4 ms·

I've mostly only used OpenVPN for personal VPN needs. Is WG stable/reliable? My OpenVPN tunnels bounce too much.

by _8j50 5y ago

johnchristopher 5y ago
Running wg on my VPS was a setup-and-forget thing. I like the fact it's dead simple to add a new pair and to configure.
jvanderbot 5y ago
WG isn't just stable, it's so easy to configure and set up you'll wonder why you didn't do it ages ago. At least that's the way it was for me. I stand by my assertion that eventually nobody will talk about Wireguard because everyone will use it for almost everything. It'll be like HTTPS, TLS, or TCP.
- icelancer 5y ago
  I tried setting it up on a VPS on Ubuntu the other day, got it installed after doing some config files, connected to the tunnel, could access the server but not the wider Internet. Made about 4-5 config changes per a bunch of Stackoverflow posts then gave up since nothing worked. Installed OpenVPN instead, took me 2 minutes and worked immediately with far fewer config files changes. I've had this experience before with Wireguard as well. People keep saying how easy it is and in my experience... it simply isn't. OpenVPN has a lot of BS overhead and I'd be more than pleased to move off of it. But WG hasn't been simple for a common use case - install on Ubuntu VPS, client on Windows.
  - j3th9n 5y ago
    This was possibly all you needed to do: echo 1 > /proc/sys/net/ipv4/ip_forward
    - icelancer 5y ago
      cat /proc/sys/net/ipv4/ip_forward shows '1', I set it via sysctl -w net.ipv4.ip_forward=1 in the past I think based on instructions.
      - j3th9n 5y ago
        Then maybe you need to add the following to the [Interface] section of your wg0.conf on your server or else I don't know ;-) : PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
        icelancer 5y ago
        Already reads as such, though I've tried that code snippet too: PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; iptables -A FORWARD -o %i -j ACCEPT PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; iptables -D FORWARD -o %i -j ACCEPT Like I said, everyone keeps saying Wireguard is dead simple to set up, but the comments are full of editing configuration files, priv/pub key pairs, etc. I've helped administer OpenVPN servers for a decade now (and take no pride in it), and yet all these errors that keep coming up in Wireguard configuration for me on a main Linux distro + Windows 10 client seem pretty odd for something that's supposedly so easy to use. Someone just come out with a wizard/package installer that actually works reasonably well (like OpenVPN has already) and then it might be "easy" to install. For OpenVPN I run an apt install command, run a wizard, SFTP into the box, transfer out the .ovpn file, import it into whatever client devices I need, and it works. Wireguard is at least 10 times tougher than that, even if it worked, which it currently does not.
        j3th9n 5y ago
        Well, hit me up if you want a VPS installed with WireGuard with maybe some nice web interface like https://github.com/EmbarkStudios/wg-ui https://github.com/EmbarkStudios/wg-ui
      - 5y ago
  - rndgermandude 5y ago
    To give a counterpoint. I have both OpenVPN and wireguard set up, running my own server/"server" peer... First OpenVPN because that's what I used before wireguard was around (and now keep as a fallback that I never use). OpenVPN required a lot more fiddling e.g. to get a ca+client certs for auth set up, find a config that works for each OS where I have clients, etc. And then again some more work because client certs expired, and again more work because the distro changed some things and required a different config suddenly (not really OpenVPN's fault) wireguard just worked for me, except I first forgot to enable port forwarding / the NAT stuff on the interface on the "server" peer so that I could route all traffic through it (other people already remarked about that), not just have a point-to-point to it. The point-to-point stuff worked immediately tho without having to sprinkle any magic pixie dust on top first. Setting up a "server" is always more intricate be it OpenVPN be it wireguard, tho. But once I had two peers in my wireguard setup up and running (the "server" and the first client) adding more clients was a breeze compared to doing the same in OpenVPN. All in all, it was like 10 mins of fiddling in some testing VMs and a bit of googling, and then a couple of more minutes to apply what iIlearned and set up the real "prod".
  - na85 5y ago
    >I tried setting it up on a VPS on Ubuntu the other day, got it installed after doing some config files, connected to the tunnel, could access the server but not the wider Internet. Made about 4-5 config changes per a bunch of Stackoverflow posts then gave up since nothing worked. I ran into this also. The docs are quite bad, in the sense that they assume a lot on the part of the reader and only cover a fairly simple use case.
    - wg-throw-away 5y ago
      I have a script to automate the pain away with creating throw away VM instances based on Ubuntu/Debian. Almost every fail is not allowing the correct ingress port into the VM (51820 in my case) https://pastebin.com/09iE1sME https://pastebin.com/09iE1sME
codetrotter 5y ago
