7 ms·

Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

351 points by devStorms 3y ago

hkwerf 3y ago
Link was probably supposed to be https://im.salty.fish/index.php/archives/linux-networking-shallow-dive.html https://im.salty.fish/index.php/archives/linux-networking-sh....
- devStorms 3y ago
  Yup thanks for pointing out. There was an issue with the canonical link meta tag. Should be fixed now :)
- dang 3y ago
  Fixed above. Thanks!
sushidev 3y ago
nice
sushidev 3y ago
i agree it's very hard to learn from the internet.. (the bottomline in the post)
- harry8 3y ago
  It was incredibly so much easier when popular search engines did search instead of "recommendation." The hardest thing is actually finding the thing that exists, in multiple forms, that you set out to find. We've gone backwards in the past 15 years.
litia 3y ago
tql
jmclnx 3y ago
For people using wireguard, it was not designed to provide anonymity. Otherwise it is fine for use in Countries with decent protections for their citizens. If you need privacy, you should use OpenVPN. Quote: >WireGuard is highly secure, but it’s not designed with privacy in mind. from https://www.tomsguide.com/how-to/is-the-new-wireguard-protocol-secure https://www.tomsguide.com/how-to/is-the-new-wireguard-protoc...
- jbverschoor 3y ago
  Almost nothing was created with privacy in mind. Security and privacy are different things. I hate that people think that a VPN is private as in anonymous. But then again, those providers had great marketing.. So now devs and sysops need to call VPNs "tunneled networks".
- nixcraft 3y ago
  > WireGuard is highly secure, but it’s not designed with privacy in mind. I'm sorry, but I must inform you that the Toms guide contains affiliate links to OpenVPN services. However, it is important to note that neither OpenVPN nor WireGuard can guarantee your safety if you are being targeted by government agencies. The guide's attempt from TFA is to promote these VPN services as a solution for anonymity and censorship (deep packets inspection can block all VPN protocols) avoidance is misleading. VPNs are primarily useful for accessing corporate or home resources and viewing geo-blocked streaming content (say from your home network) on insecure networks like hotel or cafe WiFi.
- freedomben 3y ago
  You're not wrong, but there are VPN services that add on privacy to their wireguard offerings, such as PIA (private internet access). They open sourced the connection code so you can see how they do it[1] using an API that initializes a temporary wireguard connection for you. I've been really pleased with PIA's wireguard setup, which even includes forwarding of an incoming port! [1]: https://github.com/pia-foss/manual-connections/blob/master/connect_to_wireguard_with_token.sh https://github.com/pia-foss/manual-connections/blob/master/c...
- icehawk 3y ago
systems_glitch 3y ago
We recently switched a bunch of stuff from OpenVPN to Wireguard. A number of the links were OpenVPN layer 2 tunnels to pass, of all things, Novell Netware running on IPX (the particular situation precludes switching to TCP/IP for those customers). Now, layer 2 tunneling is being performed using RFC 3378 EtherIP, and it's much more performant, not to mention easier to manage. Old and new systems are running OpenBSD.
- deleted 3y ago
  [deleted]
- generalizations 3y ago
  If you have a write up of how you managed to get layer 2 working inside wireguard, I'd love to read it.
  - FL410 3y ago
    Me too.
  - usui 3y ago
    Since WireGuard is Layer 3, what would is everyone's use case of doing Layer 2 on it? Or, what can it improve over existing solutions? I have tried to do the same for a bit while still learning networking, but ran into Layer 3 limitations.
    - zokier 3y ago
      One example usecase would be to try to tunnel something like BOOTP/DHCP/PXE/TFTP stack, which iirc is bit tricky with only L3 tunneling.
      - simonjgreen 3y ago
        Yes, this is common among those who don't understand how DHCP Relay works
Snawoot 3y ago
Or instead you can have HTTP proxy over TLS in just four steps: https://github.com/Snawoot/dumbproxy/wiki/Quick-deployment https://github.com/Snawoot/dumbproxy/wiki/Quick-deployment You don't even need a client for this, any modern browser can work with it right away: https://github.com/Snawoot/dumbproxy#using-http-over-tls-proxy https://github.com/Snawoot/dumbproxy#using-http-over-tls-pro...
garbagecoder 3y ago
I just moved from OpenVPN to tailscale, which uses Wireguard, on my personal stuff. I have a similar situation as OP describes at first where my residential account has the ports blocked. I am quite happy so far, just wish it was innately supported in my consumer grade router, which support vanilla wireguard.
