4 ms·

> I always felt the disappointment of wireguard was wrapping it up into an opinionated network interface. Why? WireGuard is a VPN, it's pretty normal for VPN s

by d-z-m 3y ago

> I always felt the disappointment of wireguard was wrapping it up into an opinionated network interface. Why? WireGuard is a VPN, it's pretty normal for VPN solutions to expose themselves as a network interface. > It really should have been a generic "filter" that you could attach to any type of file handle. What's the use-case you had in mind here? I'm not sure how generifying it to a "filter" on any type of file descriptor looks for an interactive protocol like wireguard. > It's always been a weird smelling underspecified IPSEC clone to me[...] Just because there isn't an RFC? I've always found the wireguard paper[0] to be quite readable and thorough in it's specification of the protocol. [0]:https://www.wireguard.com/papers/wireguard.pdf https://www.wireguard.com/papers/wireguard.pdf

justsomehnguy 3y ago
Not the OP, but the main problem with WireGuard[0] is not the protocol[1], it's good, but the opinionated tooling around it, be it .INI style configurations (god I hate it), mutual incompatibility of wg and wg-quick or just outright stupid decisions around storing config files and interacting with the user in the Windows client. Though there are some nuances with the routing selection/filtering too, which gets troublesome when you just need a pipe and run a proper routing protocols over it. ::/0 solves most of it but still there are some rough edges. [0] well, for *me* [1] One of the amusing things I discovered what I have a full 10MB/s+ to the SMB server in the DC over the WireGuard tunnel (and that's because it's 100Mbit/s uplink), while the Synology which sits on the same router on a 1Gbit port only makes 3-5MB/s.
- aragilar 3y ago
  You don't ever need to use the configuration files, netlink on linux or the cross platform interface documented at https://www.wireguard.com/xplatform/ https://www.wireguard.com/xplatform/ mean you can write your own tooling around an existing inteface. The cryptokey routing is pretty fundamental to wireguard, I'm not sure you could have one without the other.
- vbezhenar 3y ago
  wg is low-level binary, wg-quick is high-level script wrapper. They're not supposed to have any compatibility at all. You can build any kind of high-level wrapper for wg. One of that wrappers is Network Manager, for example. My issue with wireguard is that it's not enough for full-fledged VPN solution, for example there's no way to push routes to the client or DNS configuration or something like that. Those are very basic needs. If you have 100 users and you decide to change routing scheme, well, you're in a trouble. It is supposed to be solved by higher-level protocols, but I'm not aware of any open standard-de-facto ones with quality implementations.
  - tuetuopay 3y ago
    nothing prevents you from running bgp over wireguard for route exchange. and there are many quality bgp daemons available* (* for linux and bsd)
    - vbezhenar 3y ago
      How do I configure my iPhone with BGP routes? Write my own app for VPN? Android, Windows? Linux users who have no idea what BGP is? That won't work, if you're small.
      - tuetuopay 3y ago
        huh yeah, too focused on my infra side of things; mobile vpn is another can of worms. though I don't know what would prevent any bgp daemon from running in e.g. the wireguard iOS app? there are bgp daemons like gobgp that can be easily integrated in other software. but this was more meant to be a joke than anything. wireguard is batteries definitely not included, and is why tailscale and the like do exist.
  - LeBit 3y ago
    You mean "dynamically" push routes and DNS configurations while the tunnel is already up? Because you can definitively configure routes and DNS at connection time.

by d-z-m 3y ago

justsomehnguy 3y ago

Not the OP, but the main problem with WireGuard[0] is not the protocol[1], it's good, but the opinionated tooling around it, be it .INI style configurations (god I hate it), mutual incompatibility of wg and wg-quick or just outright stupid decisions around storing config files and interacting with the user in the Windows client. Though there are some nuances with the routing selection/filtering too, which gets troublesome when you just need a pipe and run a proper routing protocols over it. ::/0 solves most of it but still there are some rough edges. [0] well, for *me* [1] One of the amusing things I discovered what I have a full 10MB/s+ to the SMB server in the DC over the WireGuard tunnel (and that's because it's 100Mbit/s uplink), while the Synology which sits on the same router on a 1Gbit port only makes 3-5MB/s.

aragilar 3y ago
You don't ever need to use the configuration files, netlink on linux or the cross platform interface documented at https://www.wireguard.com/xplatform/ https://www.wireguard.com/xplatform/ mean you can write your own tooling around an existing inteface. The cryptokey routing is pretty fundamental to wireguard, I'm not sure you could have one without the other.
vbezhenar 3y ago
wg is low-level binary, wg-quick is high-level script wrapper. They're not supposed to have any compatibility at all. You can build any kind of high-level wrapper for wg. One of that wrappers is Network Manager, for example. My issue with wireguard is that it's not enough for full-fledged VPN solution, for example there's no way to push routes to the client or DNS configuration or something like that. Those are very basic needs. If you have 100 users and you decide to change routing scheme, well, you're in a trouble. It is supposed to be solved by higher-level protocols, but I'm not aware of any open standard-de-facto ones with quality implementations.
- tuetuopay 3y ago
  nothing prevents you from running bgp over wireguard for route exchange. and there are many quality bgp daemons available* (* for linux and bsd)
  - vbezhenar 3y ago
    How do I configure my iPhone with BGP routes? Write my own app for VPN? Android, Windows? Linux users who have no idea what BGP is? That won't work, if you're small.
    - tuetuopay 3y ago
      huh yeah, too focused on my infra side of things; mobile vpn is another can of worms. though I don't know what would prevent any bgp daemon from running in e.g. the wireguard iOS app? there are bgp daemons like gobgp that can be easily integrated in other software. but this was more meant to be a joke than anything. wireguard is batteries definitely not included, and is why tailscale and the like do exist.
- LeBit 3y ago
  You mean "dynamically" push routes and DNS configurations while the tunnel is already up? Because you can definitively configure routes and DNS at connection time.