5 character-prefixed keys seems to up the chances of collision by many orders of magnitude, right? but even so, is that enough of a concern to not use such a tool? [0] https://github.com/warner/wireguard-vanity-address https://github.com/warner/wireguard-vanity-address
- devttyeu 7y ago
  It doesn't, you still have to do the same amount of work to find the collisions.
- Znafon 7y ago
  It's just a brute force so I think it should not matter. Once you find a public key that match what you are looking for you have the same amount of work to do to find the private key. It would be different if it was to generate a private key that matches the prefix.
geraldcombs 7y ago
Is there a way to suggest additions to the page? Wireshark supports WireGuard dissection and decryption[1], and the pcapng[2] file format has a block type defined for WireGuard secrets. [1]https://wiki.wireshark.org/WireGuard https://wiki.wireshark.org/WireGuard [2]https://github.com/pcapng/pcapng https://github.com/pcapng/pcapng
st3fan 7y ago
You can add Firefox VPN to the list too.
roamerz 7y ago
Maybe a little OT but any word of a FIPS 140 implementation of this protocol? Would make the adoption of this in an enterprise environment possible.
- ausjke 7y ago
  a very good questions indeed, but that means you need certify lots of kernel crypto modules for whatever wireguard depends on, redhat has fips-140 kernel so I assume it will do something similar to wireguard, as redhat will want to sell this to governments etc
mobilio 7y ago
TunSafe also works on iOS, Android, Linux and Windows. Not just on macOS!
kamyarg 7y ago
https://github.com/trailofbits/algo https://github.com/trailofbits/algo Also supports it. Have been using it for personal VPN deployments, very easy to use and each time I notice they have made moves to be more secure.

109 points by z0mbie42 7y ago

> It is recommended to use official WireGuard software whenever possible. I don't agree with his sentiment at all. With OpenVPN Viscosity is by far the best OpenVPN client and both the 'official' client (OpenVPN) and the open source alternative (Tunnelblick) are buggy and have crappy UI. I'm hoping Sparklabs either repurpose Viscosity to include WireGuard as well, or write a new client specifically for WireGuard (which I'd happily buy). Edit: wow, what the hell. I guess HN hates improved clients with a violent passion.

catalogia 7y ago
What does OpenVPN having a shitty official client have to do with wireguard?
- kylek 7y ago
  I think it's less about openvpn and more about having the protocol integrated with existing enterprise products/infrastructure/paradigms.
  - oneplane 7y ago
    Imagine having WireGuard wrapped up in PulseSecure or one of the other 'enterprise' solutions. We'd see silly exploits in no-time. Not that WireGuard in itself is perfect, but those enterprise products have not shown any benefit over 'the rest' so far. (except more money moving around and giving sales people jobs) It's often not the protocol that has the problem, as with OpenVPN, it's whatever gets layered around it usually causes the issues (as was with those 'SSL VPN' solutions and stuff like Citrix).
    - kylek 7y ago
      It's almost beside the point. Enterprises want to pay someone for support (and, more importantly, someone to blame when things go wrong) rather than (rightfully) attempt to put something together with duct tape and bailing wire.
      - oneplane 7y ago
        The point was that 'enterprise' is not any less 'duct tape and bailing wire'. Unless you get value out of shifting blame to a vendor or some contract thing, there really isn't much use throwing money at it. In some sectors that's probably still a requirement. I hope I never get to the point where I have to go back to that.
- jorvi 7y ago
  Both the iOS and macOS Wireguard client are functional but they aren't shining examples of great UI, UX or feature richness. Often 3rd party clients (as happened with OpenVPN) will fill that gap.
  - catalogia 7y ago
    Hmm, I can't say I've noticed much UI/UX issue with the MacOS wireguard client; it seems very straight forward to me. As for feature richness, wireguard not having a bunch of knobs and buttons to tweak is one of its nicer features I think.
ecnahc515 7y ago
All of the "clients" you mentioned are just "frontends". They all just produce openvpn configuration files and run the official OpenVPN client. Some of them (Viscosity) use the remote control daemon protocol, to more directly integrate with the openvpn client, but it's still the standard openvpn client doing the bulk of the work. These frontends are just UIs, not full fledged clients.
- jorvi 7y ago
  I obviously mean the clients as in the GUI clients, not the core binary. For OpenVPN that would be OpenVPN-GUI[0] [0] https://openvpn.net/community-downloads/ https://openvpn.net/community-downloads/
  - xnyan 7y ago
    Some of the clients mentioned, for example TunSafe, are not GUIs for Wireguard but rather their own third-party implementations of a client to the Wireguard protocol. In context of the linked text, it was not in fact obvious what you meant.

