4 ms·

> Not only is it much faster other VPNs IPSec is as fast as Wireguard. And there is native client in MacOS. As for bloated codebase, there is an OpenBSD iked r

by nuker 6y ago

> Not only is it much faster other VPNs IPSec is as fast as Wireguard. And there is native client in MacOS. As for bloated codebase, there is an OpenBSD iked rewrite.

cmeacham98 6y ago
iirc, ipsec is considered somewhat of a security nightmare by modern standards, given that it difficult to fully understand and very easy to misconfigure in an insecure way. I would only recommend using ipsec over wireguard when legacy compat matters.
- igetspam 6y ago
  It is. Even the companies I integrate with that require it know it's full of pitfalls. When you've been doing ipsec for two decades and it's a checkbox in your compliance sheet though, you check the box and hopefully you're good at it by now.
- beermonster 6y ago
  IKEv2 can be configured securely, but by someone that that is familiar with that particular minefield. Both on Windows and MacOS the GUIs configure weaker security by default (the cynic may wonder why!). On MacOS you can use Apple Configurator /Apple Profile Manager and on Windows Powershell, to configure stronger security. The nice thing with WireGuard is it’s either secure or it’s off. As you say, it’s easy to misconfigure IPSec and the number of experts gets smaller day by day.
cesarb 6y ago
Doesn't IPSec need a "clean" network connection, without any NAT in the middle? Wireguard was designed to work well even in the presence of NAT.
- vetinari 6y ago
  If you enable UDP encapsulation, it will work over NAT.
- beermonster 6y ago
  In IKEv2 it’s optional but IPsec NAT traversal (NAT-T) uses UDP port 4500.
vetinari 6y ago
With IPSec native client in MacOS, there are several problems: - multiple users on the same machine cannot have their own credentials for the same tunnel; you have to create several tunnels and each user sees all of them. Obviously, you cannot save password then. - if you want to setup routing for your L2TP split-tunel, you have to create bash scripts (ip-up, ip-down) in /etc/ppp. Not even Linux makes you to do this by hand. Compared to this, Wireguard for Mac is much more polished.
- nuker 6y ago
  Why L2TP and not IKEv2?
  - vetinari 6y ago
    Depends on the other side, too. Otherwise, a good question for Ubiquity, why they don't support IKEv2 (among other things), when they are using strongswan underneath anyway.
Hamuko 6y ago
Is IPSec as fast as Wireguard if I'm running it on a potato like a Raspberry Pi 2?
- nuker 6y ago
  Yep

by nuker 6y ago

> Not only is it much faster other VPNs IPSec is as fast as Wireguard. And there is native client in MacOS. As for bloated codebase, there is an OpenBSD iked rewrite.

cmeacham98 6y ago

iirc, ipsec is considered somewhat of a security nightmare by modern standards, given that it difficult to fully understand and very easy to misconfigure in an insecure way. I would only recommend using ipsec over wireguard when legacy compat matters.

igetspam 6y ago
It is. Even the companies I integrate with that require it know it's full of pitfalls. When you've been doing ipsec for two decades and it's a checkbox in your compliance sheet though, you check the box and hopefully you're good at it by now.
beermonster 6y ago
IKEv2 can be configured securely, but by someone that that is familiar with that particular minefield. Both on Windows and MacOS the GUIs configure weaker security by default (the cynic may wonder why!). On MacOS you can use Apple Configurator /Apple Profile Manager and on Windows Powershell, to configure stronger security. The nice thing with WireGuard is it’s either secure or it’s off. As you say, it’s easy to misconfigure IPSec and the number of experts gets smaller day by day.

cesarb 6y ago

Doesn't IPSec need a "clean" network connection, without any NAT in the middle? Wireguard was designed to work well even in the presence of NAT.

vetinari 6y ago
If you enable UDP encapsulation, it will work over NAT.
beermonster 6y ago
In IKEv2 it’s optional but IPsec NAT traversal (NAT-T) uses UDP port 4500.

vetinari 6y ago

With IPSec native client in MacOS, there are several problems: - multiple users on the same machine cannot have their own credentials for the same tunnel; you have to create several tunnels and each user sees all of them. Obviously, you cannot save password then. - if you want to setup routing for your L2TP split-tunel, you have to create bash scripts (ip-up, ip-down) in /etc/ppp. Not even Linux makes you to do this by hand. Compared to this, Wireguard for Mac is much more polished.

nuker 6y ago
Why L2TP and not IKEv2?
- vetinari 6y ago
  Depends on the other side, too. Otherwise, a good question for Ubiquity, why they don't support IKEv2 (among other things), when they are using strongswan underneath anyway.

Hamuko 6y ago

Is IPSec as fast as Wireguard if I'm running it on a potato like a Raspberry Pi 2?

nuker 6y ago
Yep