I've been running a WireGuard setup for a couple of years now, and have been and continue to be very satisfied with it. - WireGuard server running on my FreeBSD VPS. Always on. - WireGuard client running on my MacBook Pro M1 laptop (and prior to that, on the MacBook Air that I had before this computer). I activate this one when I need to connect to my server or to some other device on the VPN. - WireGuard client running on my iPhone X. Like with my laptop, I activate it when I need to connect to the server or to another device on the VPN. - WireGuard client running on my grandfather's Mac Pro desktop computer. Always on. This allows me to remote into his computer via the macOS-builtin VNC server on his computer, to help him out when he is stuck at something. I use the macOS-builtin VNC client on my MBP or a third-party VNC client on my iPhone. In either case the connection is tunneled over the WireGuard VPN. I also have the builtin SSH server running on his computer that I connect to over WG VPN to transfer files or run commands through. - WireGuard client running on my desktop computer which runs KDE Neon Linux. Always on. WireGuard has been almost trivially simple to set up across all of these systems; FreeBSD, macOS, iOS, Linux. And I am sure it is equally simple to set up on many other systems as well. WireGuard has been very stable and reliable too for all of the time that I have been using it. Some months ago I changed the WireGuard configuration on my server to run on port 443 UDP instead of the UDP port that WireGuard server would run on by default. This has allowed me to connect to my VPN even when using some public hotspots that were very restrictive on what traffic they allowed through and where previously I could not connect to my WireGuard VPN. Deep packet inspection would still block the traffic I assume, but in all cases with regular public hotspots in my country I have been able to connect to my VPN after I made this change of what port I am using. I live in Norway. I highly recommend anyone that wants to run their own VPN to use WireGuard. I personally use my WireGuard VPN for connectivity between these hosts only, not for tunneling traffic that is routed out onto the wider Internet. (That is, my tunnel runs over the Internet but I only use it for traffic that is destined to the machines that are member of the VPN). So I cannot really comment on the use-case of tunneling Internet traffic, but from the experience with connecting the hosts in my VPN I can only assume that tunneling Internet traffic would work out equally well.
- atatatat 5y ago
  Is your grandfather on a VPN you share with him? Is he on static IP?
georgyo 5y ago
All the replies to your comment seem like sales pitches that don't actually explain anything. The difference between wireguard and OpenVPN is that there is no real negotiation between the client and server. Connecting to OpenVPN can take several seconds as it authenticates you, figured out encryption algorithms, IP and route management. If the network or OpenVPN server hiccup, it drops you and you need to reconnect and renegotiate again. Wireguard does not do this, the interface comes up regardless if the remote server is up. The client and server key have already been exchanged, the routing and ip are statically configured, so the server can just receive packets without any negotiation. Clients are identified by their public key, so roaming and ip switches are seamless as well. There actually is a very tiny amount of negotiation in that protocol has perfect forward secrecy, so the connection re keys every two minutes (hard codes time value).
- _8j50 5y ago
  Thanks, that was very useful
- SahAssar 5y ago
  > All the replies to your comment seem like sales pitches that don't actually explain anything. It's sort of hard to provide any other than "yes/no" to a question like "Is WG stable/reliable", right? For most uses the answer is probably "yes" but there are use cases (I'm guessing around auth and middleboxes that do not like UDP) where the answer would be "no".
- wolverine876 5y ago
  Regarding stability: WireGuard is widely used, Linus allowed it into the Linux kernel, and I haven't heard anyone mention stability problems. WireGuard is also orders of magnitude more secure than OpenVPN.
  - TedDoesntTalk 5y ago
    > WireGuard is also orders of magnitude more secure than OpenVPN. This entirely depends on how you configure OpenVPN, which encryption to allow it to support, HMAC, hashes, etc. If you configure it with maximum security, it is equally secure as WireGuard. If you configure it less so, then you allow older clients to connect.
zxcvbn4038 5y ago
About the only issue I've had with wireguard is that it leaks DNS so I'm constantly getting alerts from AWS GuardDuty about suspicious DNS queries. The only way around that I can see is to run my own DNS and forward the queries that don't look like they are AWS related to a public resolver like 1.1.1.1. I am really eager to hear details how the VPNs are implementing Wireguard - particularly the address management portion.
- rndgermandude 5y ago
  It doesn't really "leak" DNS, because it has no concept really of DNS resolution. It's a virtual network interface. It will not mess with your resolv.conf. Are you tunneling out of AWS, or are you using some AWS node as a wireguard server? Sounds like the former with wireguard interface being the default gateway (I am not an AWS user and am just guessing)... Adding a route for the AWS DNS server IP(s) to use the real network interface for traffic instead of the wireguard interface might work. Something like ip route add <AWS DNS server IP, or AWS subnet) dev <normal network interface such as eth0> e.g. ip route add 10.0.0/24 dev eth0 Of course, that will make DNS traffic bypass wireguard. If your goal is to hide your DNS queries from AWS except for internal AWS queries, then you will indeed have to run some local resolver that is set up to use the AWS DNS server for AWS-internal queries and some other server (be it a local one or some public one) for everything else.

