5 ms·

It's good to see WireGuard getting some love on Windows. Unfortunately it's not for me at the moment and doesn't tick the boxes I need: - Last I checked, dynam

It's good to see WireGuard getting some love on Windows. Unfortunately it's not for me at the moment and doesn't tick the boxes I need: - Last I checked, dynamic server IPs were not supported - It's system wide by default. With all VPNs, it is relatively difficult to say: use this connection for these applications, or these addresses. Popular VPN apps have per-app-settings, but I find them buggy and not trustworthy. And if you are an expert you can set your own routing of course. But it would be great if you could just right click on a titlebar and say "use VPN for this app", and it was integrated with the OS - There is no obfuscation for hostile environments. I would like a VPN which has pluggable transports, and can, say, look like ssh or http or a game, and route over 20 random servers. I know of shadowsocks etc., but I could never get it to run. - There is no integration with Windows login AFAIK. If you want to log into a Windows AD domain, you need to be in the VPN, but you can't establish connection when you are not logged in. This is really annoying. There is a capability in Windows for this, but I never found a VPN where it works properly. So technically WireGuard is great, security and speed wise, but for me the potential VPN killer application would be defined by superior UX, not by tech.

c7DJTLrn 5y ago
On your last point, I have a similar problem. I'd like to use WireGuard in a large fleet but the authentication/encryption is just too barebones. You have to generate a keypair for each host and then add that public key to a file on the server. In other words, you can't do it with X509 certificates. I appreciate WireGuard is designed for simplicity but I don't see how it can scale with this limitation.
- phkahler 5y ago
  Other VPN software will change out their lower layers for wire guard, while keeping things like key management as is.
  - stormbrew 5y ago
    This is a tempting idea, and maybe it's actually happening, but I do wonder if it's a bit like the hope that git would eventually sprout 'better porcelain' that would obsolete all the clunky bash, perl, etc. scripts that it started out as. In the end most everyone who uses git puts up with the slowly improving 'mainline' porcelain and all the replacements never go anywhere. In particular, I imagine it was important for initial adoption to create the android/ios apps but it really feels like now we're stuck with the kind of clunky (super easy for the user, but super hard to get right for the admin of the network imo) flow they created.
tptacek 5y ago
These things aren't WireGuard's job any more than they were IPSEC's job. What's supposed to happen for people who care a lot about these things is for systems to get built on top of WireGuard to provide them. That's happened for the commercial market, where things like roaming and NAT traversal are key features, and so we have Tailscale. It sounds like you're identifying an open source privacy project built on WireGuard that want to exist. Why not try to put one together?
- riobard 5y ago
  This is when what makes WireGuard very performing also makes it very difficult to extend. Being in the kernel means extending it in userspace hurts its performance.
  - oynqr 5y ago
    Check out innernet, they seem to be doing just fine.
  - touisteur 5y ago
    Why extend when most of you might need can be built atop a very performant base layer. Combining wg and namespaces is quite the amazing swissknife.
    - riobard 5y ago
      Please let me know how to build an obfuscation layer on top of kernel-based WireGuard without sacrificing performance.
      - touisteur 5y ago
        I'm curious what you mean by 'an obfuscation layer' and the use case around that?
        riobard 5y ago
        Well then how can you claim “most of you might need can be built atop a very performant base layer” without understanding what the grandparent comment (https://news.ycombinator.com/item?id=28579704 https://news.ycombinator.com/item?id=28579704) says about WireGuard lacking obfuscation? WireGuard encrypted UDP packets have obvious signature due to the packet type field in the header being in cleartext. DPI can easily filter/drop WG traffic just by checking the first few bytes of each UDP packet and doing simple statistics. To obfuscate in this context means to morph WireGuard encrypted UDP packets to look like something else (e.g. VoIP traffic). Current kernel-based official WireGuard implementations leave no possibility of doing so while staying in-kernel.
MikusR 5y ago
>Last I checked, dynamic server IPs were not supported you can specify a domain name to connect (so can use a dyndns service) >it is relatively difficult to say: use this connection for these addresses you can specify addresses that will go through wireguard. For example: AllowedIPs = 192.168.1.0/24,
- Qub3d 5y ago
  Yep! I have a domain on cloudflare (wg.<mydomain>.tld) that my OpenWRT router automatically updates when my IP changes. I just point my peers at wg.<mydomain>.tld and i'm set! This effectively costs just the registration fee annually (about $7 on cloudflare currently) but could also be done with a free service like no-ip or similar.
neither_color 5y ago
I would like a VPN which has pluggable transports, and can, say, look like ssh or http or a game, and route over 20 random servers. I know of shadowsocks etc., but I could never get it to run. To be pedantic, shadowsocks is a proxy not a VPN but it does what you describe very well, and anecdotally it is better at circumventing the great firewall than wireguard(with its predictable signature it's quickly blocked). Granted I'm not in China anymore and you probably aren't there either, so both wireguard and shadowsocks work really well, but you might want to consider using a proxy over a VPN. If you've had trouble installing SS before, I recommend the streisand ansible script. Connect it to a VPS and it'll install wireguard, shadowsocks with V2ray plugin pointing to github for obfuscation, TOR, OpenVPN and more all at once. https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand If you're an iOS user and have multiple shadowsocks server, the shadowrocket app makes it very easy to make rulesets that look like so(don't worry there's a UI for it): https://raw.githubusercontent.com/a00789123/rules-bak/main/Shadow-Rule-set.conf https://raw.githubusercontent.com/a00789123/rules-bak/main/S... You can get specific like "BBC traffic goes through my london proxy, leave netflix un-proxied, twitter traffic goes through germany, etc." I also do the opposite of VPNing, where I use home PC as a server too so that when I'm traveling I don't get flagged with anti-fraud stuff when I want to check my bank apps and I can watch American Netflix without every worrying about it being blocked. edit: looks like streisand got archived at the same time as Ubuntu 16.04 got EOL'd. I didnt know because some of my instances have run for years. You can read the discussions on github for some alternative projects.
easton 5y ago
> There is a capability in Windows for this, but I never found a VPN where it works properly. This works with Cisco AnyConnect and Palo Alto GlobalProtect (I've seen it work). Those products are pretty terrible, but that one thing works.
mongol 5y ago
You can use Linux network namespaces to apply it only to processes in that namespace.
- carlhjerpe 5y ago
  Or vrf-lite, ip vrf run <vrfname> <command> Quite easy to use

