5 ms·

This comment thread is for people who don't think IPSec/IKEv2 is the worst invention on the planet and want to share life saving stories about it. This will ine

by j3th9n 5y ago

This comment thread is for people who don't think IPSec/IKEv2 is the worst invention on the planet and want to share life saving stories about it. This will inevitably be downvoted, but (almost) everytime I see IPSec/IKEv2 mentioned there's a bunch of people puking all over it. Of course, it has a lot of options and configurations and you can fu*k things up, you have to study it a bit, like a brain surgeon has to read some books and do some practice. But once done that, it is a beautiful piece of protocol, excuse my language. It's fast, stable, it auto-reconnects, not to mention MOBIKE, it is simply state-of-the-art. I guess not everybody can drive the Formula 1 car of the VPN protocols. ;-o

kortilla 5y ago
It’s like a dishwasher where most of the buttons cause it to not wash your dishes at all and some just break your dishes entirely. A VPN protocol shouldn’t be a kit of parts that might be able to make a secure tunnel. It should only be able to be used correctly.
- j3th9n 5y ago
  IPSec/IKEv2 is not breaking anything, maybe it just won't setup a tunnel. Maybe a better analogy: We don't say the same thing about for example a piano: "it should only be able to be used correctly". You have to study and practice a bit before you can play a somewhat decent piece, without study no piano play. The same for IPSec/IKEv2, without study no tunnel. Every VPN protocol needs a bit of study, maybe some protocol a bit more than the other. We have a Dutch saying: "Als een boer niet kan zwemmen ligt het aan zijn zwembroek", which translates to something like: "If a farmer can't swim it's because of his swimming trunks". If you want out-of-the-box VPN solutions, you go to a VPN provider and download their apps. ;-o
  - chousuke 5y ago
    But there's no value in IPsec being like a piano. Continuing the analogue, nearly everyone would be playing the exact same handful of songs in the exact same way and if they don't, they're doing it wrong. Why on earth do you have to learn to play an instrument like that? You don't want core pieces of security technology to have room for creativity.
    - j3th9n 5y ago
      Yes, I guess the analogy has its limits. (-: The only point I'm trying to make is that no VPN protocol is an out-of-the-box solution. And mind you, I'm talking about the protocol, the out of the box solution "Tailscale" is not a protocol for example, it's an app with WireGuard at its core with added proprietary functionality to make it work out-of-the-box. WireGuard as a protocol is possibly the easiest to setup, IPSec/IKEv2 might be the most challenging to setup. On the other hand WireGuard has limited capabilities, IPSec/IKEv2 has a bit more. More capabilities for IPSec/IKEv2 comes with more study and practice.
  - kortilla 5y ago
    > IPSec/IKEv2 is not breaking anything, Yes it does. It’s trivial to screw up the configuration into broken security.
    - j3th9n 5y ago
      Then it's you breaking things because of lack of understanding, not IPSec/IKEv2. The same way no dishwasher is going to break plates, unless you throw them in with force yourself.
      - nucleardog 5y ago
        Okay, how about a different analogy then. Seatbelts. Wireguard is a seatbelt where you plug the latch plate into the buckle, it lets out an audible "click" and you're secured. If you fail to secure it properly, the latch plate will not be held by the buckle and will retract. It will be immediately obvious that you aren't secured and the car will refuse to move until the problem is resolved. IPSec is a seatbelt where the process of putting the latch plate into the buckle requires adjusting several knobs on the buckle to the correct setting depending on your specific size and weight and then placing the latch plate into the buckle at the _exact_ right angle. The settings of these knobs and the angle required differs slightly or significantly between manufacturers as well as model years. With the IPSec seatbelt, failing to perform these steps correctly often results in the buckle failing to engage and the car failing to start. But sometimes it also results in the buckle letting out a "click" and appearing to be latched while not being properly engaged and able to protect you in a crash. This counts as buckled as far as the car is concerned though and it's happy to let you drive this way. Well what if I _want_ to drive around with only the appearance of a seatbelt without the safety of it, huh? Wireguard won't let me do that! Sure, there are _very_ specific situations where IPSec is the only option to implement what we need. Great, I'm glad it exists to cover off those use cases. But when everyone's getting the common case wrong in subtle and dangerous ways, the answer isn't "well, it's as complicated as brain surgery get good scrub" (I can't imagine how you think that's a defense of IPSec.). It's possible to design a system that allows a secure tunnel _without_ the complexity and massive number of footguns (see: wireguard). For most use cases, that makes IPSec defective by design. If GM designed their cars to have as many buttons and knobs as a 747 cockpit, they would never make it to market. Manufacturers have been forced to recall vehicles for much less[0]. By all means, continue to use it, but expecting people to learn brain surgery to set up a secure tunnel is and should be a non-starter. [0] https://www.consumerreports.org/car-safety/fca-recalls-confusing-shifters-in-chrysler-dodge-jeep/ https://www.consumerreports.org/car-safety/fca-recalls-confu...