I've mostly only used OpenVPN for personal VPN needs. Is WG stable/reliable? My OpenVPN tunnels bounce too much.

by _8j50 5y ago

I've mostly only used OpenVPN for personal VPN needs. Is WG stable/reliable? My OpenVPN tunnels bounce too much.

johnchristopher 5y ago

Running wg on my VPS was a setup-and-forget thing. I like the fact it's dead simple to add a new pair and to configure.

jvanderbot 5y ago

WG isn't just stable, it's so easy to configure and set up you'll wonder why you didn't do it ages ago. At least that's the way it was for me. I stand by my assertion that eventually nobody will talk about Wireguard because everyone will use it for almost everything. It'll be like HTTPS, TLS, or TCP.

icelancer 5y ago
I tried setting it up on a VPS on Ubuntu the other day, got it installed after doing some config files, connected to the tunnel, could access the server but not the wider Internet. Made about 4-5 config changes per a bunch of Stackoverflow posts then gave up since nothing worked. Installed OpenVPN instead, took me 2 minutes and worked immediately with far fewer config files changes. I've had this experience before with Wireguard as well. People keep saying how easy it is and in my experience... it simply isn't. OpenVPN has a lot of BS overhead and I'd be more than pleased to move off of it. But WG hasn't been simple for a common use case - install on Ubuntu VPS, client on Windows.
- j3th9n 5y ago
  This was possibly all you needed to do: echo 1 > /proc/sys/net/ipv4/ip_forward
  - icelancer 5y ago
    cat /proc/sys/net/ipv4/ip_forward shows '1', I set it via sysctl -w net.ipv4.ip_forward=1 in the past I think based on instructions.
    - j3th9n 5y ago
      Then maybe you need to add the following to the [Interface] section of your wg0.conf on your server or else I don't know ;-) : PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
      - icelancer 5y ago
        Already reads as such, though I've tried that code snippet too: PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; iptables -A FORWARD -o %i -j ACCEPT PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; iptables -D FORWARD -o %i -j ACCEPT Like I said, everyone keeps saying Wireguard is dead simple to set up, but the comments are full of editing configuration files, priv/pub key pairs, etc. I've helped administer OpenVPN servers for a decade now (and take no pride in it), and yet all these errors that keep coming up in Wireguard configuration for me on a main Linux distro + Windows 10 client seem pretty odd for something that's supposedly so easy to use. Someone just come out with a wizard/package installer that actually works reasonably well (like OpenVPN has already) and then it might be "easy" to install. For OpenVPN I run an apt install command, run a wizard, SFTP into the box, transfer out the .ovpn file, import it into whatever client devices I need, and it works. Wireguard is at least 10 times tougher than that, even if it worked, which it currently does not.
        j3th9n 5y ago
        Well, hit me up if you want a VPS installed with WireGuard with maybe some nice web interface like https://github.com/EmbarkStudios/wg-ui https://github.com/EmbarkStudios/wg-ui
    - 5y ago
- rndgermandude 5y ago
  To give a counterpoint. I have both OpenVPN and wireguard set up, running my own server/"server" peer... First OpenVPN because that's what I used before wireguard was around (and now keep as a fallback that I never use). OpenVPN required a lot more fiddling e.g. to get a ca+client certs for auth set up, find a config that works for each OS where I have clients, etc. And then again some more work because client certs expired, and again more work because the distro changed some things and required a different config suddenly (not really OpenVPN's fault) wireguard just worked for me, except I first forgot to enable port forwarding / the NAT stuff on the interface on the "server" peer so that I could route all traffic