3 ms·

I'm torn on WireGuard. Getting it set up was really easy. I think it took about an hour, which included standing up a new OpenBSD VM to run the server. Confi

I'm torn on WireGuard. Getting it set up was really easy. I think it took about an hour, which included standing up a new OpenBSD VM to run the server. Configuring clients (iOS) was pretty straight-forward and reasonable. I don't have a feeling that there's some security hole lurking in the configuration simply because there's not a lot to get wrong. In comparison, IKEv2/IPSec was incredibly painful, especially when you also create configuration profiles for iOS and have to issue and distribute certificates. Once I understood how it worked it made some sense, but there's always that nagging feeling that I've screwed up the configuration because there's just so many options to get wrong. I've probably spent six hours, not all at once of course, getting it working and set up "just so." In spite of all of this, I'm continuing to use my IKEv2/IPSec setup. I have not figured out how to get WireGuard to do split DNS, whereas this was a fairly simple part of the IKEv2/IPSec setup. The other requirement I have is split tunnels, but I think WireGuard can do that fairly easily.

fl0id 4y ago
That's what Tailscale is for. Sure, it adds another layer that you might not like. But underneath it is all Wireguard and at least most of it (not sure if all of it) is also open-source. In fact, the OP post was written by a Tailscale guy apparently.
- Mister_Snuggles 4y ago
  Tailscale deals with the things that the IKEv2 part of IKEv2/IPSec handles. It's not a perfect mapping as Tailscale/Wireguard is different that IKEv2/IPSec. Apart from being a 3rd-party service, which isn't really what I want, it seems to check all of the boxes. The documentation is very thin on the iOS side, but it seems likely that the iOS app can do everything that can be configured in the admin console. That configuration does seem to meet my requirements. Is there a self-hosted Tailscale-like option? The only other thing is automatic connection. In my IKEv2/IPSec setup, I've build configuration profiles for the iOS devices so that they'll establish a connection on-demand (triggered by a DNS lookup for my internal domain), but only when they're not on my home Wifi network. It's perfectly seamless since it's all built-in to iOS. The Wireguard app seems to deal with the "connect when not on home Wifi" part, but doesn't do the on-demand side. Wireguard is light enough that this may not actually matter though.

fl0id 4y ago

That's what Tailscale is for. Sure, it adds another layer that you might not like. But underneath it is all Wireguard and at least most of it (not sure if all of it) is also open-source. In fact, the OP post was written by a Tailscale guy apparently.

Mister_Snuggles 4y ago
Tailscale deals with the things that the IKEv2 part of IKEv2/IPSec handles. It's not a perfect mapping as Tailscale/Wireguard is different that IKEv2/IPSec. Apart from being a 3rd-party service, which isn't really what I want, it seems to check all of the boxes. The documentation is very thin on the iOS side, but it seems likely that the iOS app can do everything that can be configured in the admin console. That configuration does seem to meet my requirements. Is there a self-hosted Tailscale-like option? The only other thing is automatic connection. In my IKEv2/IPSec setup, I've build configuration profiles for the iOS devices so that they'll establish a connection on-demand (triggered by a DNS lookup for my internal domain), but only when they're not on my home Wifi network. It's perfectly seamless since it's all built-in to iOS. The Wireguard app seems to deal with the "connect when not on home Wifi" part, but doesn't do the on-demand side. Wireguard is light enough that this may not actually matter though.