WesolyKubeczek 5y ago
I'm using IPSec for my homelab/roadwarrior setup, and that's explicitly because Linux, macOS, and iOS can all use it right out of the box without any "apps" to install. The only gripe I have is that StrongSwan is not a particularly easy piece of software to set up and debug when your tunnels suddenly go pear-shaped. I'd say they are a textbook example on how to screw things up when introducing a whole new set of daemons and configuration format, while a multi-year body of knowledge and corner cases exists only for the old format.
otterley 5y ago
This sounds like network security gatekeeping to me. Tailscale and others are trying to make things easier for most people while preserving high security. This is a noble effort IMO.
- j3th9n 5y ago
  I had other intentions with my comment than what you insinuate.
- saurik 5y ago
  I mean, the exact opposite is also true? The Wireguard camp is always essentially claiming that everyone not using Wireguard is incompetent and should feel bad for not understanding how it is better, and this post to me felt like "let's make some space for people to say something good about IPsec actually solving a problem for them".
EricE 5y ago
Why study something outdated when there is a newer, modern and a lot more sane alternative out there? I can understand if you now have years worth of expertise you are invested in defending. It's selfish, but I understand your position. For anyone else? Suggesting they invest in IPSec vs. something more modern is just nuts.
- xwolfi 5y ago
  Why follow the charted map when the beautiful mermaids sing the praise of a better newer shortcut? :p
- j3th9n 5y ago
  Ok, you're not the first one blaming me for defending or gatekeeping, even calling me selfish, so I guess I need to clarify myself a bit: I love WireGuard, Tailscale does a great job making it even more "user" friendly and I'm nowhere suggesting to invest in IPSec instead of something "modern" (or do you mean something invented not longer than 3 years ago?). You're missing my point, putting words in my mouth and you seem to not know what you're talking about if you think for example WireGuard is an alternative for IPSec/IKEv2, because in a lot of cases it's not. You're even calling IPSec/IKEv2 outdated. There's a difference between the protocol and the configured crypto algorithms. If the configured algorithm is outdated, configure a modern one. If that's not possible in your device supporting IPSec/IKEv2, vote with your money and don't buy from that manufacturer. Don't blame IPSec/IKEv2 for it.
  - detaro 5y ago
    The protocol is outdated, because its design is based on ideas we now consider to be mistakes.
    - j3th9n 5y ago
      Unless there is an alternative it can't be outdated, per definition. WireGuard is not an alternative in many cases. But I get your point, it might have design mistakes (or implementations we would have done different today, while I think you are talking about IKEv1, not IKEv2), but no IPSec/IKEv2 server is left open for scriptkiddies to break, it's receiving updates when bugs are found and in this sense not outdated too. Unless you're using outdated crypto algorithms, but that's up to you. The NSA possibly has capabilities to break IPSec/IKEv2 anytime they want, but that's something we don't know about WireGuard either. If that's the case with WireGuard, it has design flaws too or bugs which aren't found yet. It's better to know about a design flaw and mitigate against it, then not knowing about it and not being able to mitigate against it.
beermonster 5y ago
IPSec is based on tens of RFCs with optional features (such as dpd in IKEv1) and more knobs than a boeing 747 cockpit. You get companies as big as AT&T setting up IKEv1 with pre-shared keys and weak crypto in 2021 by default as that’s their template offering for site-to-sites. BUT the interoperability (when it works) and the native stack implementations (Android, iOS, Windows, MacOS) though nice for admins, is only owing to it’s prevalence in enterprise rather than any superiority as a standard.
- j3th9n 5y ago
  So who is to blame? AT&T for incompetence while implementing the old IKEv1 version, or IPSec/IKEv2 for apparently not being able to be attractive enough for AT&T?

