4 ms·

All the replies to your comment seem like sales pitches that don't actually explain anything. The difference between wireguard and OpenVPN is that there is no

All the replies to your comment seem like sales pitches that don't actually explain anything. The difference between wireguard and OpenVPN is that there is no real negotiation between the client and server. Connecting to OpenVPN can take several seconds as it authenticates you, figured out encryption algorithms, IP and route management. If the network or OpenVPN server hiccup, it drops you and you need to reconnect and renegotiate again. Wireguard does not do this, the interface comes up regardless if the remote server is up. The client and server key have already been exchanged, the routing and ip are statically configured, so the server can just receive packets without any negotiation. Clients are identified by their public key, so roaming and ip switches are seamless as well. There actually is a very tiny amount of negotiation in that protocol has perfect forward secrecy, so the connection re keys every two minutes (hard codes time value).

_8j50 5y ago
Thanks, that was very useful
SahAssar 5y ago
> All the replies to your comment seem like sales pitches that don't actually explain anything. It's sort of hard to provide any other than "yes/no" to a question like "Is WG stable/reliable", right? For most uses the answer is probably "yes" but there are use cases (I'm guessing around auth and middleboxes that do not like UDP) where the answer would be "no".
wolverine876 5y ago
Regarding stability: WireGuard is widely used, Linus allowed it into the Linux kernel, and I haven't heard anyone mention stability problems. WireGuard is also orders of magnitude more secure than OpenVPN.
- TedDoesntTalk 5y ago
  > WireGuard is also orders of magnitude more secure than OpenVPN. This entirely depends on how you configure OpenVPN, which encryption to allow it to support, HMAC, hashes, etc. If you configure it with maximum security, it is equally secure as WireGuard. If you configure it less so, then you allow older clients to connect.
  - BlackLotus89 5y ago
    I think what the parent post meant isn't necessarily security in the transport, but security in the code. The wireguard has around 4k LOC [0] and you can read and understand it in a weekend (or faster depending on your skill). Also you not only don't have to configure the ciphers, but you actually can't. If any of the chosen defaults isn't considered secure anymore they will be replaced [citation needed]. So even thought the code resides in the linux kernel you could still reasonably well argue that it is indeed on several levels more secure than OpenVPN. Here [1] is the whitepaper for anyone who is interested. [0] https://git.zx2c4.com/wireguard-linux/tree/drivers/net/wireguard/ https://git.zx2c4.com/wireguard-linux/tree/drivers/net/wireg... [1] https://www.wireguard.com/papers/wireguard.pdf https://www.wireguard.com/papers/wireguard.pdf
  - tptacek 5y ago
    No, it does not depend on configuration. You cannot configure OpenVPN to be "equally as secure as WireGuard".

_8j50 5y ago

Thanks, that was very useful

SahAssar 5y ago

> All the replies to your comment seem like sales pitches that don't actually explain anything. It's sort of hard to provide any other than "yes/no" to a question like "Is WG stable/reliable", right? For most uses the answer is probably "yes" but there are use cases (I'm guessing around auth and middleboxes that do not like UDP) where the answer would be "no".

wolverine876 5y ago

Regarding stability: WireGuard is widely used, Linus allowed it into the Linux kernel, and I haven't heard anyone mention stability problems. WireGuard is also orders of magnitude more secure than OpenVPN.

TedDoesntTalk 5y ago
> WireGuard is also orders of magnitude more secure than OpenVPN. This entirely depends on how you configure OpenVPN, which encryption to allow it to support, HMAC, hashes, etc. If you configure it with maximum security, it is equally secure as WireGuard. If you configure it less so, then you allow older clients to connect.
- BlackLotus89 5y ago
  I think what the parent post meant isn't necessarily security in the transport, but security in the code. The wireguard has around 4k LOC [0] and you can read and understand it in a weekend (or faster depending on your skill). Also you not only don't have to configure the ciphers, but you actually can't. If any of the chosen defaults isn't considered secure anymore they will be replaced [citation needed]. So even thought the code resides in the linux kernel you could still reasonably well argue that it is indeed on several levels more secure than OpenVPN. Here [1] is the whitepaper for anyone who is interested. [0] https://git.zx2c4.com/wireguard-linux/tree/drivers/net/wireguard/ https://git.zx2c4.com/wireguard-linux/tree/drivers/net/wireg... [1] https://www.wireguard.com/papers/wireguard.pdf https://www.wireguard.com/papers/wireguard.pdf
- tptacek 5y ago
  No, it does not depend on configuration. You cannot configure OpenVPN to be "equally as secure as WireGuard".