5 ms·

How does this or ZeroTier compare to WireGuard besides the fact WireGuard doesn’t have much of a UI or key management?

by marcrosoft 6y ago

jsilence 6y ago
Tinc and Zerotier are establishing n to m connections and meshed routing where Wireguard AFAIK does 1 to 1 connections.
- gpm 6y ago
  Wireguard does more than 1-1 connections, every computer can connect to as many other computers as you like, you can have computer a connect to computer c via computer b, and vice versa, and longer chains.
  - kitotik 6y ago
    In my experience this is basically a turnkey setup with Tinc though as it handles all the key sharing transparently, and in your example will only use computer b to do the initial handshake and then let computer a talk directly to computer c. This is especially useful when you have large mesh networks across various LANs and WAN.
    - gpm 6y ago
      I haven't used tinyc - but that does sound like an improvement over wireguard.
mcsoft 6y ago
The tradeoff is performance vs features. WireGuard runs at the kernel level, is focused on performance but very minimalistic in terms of features.
mindslight 6y ago
I started off using tinc before wireguard existed, and now use both. Tinc provides a guaranteed full connectivity graph with indirect routing, nat punching, and local subnet discovery as needed. Wireguard is much more performant (eg it can be used to secure nfs without kerberos). Eventually someone will write a daemon for wireguard that provides tinc's features, but until then they are complimentary. I use wireguard between routers to carry full subnets, and tinc is setup on individual hosts to provide fallback access.
- sa1 6y ago
  Have you tried Tailscale?
  - mindslight 6y ago
    No... I'm not really interested in proprietary software, especially as security-critical foundation.
    - sa1 6y ago
      Fair enough
    - twsted 6y ago
      I would normally agree, but I trust both apenwarr and bradfitz. And Tailscale rocks.
tptacek 6y ago
WireGuard is like a modernized version of the SPTPS protocol --- SPTPS is a denatured variant of TLS --- that tinc uses, (ordinarily) coupled to the Linux networking stack. It is something you would build a modern version of tinc on top of, not a competitor to tinc. See Tailscale for an example of something that looks a lot like tinc, but built on WireGuard. Tinc's security track record has not been especially great†, and while WireGuard and tinc are both written in C, tinc is a great ghastly blob of C, and WireGuard was written defensively by a vulnerability researcher to minimize attack surface --- the whole thing is about 4000 lines of code, and can be run without memory allocation. So if you were just comparing SPTPS to WireGuard, it'd be no contest at all: you'd always, always prefer WireGuard. And that's what most people should do, because most people run simple access VPNs that don't need elaborate mesh routing features. For the minority that do, for now, there's Tailscale and Tinc; maybe Tinc can do a 2.0 on top of WireGuard, with its userland components in a memory-safe language. † This, in particular, is not the commit message you want to see in a fix for an error oracle vulnerability: https://www.tinc-vpn.org/git/browse?p=tinc;a=commit;h=d3297fbd3b8c8c8a4661f5bbf89aca5cacba8b5a https://www.tinc-vpn.org/git/browse?p=tinc;a=commit;h=d3297f...
- sigjuice 6y ago
  There's no commit message here at all 400 - Invalid hash parameter Looks like the URL doesn't work because it picked up an asterisk somehow.
  - tptacek 6y ago
    Fixed. Thanks!
- marcrosoft 6y ago
  Thanks for the rundown. I’m already using wireguard so I’ll stick with that and hopefully figure out some of the kernel upgrade issues I’ve ran into. Tailscale is an automatic no for me. I won’t use proprietary software for something as important as this. Even with tincs history I’d much rather go with opensource.
  - 6y ago

How does this or ZeroTier compare to WireGuard besides the fact WireGuard doesn’t have much of a UI or key management?

jsilence 6y ago

Tinc and Zerotier are establishing n to m connections and meshed routing where Wireguard AFAIK does 1 to 1 connections.

gpm 6y ago
Wireguard does more than 1-1 connections, every computer can connect to as many other computers as you like, you can have computer a connect to computer c via computer b, and vice versa, and longer chains.
- kitotik 6y ago
  In my experience this is basically a turnkey setup with Tinc though as it handles all the key sharing transparently, and in your example will only use computer b to do the initial handshake and then let computer a talk directly to computer c. This is especially useful when you have large mesh networks across various LANs and WAN.
  - gpm 6y ago
    I haven't used tinyc - but that does sound like an improvement over wireguard.

mcsoft 6y ago

The tradeoff is performance vs features. WireGuard runs at the kernel level, is focused on performance but very minimalistic in terms of features.

mindslight 6y ago

I started off using tinc before wireguard existed, and now use both. Tinc provides a guaranteed full connectivity graph with indirect routing, nat punching, and local subnet discovery as needed. Wireguard is much more performant (eg it can be used to secure nfs without kerberos). Eventually someone will write a daemon for wireguard that provides tinc's features, but until then they are complimentary. I use wireguard between routers to carry full subnets, and tinc is setup on individual hosts to provide fallback access.

sa1 6y ago
Have you tried Tailscale?
- mindslight 6y ago
  No... I'm not really interested in proprietary software, especially as security-critical foundation.
  - sa1 6y ago
    Fair enough
  - twsted 6y ago
    I would normally agree, but I trust both apenwarr and bradfitz. And Tailscale rocks.

tptacek 6y ago

WireGuard is like a modernized version of the SPTPS protocol --- SPTPS is a denatured variant of TLS --- that tinc uses, (ordinarily) coupled to the Linux networking stack. It is something you would build a modern version of tinc on top of, not a competitor to tinc. See Tailscale for an example of something that looks a lot like tinc, but built on WireGuard. Tinc's security track record has not been especially great†, and while WireGuard and tinc are both written in C, tinc is a great ghastly blob of C, and WireGuard was written defensively by a vulnerability researcher to minimize attack surface --- the whole thing is about 4000 lines of code, and can be run without memory allocation. So if you were just comparing SPTPS to WireGuard, it'd be no contest at all: you'd always, always prefer WireGuard. And that's what most people should do, because most people run simple access VPNs that don't need elaborate mesh routing features. For the minority that do, for now, there's Tailscale and Tinc; maybe Tinc can do a 2.0 on top of WireGuard, with its userland components in a memory-safe language. † This, in particular, is not the commit message you want to see in a fix for an error oracle vulnerability: https://www.tinc-vpn.org/git/browse?p=tinc;a=commit;h=d3297fbd3b8c8c8a4661f5bbf89aca5cacba8b5a https://www.tinc-vpn.org/git/browse?p=tinc;a=commit;h=d3297f...

sigjuice 6y ago
There's no commit message here at all 400 - Invalid hash parameter Looks like the URL doesn't work because it picked up an asterisk somehow.
- tptacek 6y ago
  Fixed. Thanks!
marcrosoft 6y ago
Thanks for the rundown. I’m already using wireguard so I’ll stick with that and hopefully figure out some of the kernel upgrade issues I’ve ran into. Tailscale is an automatic no for me. I won’t use proprietary software for something as important as this. Even with tincs history I’d much rather go with opensource.
- 6y ago