by j3th9n 5y ago

kortilla 5y ago

It’s like a dishwasher where most of the buttons cause it to not wash your dishes at all and some just break your dishes entirely. A VPN protocol shouldn’t be a kit of parts that might be able to make a secure tunnel. It should only be able to be used correctly.

j3th9n 5y ago
IPSec/IKEv2 is not breaking anything, maybe it just won't setup a tunnel. Maybe a better analogy: We don't say the same thing about for example a piano: "it should only be able to be used correctly". You have to study and practice a bit before you can play a somewhat decent piece, without study no piano play. The same for IPSec/IKEv2, without study no tunnel. Every VPN protocol needs a bit of study, maybe some protocol a bit more than the other. We have a Dutch saying: "Als een boer niet kan zwemmen ligt het aan zijn zwembroek", which translates to something like: "If a farmer can't swim it's because of his swimming trunks". If you want out-of-the-box VPN solutions, you go to a VPN provider and download their apps. ;-o
- chousuke 5y ago
  But there's no value in IPsec being like a piano. Continuing the analogue, nearly everyone would be playing the exact same handful of songs in the exact same way and if they don't, they're doing it wrong. Why on earth do you have to learn to play an instrument like that? You don't want core pieces of security technology to have room for creativity.
  - j3th9n 5y ago
    Yes, I guess the analogy has its limits. (-: The only point I'm trying to make is that no VPN protocol is an out-of-the-box solution. And mind you, I'm talking about the protocol, the out of the box solution "Tailscale" is not a protocol for example, it's an app with WireGuard at its core with added proprietary functionality to make it work out-of-the-box. WireGuard as a protocol is possibly the easiest to setup, IPSec/IKEv2 might be the most challenging to setup. On the other hand WireGuard has limited capabilities, IPSec/IKEv2 has a bit more. More capabilities for IPSec/IKEv2 comes with more study and practice.
- kortilla 5y ago
  > IPSec/IKEv2 is not breaking anything, Yes it does. It’s trivial to screw up the configuration into broken security.
  - j3th9n 5y ago
    Then it's you breaking things because of lack of understanding, not IPSec/IKEv2. The same way no dishwasher is going to break plates, unless you throw them in with force yourself.
    - nucleardog 5y ago
      Okay, how about a different analogy then. Seatbelts. Wireguard is a seatbelt where you plug the latch plate into the buckle, it lets out an audible "click" and you're secured. If you fail to secure it properly, the latch plate will not be held by the buckle and will retract. It will be immediately obvious that you aren't secured and the car will refuse to move until the problem is resolved. IPSec is a seatbelt where the process of putting the latch plate into the buckle requires adjusting several knobs on the buckle to the correct setting depending on your specific size and weight and then placing the latch plate into the buckle at the _exact_ right angle. The settings of these knobs and the angle required differs slightly or significantly between manufacturers as well as model years. With the IPSec seatbelt, failing to perform these steps correctly often results in the buckle failing to engage and the car failing to start. But sometimes it also results in the buckle letting out a "click" and appearing to be latched while not being properly engaged and able to protect you in a crash. This counts as buckled as far as the car is concerned though and it's happy to let you drive this way. Well what if I _want_ to drive around with only the appearance of a seatbelt without the safety of it, huh? Wireguard won't let me do that! Sure, there are _very_ specific situations where IPSec is the only option to implement what we need. Great, I'm glad it exists to cover off those use cases. But when everyone's getting the common case wrong in subtle and dangerous ways, the answer isn't "well, it's as complicated as brain surgery get good scrub" (I can't imagine how you think that's a defense of IPSec.). It's possible to design a system that allows a secure tunnel _without_ the complexity and massive number of footguns (see: wireguard). For most use cases, that makes IPSec defective by design. If GM designed their cars to have as many buttons and knobs as a 747 cockpit, they would never make it to market. Manufacturers have been forced to recall vehicles for much less[0]. By all means, continue to use it, but expecting people to learn brain surgery to set up a secure tunnel is and should be a non-starter. [0] https://www.consumerreports.org/car-safety/fca-recalls-confusing-shifters-in-chrysler-dodge-jeep/ https://www.consumerreports.org/car-safety/fca-recalls-confu...