through it (other people already remarked about that), not just have a point-to-point to it. The point-to-point stuff worked immediately tho without having to sprinkle any magic pixie dust on top first. Setting up a "server" is always more intricate be it OpenVPN be it wireguard, tho. But once I had two peers in my wireguard setup up and running (the "server" and the first client) adding more clients was a breeze compared to doing the same in OpenVPN. All in all, it was like 10 mins of fiddling in some testing VMs and a bit of googling, and then a couple of more minutes to apply what iIlearned and set up the real "prod".
- na85 5y ago
  >I tried setting it up on a VPS on Ubuntu the other day, got it installed after doing some config files, connected to the tunnel, could access the server but not the wider Internet. Made about 4-5 config changes per a bunch of Stackoverflow posts then gave up since nothing worked. I ran into this also. The docs are quite bad, in the sense that they assume a lot on the part of the reader and only cover a fairly simple use case.
  - wg-throw-away 5y ago
    I have a script to automate the pain away with creating throw away VM instances based on Ubuntu/Debian. Almost every fail is not allowing the correct ingress port into the VM (51820 in my case) https://pastebin.com/09iE1sME https://pastebin.com/09iE1sME

codetrotter 5y ago

I've been running a WireGuard setup for a couple of years now, and have been and continue to be very satisfied with it. - WireGuard server running on my FreeBSD VPS. Always on. - WireGuard client running on my MacBook Pro M1 laptop (and prior to that, on the MacBook Air that I had before this computer). I activate this one when I need to connect to my server or to some other device on the VPN. - WireGuard client running on my iPhone X. Like with my laptop, I activate it when I need to connect to the server or to another device on the VPN. - WireGuard client running on my grandfather's Mac Pro desktop computer. Always on. This allows me to remote into his computer via the macOS-builtin VNC server on his computer, to help him out when he is stuck at something. I use the macOS-builtin VNC client on my MBP or a third-party VNC client on my iPhone. In either case the connection is tunneled over the WireGuard VPN. I also have the builtin SSH server running on his computer that I connect to over WG VPN to transfer files or run commands through. - WireGuard client running on my desktop computer which runs KDE Neon Linux. Always on. WireGuard has been almost trivially simple to set up across all of these systems; FreeBSD, macOS, iOS, Linux. And I am sure it is equally simple to set up on many other systems as well. WireGuard has been very stable and reliable too for all of the time that I have been using it. Some months ago I changed the WireGuard configuration on my server to run on port 443 UDP instead of the UDP port that WireGuard server would run on by default. This has allowed me to connect to my VPN even when using some public hotspots that were very restrictive on what traffic they allowed through and where previously I could not connect to my WireGuard VPN. Deep packet inspection would still block the traffic I assume, but in all cases with regular public hotspots in my country I have been able to connect to my VPN after I made this change of what port I am using. I live in Norway. I highly recommend anyone that wants to run their own VPN to use WireGuard. I personally use my WireGuard VPN for connectivity between these hosts only, not for tunneling traffic that is routed out onto the wider Internet. (That is, my tunnel runs over the Internet but I only use it for traffic that is destined to the machines that are member of the VPN). So I cannot really comment on the use-case of tunneling Internet traffic, but from the experience with connecting the hosts in my VPN I can only assume that tunneling Internet traffic would work out equally well.