- manmal 3y ago
  I thought tailscale works through all kinds of firewalls due to some connection setup magic (initiating connection from both sides at once). EDIT: I think I misunderstood your comment, you probably are wishing for tailscale client support in the router?
- nirav72 3y ago
  >consumer grade router, which support vanilla wireguard. See if your consumer grade router supports flashing OpenWRT. It supports Wireguard.
  - garbagecoder 3y ago
    It doesn't, really. It's an AX-82 and there's only a hackish version for it.
1970-01-01 3y ago
>I always felt, and still feel, that applied Linux networking is difficult to get started with, mainly due to lack of good guidance. Most of the time I had to dig through small pieces of documentation scattered throughout the internet, trying to put them together to form a systematic overview of the network stack in Linux. ... >It is extremely frustrating when somebody interested in setting up their own network infrastructure has to at some point get stuck at some convoluted networking concepts, intricate and abstract tools, mysterious errors here and there, or lack of systematic documentation. I wish everyone has some choices other than spending days and weeks trying to figure these out alone, so I decided to write down what I have done, what I have learned and what I have to share with the rest of the internet. I sincerely hope that some day IT operations would be more beginner-friendly, and hosting one's own network infrastructure no longer means headache and mess. These are exactly my feelings. Stinky.fish makes more sense for a Linux blog. Everything about it stinks until it actually works. :)
- slacka 3y ago
  I experienced this back when I configured my home Linux boxes as a router, VPN server, firewall, media server, etc. Since I had the time, compiled all of the info I found on random blogs and sites and added them to the Ubuntu Community wiki. That was the 12.x days, when Ubuntu was in its prime and the distro to use. While these blogs were a great resource, I often found the commands outdated or applied to a different distro. A distro specific wiki solves both those issue. While I don't get the glory of a blog, I just checked an it's nice to see my notes still there for future Denvercoder9's.
  - gerdesj 3y ago
    Ahhh, it sounds like you've only done this once. I started off with ipfw, then ipchains, then iptables and now whatever firewalld supports. OK that's roughly 25 years so not too much firewalling churn! I stopped hand rolling my own rule sets with ipchains and switched to generators and there are loads of them. For me some of the problems nowadays are caused by search engine manipulation. Up until around five or so years ago Linux concept searches would get you pointed at the usual big hitters - Arch/Gentoo/Ubuntu/etc wikis and useful and quite well known blogs. My modern block list for ublacklist is huge and barely scratches the surface. Now I come to think of it, we now have ChatGPT and I bet it can roll a decent ruleset without hallucinating madly. No doubt someone will soon be Showing HN: their smart new firewall prompt generator language for <insert AI here>. It will make the LLM use Rust as an intermediary for extra safety.
mulmen 3y ago
Meta: Huh. I don’t use “shallow dive” enough. “Deep dive” of course, everyone loves a good deep dive. But what about a shallow dive, or even just “getting your feet wet”? These are useful concepts too. This headline alone revealed a blind spot for me.
- bryancoxwell 3y ago
  Had the same thought. Could do with more shallow dives to be honest.
- kagevf 3y ago
  Maybe we can expand X in Y minutes beyond programming languages?
igtztorrero 3y ago
UPS and Downs a chinesse programmer should do. Hosting is prohibited in CN It would be interesting to make a Github repo titled: how to hack CN goverment !
jarym 3y ago
Dumb question but the frp example shows op forwarding to port 443 on local, how then did the spammers get access to port 25 or was there a separate forward rule setup for 25?
yrro 3y ago
> We will be using the local IPv6 addresses fc00::/7 for routing inside our WireGuard network. For example, if we use the subnet fc00:0:0:160::/64, this can be the new Address config on Server: > Address = 192.168.160.2, fc00:0:0:160::2 Please don't do this. fc00::/7 has been assigned for "Unique Local Unicast" and address ranges must be generated as specified in RFC 4193: https://www.google.com/search?hl=en&q=ipv6%20ula%20generator https://www.google.com/search?hl=en&q=ipv6%20ula%20generator
ttsiodras 3y ago
signal-to-noise ratio: off the charts. Many thanks, OP.