c7DJTLrn 5y ago

On your last point, I have a similar problem. I'd like to use WireGuard in a large fleet but the authentication/encryption is just too barebones. You have to generate a keypair for each host and then add that public key to a file on the server. In other words, you can't do it with X509 certificates. I appreciate WireGuard is designed for simplicity but I don't see how it can scale with this limitation.

phkahler 5y ago
Other VPN software will change out their lower layers for wire guard, while keeping things like key management as is.
- stormbrew 5y ago
  This is a tempting idea, and maybe it's actually happening, but I do wonder if it's a bit like the hope that git would eventually sprout 'better porcelain' that would obsolete all the clunky bash, perl, etc. scripts that it started out as. In the end most everyone who uses git puts up with the slowly improving 'mainline' porcelain and all the replacements never go anywhere. In particular, I imagine it was important for initial adoption to create the android/ios apps but it really feels like now we're stuck with the kind of clunky (super easy for the user, but super hard to get right for the admin of the network imo) flow they created.

tptacek 5y ago

These things aren't WireGuard's job any more than they were IPSEC's job. What's supposed to happen for people who care a lot about these things is for systems to get built on top of WireGuard to provide them. That's happened for the commercial market, where things like roaming and NAT traversal are key features, and so we have Tailscale. It sounds like you're identifying an open source privacy project built on WireGuard that want to exist. Why not try to put one together?

