5 ms·

> WireGuard is a great demonstration of why the total complexity of the implementation ends up affecting the UX of the product. This is absolutely true! Proba

> WireGuard is a great demonstration of why the total complexity of the implementation ends up affecting the UX of the product. This is absolutely true! Probably everything you could do with WireGuard you could accomplish with OpenSSL/OpenVPN, but the complexity is staggering. This makes it much more difficult to troubleshoot and far more likely that there will be an error in the configuration that could lead to compromise.

onehair 4y ago
For my simple road warrior setup, 8 lines that are clearly understandable were all it took in wireguard. OpenVPN was always a nightmare
RedShift1 4y ago
I wish more developers would work on this, making sure their product works straight out of the box. Lots of software requires setting up additional things like Redis, an SQL server, Docker, a proxy server, etc... All those things are in most cases unnecessary. I understand that for high load scenarios they are needed but for small time setups it's just overkill. Make it run with sane defaults and when the time comes to scale up, then those other things can be added.
- javajosh 4y ago
  That's a bit like saying "I wish more musicians would write hits more often." Talent and luck is the bottleneck as much as good taste. Certainly its not developer ignorance about what good software feels like.
Mister_Snuggles 4y ago
I'm torn on WireGuard. Getting it set up was really easy. I think it took about an hour, which included standing up a new OpenBSD VM to run the server. Configuring clients (iOS) was pretty straight-forward and reasonable. I don't have a feeling that there's some security hole lurking in the configuration simply because there's not a lot to get wrong. In comparison, IKEv2/IPSec was incredibly painful, especially when you also create configuration profiles for iOS and have to issue and distribute certificates. Once I understood how it worked it made some sense, but there's always that nagging feeling that I've screwed up the configuration because there's just so many options to get wrong. I've probably spent six hours, not all at once of course, getting it working and set up "just so." In spite of all of this, I'm continuing to use my IKEv2/IPSec setup. I have not figured out how to get WireGuard to do split DNS, whereas this was a fairly simple part of the IKEv2/IPSec setup. The other requirement I have is split tunnels, but I think WireGuard can do that fairly easily.
- fl0id 4y ago
  That's what Tailscale is for. Sure, it adds another layer that you might not like. But underneath it is all Wireguard and at least most of it (not sure if all of it) is also open-source. In fact, the OP post was written by a Tailscale guy apparently.
  - Mister_Snuggles 4y ago
    Tailscale deals with the things that the IKEv2 part of IKEv2/IPSec handles. It's not a perfect mapping as Tailscale/Wireguard is different that IKEv2/IPSec. Apart from being a 3rd-party service, which isn't really what I want, it seems to check all of the boxes. The documentation is very thin on the iOS side, but it seems likely that the iOS app can do everything that can be configured in the admin console. That configuration does seem to meet my requirements. Is there a self-hosted Tailscale-like option? The only other thing is automatic connection. In my IKEv2/IPSec setup, I've build configuration profiles for the iOS devices so that they'll establish a connection on-demand (triggered by a DNS lookup for my internal domain), but only when they're not on my home Wifi network. It's perfectly seamless since it's all built-in to iOS. The Wireguard app seems to deal with the "connect when not on home Wifi" part, but doesn't do the on-demand side. Wireguard is light enough that this may not actually matter though.

onehair 4y ago

For my simple road warrior setup, 8 lines that are clearly understandable were all it took in wireguard. OpenVPN was always a nightmare

RedShift1 4y ago

I wish more developers would work on this, making sure their product works straight out of the box. Lots of software requires setting up additional things like Redis, an SQL server, Docker, a proxy server, etc... All those things are in most cases unnecessary. I understand that for high load scenarios they are needed but for small time setups it's just overkill. Make it run with sane defaults and when the time comes to scale up, then those other things can be added.

javajosh 4y ago
That's a bit like saying "I wish more musicians would write hits more often." Talent and luck is the bottleneck as much as good taste. Certainly its not developer ignorance about what good software feels like.

Mister_Snuggles 4y ago

I'm torn on WireGuard. Getting it set up was really easy. I think it took about an hour, which included standing up a new OpenBSD VM to run the server. Configuring clients (iOS) was pretty straight-forward and reasonable. I don't have a feeling that there's some security hole lurking in the configuration simply because there's not a lot to get wrong. In comparison, IKEv2/IPSec was incredibly painful, especially when you also create configuration profiles for iOS and have to issue and distribute certificates. Once I understood how it worked it made some sense, but there's always that nagging feeling that I've screwed up the configuration because there's just so many options to get wrong. I've probably spent six hours, not all at once of course, getting it working and set up "just so." In spite of all of this, I'm continuing to use my IKEv2/IPSec setup. I have not figured out how to get WireGuard to do split DNS, whereas this was a fairly simple part of the IKEv2/IPSec setup. The other requirement I have is split tunnels, but I think WireGuard can do that fairly easily.

fl0id 4y ago
That's what Tailscale is for. Sure, it adds another layer that you might not like. But underneath it is all Wireguard and at least most of it (not sure if all of it) is also open-source. In fact, the OP post was written by a Tailscale guy apparently.
- Mister_Snuggles 4y ago
  Tailscale deals with the things that the IKEv2 part of IKEv2/IPSec handles. It's not a perfect mapping as Tailscale/Wireguard is different that IKEv2/IPSec. Apart from being a 3rd-party service, which isn't really what I want, it seems to check all of the boxes. The documentation is very thin on the iOS side, but it seems likely that the iOS app can do everything that can be configured in the admin console. That configuration does seem to meet my requirements. Is there a self-hosted Tailscale-like option? The only other thing is automatic connection. In my IKEv2/IPSec setup, I've build configuration profiles for the iOS devices so that they'll establish a connection on-demand (triggered by a DNS lookup for my internal domain), but only when they're not on my home Wifi network. It's perfectly seamless since it's all built-in to iOS. The Wireguard app seems to deal with the "connect when not on home Wifi" part, but doesn't do the on-demand side. Wireguard is light enough that this may not actually matter though.