351 points by devStorms 3y ago

Link was probably supposed to be https://im.salty.fish/index.php/archives/linux-networking-shallow-dive.html https://im.salty.fish/index.php/archives/linux-networking-sh....

devStorms 3y ago
Yup thanks for pointing out. There was an issue with the canonical link meta tag. Should be fixed now :)
dang 3y ago
Fixed above. Thanks!

sushidev 3y ago

nice

sushidev 3y ago

i agree it's very hard to learn from the internet.. (the bottomline in the post)

harry8 3y ago
It was incredibly so much easier when popular search engines did search instead of "recommendation." The hardest thing is actually finding the thing that exists, in multiple forms, that you set out to find. We've gone backwards in the past 15 years.

litia 3y ago

tql

jmclnx 3y ago

For people using wireguard, it was not designed to provide anonymity. Otherwise it is fine for use in Countries with decent protections for their citizens. If you need privacy, you should use OpenVPN. Quote: >WireGuard is highly secure, but it’s not designed with privacy in mind. from https://www.tomsguide.com/how-to/is-the-new-wireguard-protocol-secure https://www.tomsguide.com/how-to/is-the-new-wireguard-protoc...

jbverschoor 3y ago
Almost nothing was created with privacy in mind. Security and privacy are different things. I hate that people think that a VPN is private as in anonymous. But then again, those providers had great marketing.. So now devs and sysops need to call VPNs "tunneled networks".
nixcraft 3y ago
> WireGuard is highly secure, but it’s not designed with privacy in mind. I'm sorry, but I must inform you that the Toms guide contains affiliate links to OpenVPN services. However, it is important to note that neither OpenVPN nor WireGuard can guarantee your safety if you are being targeted by government agencies. The guide's attempt from TFA is to promote these VPN services as a solution for anonymity and censorship (deep packets inspection can block all VPN protocols) avoidance is misleading. VPNs are primarily useful for accessing corporate or home resources and viewing geo-blocked streaming content (say from your home network) on insecure networks like hotel or cafe WiFi.
freedomben 3y ago
You're not wrong, but there are VPN services that add on privacy to their wireguard offerings, such as PIA (private internet access). They open sourced the connection code so you can see how they do it[1] using an API that initializes a temporary wireguard connection for you. I've been really pleased with PIA's wireguard setup, which even includes forwarding of an incoming port! [1]: https://github.com/pia-foss/manual-connections/blob/master/connect_to_wireguard_with_token.sh https://github.com/pia-foss/manual-connections/blob/master/c...
icehawk 3y ago

systems_glitch 3y ago

We recently switched a bunch of stuff from OpenVPN to Wireguard. A number of the links were OpenVPN layer 2 tunnels to pass, of all things, Novell Netware running on IPX (the particular situation precludes switching to TCP/IP for those customers). Now, layer 2 tunneling is being performed using RFC 3378 EtherIP, and it's much more performant, not to mention easier to manage. Old and new systems are running OpenBSD.

deleted 3y ago
[deleted]
generalizations 3y ago
If you have a write up of how you managed to get layer 2 working inside wireguard, I'd love to read it.
- FL410 3y ago
  Me too.
- usui 3y ago
  Since WireGuard is Layer 3, what would is everyone's use case of doing Layer 2 on it? Or, what can it improve over existing solutions? I have tried to do the same for a bit while still learning networking, but ran into Layer 3 limitations.
  - zokier 3y ago
    One example usecase would be to try to tunnel something like BOOTP/DHCP/PXE/TFTP stack, which iirc is bit tricky with only L3 tunneling.
    - simonjgreen 3y ago
      Yes, this is common among those who don't understand how DHCP Relay works

Snawoot 3y ago

Or instead you can have HTTP proxy over TLS in just four steps: https://github.com/Snawoot/dumbproxy/wiki/Quick-deployment https://github.com/Snawoot/dumbproxy/wiki/Quick-deployment You don't even need a client for this, any modern browser can work with it right away: https://github.com/Snawoot/dumbproxy#using-http-over-tls-proxy https://github.com/Snawoot/dumbproxy#using-http-over-tls-pro...

