5 ms·

What could be interesting is if you were able to add wireguard-go into your project. It would be nice to have a single binary that can run traffic through a VP

What could be interesting is if you were able to add wireguard-go into your project. It would be nice to have a single binary that can run traffic through a VPN and something I have not see done before.

varbhat 5y ago
Nice. I will consider. You can route network of exatorrent through network/VPN . Also, wireguard implemented in Linux kernel is faster than userspace implementation of wireguard-go . No?
- y4mi 5y ago
  > You can route network of exatorrent through network/VPN . that always comes with the danger of not going through VPN if the connection somehow drops or you've restarted the machine its running on and the vpn started after the torrent client. and the linux kernel implementation isnt necessarily available if its running in a docker container of some NAS or even on a windows machine. it would also make it easier to use, allowing more people to utilize the tech.
  - varbhat 5y ago
    Thanks for suggesting me. I will consider this.
  - HansHamster 5y ago
    > that always comes with the danger of not going through VPN if the connection somehow drops or you've restarted the machine its running on and the vpn started after the torrent client. My current setup uses namespaces to avoid this issue. Basically, one can create a wg interface in the default namespace and then move it to a new namespace and run applications there. The wg interface keeps routing the encrypted traffic through the interfaces in the default namespace, but as there is only the wg interface in the new namespace, there is no risk of leaking any traffic. It also doesn't need a network bridge and doesn't disturb the network configuration of the host. I use lxc, but there are probably more lightweight options to just start an application in a different network namespace. See: https://www.wireguard.com/netns/ https://www.wireguard.com/netns/
    - oktwtf 5y ago
      What a great suggestion! I had debated rolling over to wg as my VPN provides it, however hadn't worked out how to manage the Binding for the torrent applications. This relieves me having to manage restarts when the VPN connection issues for example a new IP. I currently just allow some scripts to refresh things when the uplink changes.
      - newman314 5y ago
        So for wireguard-nt and qbittorrent, qbitorrent has the ability to only send traffic on a particular interface (under advanced settings). I set this to be the WG interface and that works as a poor man's killswitch.
- newman314 5y ago
  Userspace is slower but the idea is to have a single binary that can download torrents over wg. I have not seen anything like this before and it would make for a nice differentiator.
michaeldwan 5y ago
We use wireguard-go in our cli for connecting to vms over a private network. It is slower than wireguard in the kernel, but the convenience is hard to beat. Here's an overview https://fly.io/blog/ssh-and-user-mode-ip-wireguard/ https://fly.io/blog/ssh-and-user-mode-ip-wireguard/
- _joel 5y ago
  Have you tried https://github.com/KusakabeSi/wireguard-go-vpp https://github.com/KusakabeSi/wireguard-go-vpp ?
georgyo 5y ago
This is actually much more complicated than just using wireguard-go. That currently just creates an interface, but that is just for raw packets. The kernel is the one that is still handling the IP connections. To have a process do what you are implying would require an entire userspace TCP/IP stack. These are pretty rare. Slip4netns is an example of one.
- lunixbochs 5y ago
  There's a user space network stack in gvisor, written in Go. And it's already included in wireguard-go. See also https://fly.io/blog/ssh-and-user-mode-ip-wireguard/ https://fly.io/blog/ssh-and-user-mode-ip-wireguard/ which has already done this for SSH through wireguard-go

varbhat 5y ago

Nice. I will consider. You can route network of exatorrent through network/VPN . Also, wireguard implemented in Linux kernel is faster than userspace implementation of wireguard-go . No?

y4mi 5y ago
> You can route network of exatorrent through network/VPN . that always comes with the danger of not going through VPN if the connection somehow drops or you've restarted the machine its running on and the vpn started after the torrent client. and the linux kernel implementation isnt necessarily available if its running in a docker container of some NAS or even on a windows machine. it would also make it easier to use, allowing more people to utilize the tech.
- varbhat 5y ago
  Thanks for suggesting me. I will consider this.
- HansHamster 5y ago
  > that always comes with the danger of not going through VPN if the connection somehow drops or you've restarted the machine its running on and the vpn started after the torrent client. My current setup uses namespaces to avoid this issue. Basically, one can create a wg interface in the default namespace and then move it to a new namespace and run applications there. The wg interface keeps routing the encrypted traffic through the interfaces in the default namespace, but as there is only the wg interface in the new namespace, there is no risk of leaking any traffic. It also doesn't need a network bridge and doesn't disturb the network configuration of the host. I use lxc, but there are probably more lightweight options to just start an application in a different network namespace. See: https://www.wireguard.com/netns/ https://www.wireguard.com/netns/
  - oktwtf 5y ago
    What a great suggestion! I had debated rolling over to wg as my VPN provides it, however hadn't worked out how to manage the Binding for the torrent applications. This relieves me having to manage restarts when the VPN connection issues for example a new IP. I currently just allow some scripts to refresh things when the uplink changes.
    - newman314 5y ago
      So for wireguard-nt and qbittorrent, qbitorrent has the ability to only send traffic on a particular interface (under advanced settings). I set this to be the WG interface and that works as a poor man's killswitch.
newman314 5y ago
Userspace is slower but the idea is to have a single binary that can download torrents over wg. I have not seen anything like this before and it would make for a nice differentiator.

michaeldwan 5y ago

We use wireguard-go in our cli for connecting to vms over a private network. It is slower than wireguard in the kernel, but the convenience is hard to beat. Here's an overview https://fly.io/blog/ssh-and-user-mode-ip-wireguard/ https://fly.io/blog/ssh-and-user-mode-ip-wireguard/

_joel 5y ago
Have you tried https://github.com/KusakabeSi/wireguard-go-vpp https://github.com/KusakabeSi/wireguard-go-vpp ?

georgyo 5y ago

This is actually much more complicated than just using wireguard-go. That currently just creates an interface, but that is just for raw packets. The kernel is the one that is still handling the IP connections. To have a process do what you are implying would require an entire userspace TCP/IP stack. These are pretty rare. Slip4netns is an example of one.

lunixbochs 5y ago
There's a user space network stack in gvisor, written in Go. And it's already included in wireguard-go. See also https://fly.io/blog/ssh-and-user-mode-ip-wireguard/ https://fly.io/blog/ssh-and-user-mode-ip-wireguard/ which has already done this for SSH through wireguard-go