riobard 5y ago
This is when what makes WireGuard very performing also makes it very difficult to extend. Being in the kernel means extending it in userspace hurts its performance.
- oynqr 5y ago
  Check out innernet, they seem to be doing just fine.
- touisteur 5y ago
  Why extend when most of you might need can be built atop a very performant base layer. Combining wg and namespaces is quite the amazing swissknife.
  - riobard 5y ago
    Please let me know how to build an obfuscation layer on top of kernel-based WireGuard without sacrificing performance.
    - touisteur 5y ago
      I'm curious what you mean by 'an obfuscation layer' and the use case around that?
      - riobard 5y ago
        Well then how can you claim “most of you might need can be built atop a very performant base layer” without understanding what the grandparent comment (https://news.ycombinator.com/item?id=28579704 https://news.ycombinator.com/item?id=28579704) says about WireGuard lacking obfuscation? WireGuard encrypted UDP packets have obvious signature due to the packet type field in the header being in cleartext. DPI can easily filter/drop WG traffic just by checking the first few bytes of each UDP packet and doing simple statistics. To obfuscate in this context means to morph WireGuard encrypted UDP packets to look like something else (e.g. VoIP traffic). Current kernel-based official WireGuard implementations leave no possibility of doing so while staying in-kernel.

MikusR 5y ago

>Last I checked, dynamic server IPs were not supported you can specify a domain name to connect (so can use a dyndns service) >it is relatively difficult to say: use this connection for these addresses you can specify addresses that will go through wireguard. For example: AllowedIPs = 192.168.1.0/24,

Qub3d 5y ago
Yep! I have a domain on cloudflare (wg.<mydomain>.tld) that my OpenWRT router automatically updates when my IP changes. I just point my peers at wg.<mydomain>.tld and i'm set! This effectively costs just the registration fee annually (about $7 on cloudflare currently) but could also be done with a free service like no-ip or similar.

neither_color 5y ago

I would like a VPN which has pluggable transports, and can, say, look like ssh or http or a game, and route over 20 random servers. I know of shadowsocks etc., but I could never get it to run. To be pedantic, shadowsocks is a proxy not a VPN but it does what you describe very well, and anecdotally it is better at circumventing the great firewall than wireguard(with its predictable signature it's quickly blocked). Granted I'm not in China anymore and you probably aren't there either, so both wireguard and shadowsocks work really well, but you might want to consider using a proxy over a VPN. If you've had trouble installing SS before, I recommend the streisand ansible script. Connect it to a VPS and it'll install wireguard, shadowsocks with V2ray plugin pointing to github for obfuscation, TOR, OpenVPN and more all at once. https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand If you're an iOS user and have multiple shadowsocks server, the shadowrocket app makes it very easy to make rulesets that look like so(don't worry there's a UI for it): https://raw.githubusercontent.com/a00789123/rules-bak/main/Shadow-Rule-set.conf https://raw.githubusercontent.com/a00789123/rules-bak/main/S... You can get specific like "BBC traffic goes through my london proxy, leave netflix un-proxied, twitter traffic goes through germany, etc." I also do the opposite of VPNing, where I use home PC as a server too so that when I'm traveling I don't get flagged with anti-fraud stuff when I want to check my bank apps and I can watch American Netflix without every worrying about it being blocked. edit: looks like streisand got archived at the same time as Ubuntu 16.04 got EOL'd. I didnt know because some of my instances have run for years. You can read the discussions on github for some alternative projects.

easton 5y ago

> There is a capability in Windows for this, but I never found a VPN where it works properly. This works with Cisco AnyConnect and Palo Alto GlobalProtect (I've seen it work). Those products are pretty terrible, but that one thing works.

mongol 5y ago

You can use Linux network namespaces to apply it only to processes in that namespace.

carlhjerpe 5y ago
Or vrf-lite, ip vrf run <vrfname> <command> Quite easy to use