leeoniya 7y ago

> OPNsense 19.7 supports WireGuard yep, can confirm :) currently running on this passively-cooled thing: https://www.amazon.com/Firewall-Micro-Appliance-Gigabit-AES-NI/dp/B0742Q3NT6 https://www.amazon.com/Firewall-Micro-Appliance-Gigabit-AES-...

oneplane 7y ago
That's pretty expensive for what is essentially a rebranded Qotom. On the other hand, if you are in the USA, it's probably a good choice. OPNSense 20+ also support WireGuard just in case someone gets confused about that specific version reference.
- leeoniya 7y ago
  i think still in the ballpark for an Atom, 8GB RAM, 128GB mSATA config. could not find exactly that model, but this one's close: https://www.aliexpress.com/item/32740319382.html https://www.aliexpress.com/item/32740319382.html anyways, the price difference is not terribly relevant at this pricepoint for a qty of 1 upgraded every 5-10 years.
  - oneplane 7y ago
    I was thinking more in line with the actual ODM: https://aliexpress.com/item/32955679364.html https://aliexpress.com/item/32955679364.html But it does indeed not matter, paying 50 or 100 more over 5 years is a rather small amount.
- mech422 7y ago
  I really like the Odroid H2's... https://ameridroid.com/products/odroid-h2 https://ameridroid.com/products/odroid-h2 On backorder atm - but I have 3 currently tricked out with 16G RAM and 2x200G SATA SSD. Total cost was less then $250/unit.
- jms703 7y ago
  The ProtectLi boxes might cost a little bit more, but they seem to be really well made and of good quality. I moved from a PCEngines APU to a ProtectLi because I needed faster packet forwarding performance when I upgraded my home internet connection to 1 Gbps.

kgersen 7y ago

managed wieguard: https://tailscale.com/ https://tailscale.com/

ornornor 7y ago
I’d like to try it but why force users to login with either gmail or Microsoft? What’s wrong with a plain old username/any other email provider and password?
- cpuguy83 7y ago
  They addressed this in another post on HN. Basically they don't want to manage U/P. They are looking at other services as well (such as github).
microtherion 7y ago
Yes, its omission from the article seemed like an important oversight to me.
- v8engine 7y ago
  I see it in the "Other WireGuard goodies" section.
  - microtherion 7y ago
    I stand corrected, or it was added after I looked at the page (which appears to have been updated on April 8).

clairity 7y ago

> "wireguard-vanity-address[0] — generate Wireguard keypairs with a given prefix string" generating 4-5 character-prefixed keys seems to up the chances of collision by many orders of magnitude, right? but even so, is that enough of a concern to not use such a tool? [0] https://github.com/warner/wireguard-vanity-address https://github.com/warner/wireguard-vanity-address

devttyeu 7y ago
It doesn't, you still have to do the same amount of work to find the collisions.
Znafon 7y ago
It's just a brute force so I think it should not matter. Once you find a public key that match what you are looking for you have the same amount of work to do to find the private key. It would be different if it was to generate a private key that matches the prefix.

geraldcombs 7y ago

Is there a way to suggest additions to the page? Wireshark supports WireGuard dissection and decryption[1], and the pcapng[2] file format has a block type defined for WireGuard secrets. [1]https://wiki.wireshark.org/WireGuard https://wiki.wireshark.org/WireGuard [2]https://github.com/pcapng/pcapng https://github.com/pcapng/pcapng

st3fan 7y ago

You can add Firefox VPN to the list too.

roamerz 7y ago

Maybe a little OT but any word of a FIPS 140 implementation of this protocol? Would make the adoption of this in an enterprise environment possible.

ausjke 7y ago
a very good questions indeed, but that means you need certify lots of kernel crypto modules for whatever wireguard depends on, redhat has fips-140 kernel so I assume it will do something similar to wireguard, as redhat will want to sell this to governments etc

mobilio 7y ago

TunSafe also works on iOS, Android, Linux and Windows. Not just on macOS!

kamyarg 7y ago

https://github.com/trailofbits/algo https://github.com/trailofbits/algo Also supports it. Have been using it for personal VPN deployments, very easy to use and each time I notice they have made moves to be more secure.