WesolyKubeczek 5y ago

I'm using IPSec for my homelab/roadwarrior setup, and that's explicitly because Linux, macOS, and iOS can all use it right out of the box without any "apps" to install. The only gripe I have is that StrongSwan is not a particularly easy piece of software to set up and debug when your tunnels suddenly go pear-shaped. I'd say they are a textbook example on how to screw things up when introducing a whole new set of daemons and configuration format, while a multi-year body of knowledge and corner cases exists only for the old format.

otterley 5y ago

This sounds like network security gatekeeping to me. Tailscale and others are trying to make things easier for most people while preserving high security. This is a noble effort IMO.

j3th9n 5y ago
I had other intentions with my comment than what you insinuate.
saurik 5y ago
I mean, the exact opposite is also true? The Wireguard camp is always essentially claiming that everyone not using Wireguard is incompetent and should feel bad for not understanding how it is better, and this post to me felt like "let's make some space for people to say something good about IPsec actually solving a problem for them".

EricE 5y ago

Why study something outdated when there is a newer, modern and a lot more sane alternative out there? I can understand if you now have years worth of expertise you are invested in defending. It's selfish, but I understand your position. For anyone else? Suggesting they invest in IPSec vs. something more modern is just nuts.

xwolfi 5y ago
Why follow the charted map when the beautiful mermaids sing the praise of a better newer shortcut? :p
j3th9n 5y ago
Ok, you're not the first one blaming me for defending or gatekeeping, even calling me selfish, so I guess I need to clarify myself a bit: I love WireGuard, Tailscale does a great job making it even more "user" friendly and I'm nowhere suggesting to invest in IPSec instead of something "modern" (or do you mean something invented not longer than 3 years ago?). You're missing my point, putting words in my mouth and you seem to not know what you're talking about if you think for example WireGuard is an alternative for IPSec/IKEv2, because in a lot of cases it's not. You're even calling IPSec/IKEv2 outdated. There's a difference between the protocol and the configured crypto algorithms. If the configured algorithm is outdated, configure a modern one. If that's not possible in your device supporting IPSec/IKEv2, vote with your money and don't buy from that manufacturer. Don't blame IPSec/IKEv2 for it.
- detaro 5y ago
  The protocol is outdated, because its design is based on ideas we now consider to be mistakes.
  - j3th9n 5y ago
    Unless there is an alternative it can't be outdated, per definition. WireGuard is not an alternative in many cases. But I get your point, it might have design mistakes (or implementations we would have done different today, while I think you are talking about IKEv1, not IKEv2), but no IPSec/IKEv2 server is left open for scriptkiddies to break, it's receiving updates when bugs are found and in this sense not outdated too. Unless you're using outdated crypto algorithms, but that's up to you. The NSA possibly has capabilities to break IPSec/IKEv2 anytime they want, but that's something we don't know about WireGuard either. If that's the case with WireGuard, it has design flaws too or bugs which aren't found yet. It's better to know about a design flaw and mitigate against it, then not knowing about it and not being able to mitigate against it.

beermonster 5y ago

IPSec is based on tens of RFCs with optional features (such as dpd in IKEv1) and more knobs than a boeing 747 cockpit. You get companies as big as AT&T setting up IKEv1 with pre-shared keys and weak crypto in 2021 by default as that’s their template offering for site-to-sites. BUT the interoperability (when it works) and the native stack implementations (Android, iOS, Windows, MacOS) though nice for admins, is only owing to it’s prevalence in enterprise rather than any superiority as a standard.

j3th9n 5y ago
So who is to blame? AT&T for incompetence while implementing the old IKEv1 version, or IPSec/IKEv2 for apparently not being able to be attractive enough for AT&T?