garbagecoder 3y ago

I just moved from OpenVPN to tailscale, which uses Wireguard, on my personal stuff. I have a similar situation as OP describes at first where my residential account has the ports blocked. I am quite happy so far, just wish it was innately supported in my consumer grade router, which support vanilla wireguard.

manmal 3y ago
I thought tailscale works through all kinds of firewalls due to some connection setup magic (initiating connection from both sides at once). EDIT: I think I misunderstood your comment, you probably are wishing for tailscale client support in the router?
nirav72 3y ago
>consumer grade router, which support vanilla wireguard. See if your consumer grade router supports flashing OpenWRT. It supports Wireguard.
- garbagecoder 3y ago
  It doesn't, really. It's an AX-82 and there's only a hackish version for it.

1970-01-01 3y ago

>I always felt, and still feel, that applied Linux networking is difficult to get started with, mainly due to lack of good guidance. Most of the time I had to dig through small pieces of documentation scattered throughout the internet, trying to put them together to form a systematic overview of the network stack in Linux. ... >It is extremely frustrating when somebody interested in setting up their own network infrastructure has to at some point get stuck at some convoluted networking concepts, intricate and abstract tools, mysterious errors here and there, or lack of systematic documentation. I wish everyone has some choices other than spending days and weeks trying to figure these out alone, so I decided to write down what I have done, what I have learned and what I have to share with the rest of the internet. I sincerely hope that some day IT operations would be more beginner-friendly, and hosting one's own network infrastructure no longer means headache and mess. These are exactly my feelings. Stinky.fish makes more sense for a Linux blog. Everything about it stinks until it actually works. :)

slacka 3y ago
I experienced this back when I configured my home Linux boxes as a router, VPN server, firewall, media server, etc. Since I had the time, compiled all of the info I found on random blogs and sites and added them to the Ubuntu Community wiki. That was the 12.x days, when Ubuntu was in its prime and the distro to use. While these blogs were a great resource, I often found the commands outdated or applied to a different distro. A distro specific wiki solves both those issue. While I don't get the glory of a blog, I just checked an it's nice to see my notes still there for future Denvercoder9's.
- gerdesj 3y ago
  Ahhh, it sounds like you've only done this once. I started off with ipfw, then ipchains, then iptables and now whatever firewalld supports. OK that's roughly 25 years so not too much firewalling churn! I stopped hand rolling my own rule sets with ipchains and switched to generators and there are loads of them. For me some of the problems nowadays are caused by search engine manipulation. Up until around five or so years ago Linux concept searches would get you pointed at the usual big hitters - Arch/Gentoo/Ubuntu/etc wikis and useful and quite well known blogs. My modern block list for ublacklist is huge and barely scratches the surface. Now I come to think of it, we now have ChatGPT and I bet it can roll a decent ruleset without hallucinating madly. No doubt someone will soon be Showing HN: their smart new firewall prompt generator language for <insert AI here>. It will make the LLM use Rust as an intermediary for extra safety.

mulmen 3y ago

Meta: Huh. I don’t use “shallow dive” enough. “Deep dive” of course, everyone loves a good deep dive. But what about a shallow dive, or even just “getting your feet wet”? These are useful concepts too. This headline alone revealed a blind spot for me.

bryancoxwell 3y ago
Had the same thought. Could do with more shallow dives to be honest.
kagevf 3y ago
Maybe we can expand X in Y minutes beyond programming languages?

igtztorrero 3y ago

UPS and Downs a chinesse programmer should do. Hosting is prohibited in CN It would be interesting to make a Github repo titled: how to hack CN goverment !

jarym 3y ago

Dumb question but the frp example shows op forwarding to port 443 on local, how then did the spammers get access to port 25 or was there a separate forward rule setup for 25?

yrro 3y ago

> We will be using the local IPv6 addresses fc00::/7 for routing inside our WireGuard network. For example, if we use the subnet fc00:0:0:160::/64, this can be the new Address config on Server: > Address = 192.168.160.2, fc00:0:0:160::2 Please don't do this. fc00::/7 has been assigned for "Unique Local Unicast" and address ranges must be generated as specified in RFC 4193: https://www.google.com/search?hl=en&q=ipv6%20ula%20generator https://www.google.com/search?hl=en&q=ipv6%20ula%20generator

ttsiodras 3y ago

signal-to-noise ratio: off the charts. Many thanks, OP.