4 ms·

Is there a significant difference between doing HTTP over TLS vs HTTP over WireGuard? I enjoy WireGuard and it's tooling but in this case TLS seems like the be

Is there a significant difference between doing HTTP over TLS vs HTTP over WireGuard? I enjoy WireGuard and it's tooling but in this case TLS seems like the better, battle tested option without any significant downsides if all you are doing is HTTP anyways...

tiernano 4y ago
I see this as a handy option for 2 way comms. How much power it would use is a different question.
nicexe 4y ago
The point of WireGuard is to set up a VPN across the services you need. You could use it for point-to-point connections but it does much more than that.
adriancr 4y ago
One use case is probably as gateway, I could put IRC on it and wireguard and have an emergency entry into a network.
- guestbest 4y ago
  How is IRC a gateway?
  - adriancr 4y ago
    use IRC to give it commands and see logs so vpn is not always on (i.e: when you want vpn, you tell it to connect to an external IP, perhaps spin up a vm for that). Don't expose it directly as it would be easy to flood it into submission in addition to it being insecure. Once connected - use it to tunnel traffic back to network. Anything else would work though (telegram/cloudflare tunnels/...), It's just what I would use.
okso 4y ago
WireGuard supports TCP and UDP directly, which allows securing MQTT or AMQP directly without adding an extra layer of HTTP/QUIC. Certification also works differently: TLS (and OpenVPN) rely on Certificate Authorities while WireGuard relies directly on the public key of hosts. This has implications in how trust is managed in the network.
- svetb 4y ago
  > WireGuard supports TCP and UDP directly, which allows securing MQTT or AMQP directly without adding an extra layer of HTTP/QUIC. MQTT over TLS is pretty standard, and supported out of the box by virtually all clients/brokers. I suspect the same is true for AMQP. Some time ago I did a set of benchmarks of MQTT+TLS vs MQTT+WireGuard. Although I was rooting for WireGuard to blow TLS out of the water, the overall bandwidth requirements are quite similar. Under normal conditions WireGuard overhead is a bit higher than TLS, though various network pathologies can swing things the other way. The main one being roaming: if the client frequently switches networks, WG tends to handle this far more gracefully than TLS (not surprising given the underlying design and protocols). In short, TLS can actually be made to work really well in a context like this - I jotted some notes on an optimal setup here: https://medium.com/p/b880285da526 https://medium.com/p/b880285da526 Beyond this, there are some really interesting efforts to unify MQTT and QUIC - from an architectural perspective I feel like that’s the future for IoT comms. (https://www.emqx.com/en/blog/getting-started-with-mqtt-over-quic-from-scratch https://www.emqx.com/en/blog/getting-started-with-mqtt-over-...)

tiernano 4y ago

I see this as a handy option for 2 way comms. How much power it would use is a different question.

nicexe 4y ago

The point of WireGuard is to set up a VPN across the services you need. You could use it for point-to-point connections but it does much more than that.

adriancr 4y ago

One use case is probably as gateway, I could put IRC on it and wireguard and have an emergency entry into a network.

guestbest 4y ago
How is IRC a gateway?
- adriancr 4y ago
  use IRC to give it commands and see logs so vpn is not always on (i.e: when you want vpn, you tell it to connect to an external IP, perhaps spin up a vm for that). Don't expose it directly as it would be easy to flood it into submission in addition to it being insecure. Once connected - use it to tunnel traffic back to network. Anything else would work though (telegram/cloudflare tunnels/...), It's just what I would use.

okso 4y ago

WireGuard supports TCP and UDP directly, which allows securing MQTT or AMQP directly without adding an extra layer of HTTP/QUIC. Certification also works differently: TLS (and OpenVPN) rely on Certificate Authorities while WireGuard relies directly on the public key of hosts. This has implications in how trust is managed in the network.

svetb 4y ago
> WireGuard supports TCP and UDP directly, which allows securing MQTT or AMQP directly without adding an extra layer of HTTP/QUIC. MQTT over TLS is pretty standard, and supported out of the box by virtually all clients/brokers. I suspect the same is true for AMQP. Some time ago I did a set of benchmarks of MQTT+TLS vs MQTT+WireGuard. Although I was rooting for WireGuard to blow TLS out of the water, the overall bandwidth requirements are quite similar. Under normal conditions WireGuard overhead is a bit higher than TLS, though various network pathologies can swing things the other way. The main one being roaming: if the client frequently switches networks, WG tends to handle this far more gracefully than TLS (not surprising given the underlying design and protocols). In short, TLS can actually be made to work really well in a context like this - I jotted some notes on an optimal setup here: https://medium.com/p/b880285da526 https://medium.com/p/b880285da526 Beyond this, there are some really interesting efforts to unify MQTT and QUIC - from an architectural perspective I feel like that’s the future for IoT comms. (https://www.emqx.com/en/blog/getting-started-with-mqtt-over-quic-from-scratch https://www.emqx.com/en/blog/getting-started-with-mqtt-over-...)