4 ms·

I've recently transitioned my home "IOT" network (and servers) to a Wireguard-only network. It's wonderful. All the routing accessibility through firewalls or w

I've recently transitioned my home "IOT" network (and servers) to a Wireguard-only network. It's wonderful. All the routing accessibility through firewalls or with dynamic IPs just disappeared. All services are exposed only on the wireguard interface, meaning security and connectivity are solved (to the 80/20 level) with just Wireguard. That kind of removed the need for a static broker entirely since now every node has a static IP on my wireguard network and are accessible no matter what network they are actually on. Pinging my mobile phone from an air quality sensor was an eye-opening experience.

kobalsky 5y ago
what kind of IOT devices are we talking about? linux embedded or is wireguard available for something like nodemcu?
- jvanderbot 5y ago
  Linux embedded. (Pis mostly)
3np 5y ago
Did you ever notice any issues with significant increased softirqs? I started going down a similar path but a node that is acting as a gateway/bridge for UDP traffic routing to an outbound wireguard tunnel is now spending a constant ~20% CPU time on NET_RX softirqs with 10Mbps and 5~30Kpps. Almost no NET_TX. It's specifically the combination of UDP-over-wg that seems to cause this. It's otherwise handling 1Gbps and way more packets just fine. (I'm aware MQTT is TCP but hey, worth a shot)
jve 5y ago
Hey, tell us more, please :) I'v hoped to find in your profile maybe more info/blog, but instead: > Group supervisor at NASA Jet Propulsion Laboratory working in autonomous vehicles and sensing for space exploration. Oh well, a little out of scope and I see you blog about other things. Anyway - you mean I don't need static IP to form a network of distant IoT devices? This would be some really useful property.
- jvanderbot 5y ago
  > Group supervisor at NASA Jet Propulsion Laboratory working in autonomous vehicles and sensing for space exploration. Yes, at JPL they let engineers cycle in and out of management. (Serving institution / projects in phases) > Anyway - you mean I don't need static IP to form a network of distant IoT devices? This would be some really useful property. Yes, wireguard will "keep alive" a connection to peers by sending udp packets. This fools stateful sufficiently to allow traffic to migrate across networks easily. Kind of how push notifications magically follow you. On top of those connections, wireguard establishes its own IP addresses for each peer. If you set up wireguard, senging a packet over IP that is one of your wireguard peers will get tunnelled through UDP to the peer at its location and real IP. Thus, you know the node by the WG IP, but it gets delivered seamlessly via whatever means necessary. VPNs have done this forever. Wireguard makes it trivial and portable and fast.
joshspankit 5y ago
I think every upvote on your comment is a request for a blog post or runbook. I would certainly be interested in that.

kobalsky 5y ago

what kind of IOT devices are we talking about? linux embedded or is wireguard available for something like nodemcu?

jvanderbot 5y ago
Linux embedded. (Pis mostly)

3np 5y ago

Did you ever notice any issues with significant increased softirqs? I started going down a similar path but a node that is acting as a gateway/bridge for UDP traffic routing to an outbound wireguard tunnel is now spending a constant ~20% CPU time on NET_RX softirqs with 10Mbps and 5~30Kpps. Almost no NET_TX. It's specifically the combination of UDP-over-wg that seems to cause this. It's otherwise handling 1Gbps and way more packets just fine. (I'm aware MQTT is TCP but hey, worth a shot)

jve 5y ago

Hey, tell us more, please :) I'v hoped to find in your profile maybe more info/blog, but instead: > Group supervisor at NASA Jet Propulsion Laboratory working in autonomous vehicles and sensing for space exploration. Oh well, a little out of scope and I see you blog about other things. Anyway - you mean I don't need static IP to form a network of distant IoT devices? This would be some really useful property.

jvanderbot 5y ago
> Group supervisor at NASA Jet Propulsion Laboratory working in autonomous vehicles and sensing for space exploration. Yes, at JPL they let engineers cycle in and out of management. (Serving institution / projects in phases) > Anyway - you mean I don't need static IP to form a network of distant IoT devices? This would be some really useful property. Yes, wireguard will "keep alive" a connection to peers by sending udp packets. This fools stateful sufficiently to allow traffic to migrate across networks easily. Kind of how push notifications magically follow you. On top of those connections, wireguard establishes its own IP addresses for each peer. If you set up wireguard, senging a packet over IP that is one of your wireguard peers will get tunnelled through UDP to the peer at its location and real IP. Thus, you know the node by the WG IP, but it gets delivered seamlessly via whatever means necessary. VPNs have done this forever. Wireguard makes it trivial and portable and fast.

joshspankit 5y ago

I think every upvote on your comment is a request for a blog post or runbook. I would certainly be interested in that.