atatatat 5y ago
Is your grandfather on a VPN you share with him? Is he on static IP?

georgyo 5y ago

All the replies to your comment seem like sales pitches that don't actually explain anything. The difference between wireguard and OpenVPN is that there is no real negotiation between the client and server. Connecting to OpenVPN can take several seconds as it authenticates you, figured out encryption algorithms, IP and route management. If the network or OpenVPN server hiccup, it drops you and you need to reconnect and renegotiate again. Wireguard does not do this, the interface comes up regardless if the remote server is up. The client and server key have already been exchanged, the routing and ip are statically configured, so the server can just receive packets without any negotiation. Clients are identified by their public key, so roaming and ip switches are seamless as well. There actually is a very tiny amount of negotiation in that protocol has perfect forward secrecy, so the connection re keys every two minutes (hard codes time value).

_8j50 5y ago
Thanks, that was very useful
SahAssar 5y ago
> All the replies to your comment seem like sales pitches that don't actually explain anything. It's sort of hard to provide any other than "yes/no" to a question like "Is WG stable/reliable", right? For most uses the answer is probably "yes" but there are use cases (I'm guessing around auth and middleboxes that do not like UDP) where the answer would be "no".
wolverine876 5y ago
Regarding stability: WireGuard is widely used, Linus allowed it into the Linux kernel, and I haven't heard anyone mention stability problems. WireGuard is also orders of magnitude more secure than OpenVPN.
- TedDoesntTalk 5y ago
  > WireGuard is also orders of magnitude more secure than OpenVPN. This entirely depends on how you configure OpenVPN, which encryption to allow it to support, HMAC, hashes, etc. If you configure it with maximum security, it is equally secure as WireGuard. If you configure it less so, then you allow older clients to connect.

zxcvbn4038 5y ago

About the only issue I've had with wireguard is that it leaks DNS so I'm constantly getting alerts from AWS GuardDuty about suspicious DNS queries. The only way around that I can see is to run my own DNS and forward the queries that don't look like they are AWS related to a public resolver like 1.1.1.1. I am really eager to hear details how the VPNs are implementing Wireguard - particularly the address management portion.

rndgermandude 5y ago
It doesn't really "leak" DNS, because it has no concept really of DNS resolution. It's a virtual network interface. It will not mess with your resolv.conf. Are you tunneling out of AWS, or are you using some AWS node as a wireguard server? Sounds like the former with wireguard interface being the default gateway (I am not an AWS user and am just guessing)... Adding a route for the AWS DNS server IP(s) to use the real network interface for traffic instead of the wireguard interface might work. Something like ip route add <AWS DNS server IP, or AWS subnet) dev <normal network interface such as eth0> e.g. ip route add 10.0.0/24 dev eth0 Of course, that will make DNS traffic bypass wireguard. If your goal is to hide your DNS queries from AWS except for internal AWS queries, then you will indeed have to run some local resolver that is set up to use the AWS DNS server for AWS-internal queries and some other server (be it a local one or some public one) for everything else.