2 ms·

wg is low-level binary, wg-quick is high-level script wrapper. They're not supposed to have any compatibility at all. You can build any kind of high-level wrapp

wg is low-level binary, wg-quick is high-level script wrapper. They're not supposed to have any compatibility at all. You can build any kind of high-level wrapper for wg. One of that wrappers is Network Manager, for example. My issue with wireguard is that it's not enough for full-fledged VPN solution, for example there's no way to push routes to the client or DNS configuration or something like that. Those are very basic needs. If you have 100 users and you decide to change routing scheme, well, you're in a trouble. It is supposed to be solved by higher-level protocols, but I'm not aware of any open standard-de-facto ones with quality implementations.

tuetuopay 3y ago
nothing prevents you from running bgp over wireguard for route exchange. and there are many quality bgp daemons available* (* for linux and bsd)
- vbezhenar 3y ago
  How do I configure my iPhone with BGP routes? Write my own app for VPN? Android, Windows? Linux users who have no idea what BGP is? That won't work, if you're small.
  - tuetuopay 3y ago
    huh yeah, too focused on my infra side of things; mobile vpn is another can of worms. though I don't know what would prevent any bgp daemon from running in e.g. the wireguard iOS app? there are bgp daemons like gobgp that can be easily integrated in other software. but this was more meant to be a joke than anything. wireguard is batteries definitely not included, and is why tailscale and the like do exist.
LeBit 3y ago
You mean "dynamically" push routes and DNS configurations while the tunnel is already up? Because you can definitively configure routes and DNS at connection time.
- ta1243 3y ago
  What you'd normally think of as Wireguard allows routes at connection time sure, however OP wants a VPN which allows peer B ("server") to define a route and advertise that route to peer A ("client"). So one day the client would route 10.1.0.0/24 down the wireguard tunnel, but not 10.2.0.0/24, the next day however from changing peer B, the config on peer A would change. Obviously there are many things you could do to allow this (run a routing protocol, build a custom client which gets route information, etc), but the "out of the box" wireguard is a kernel interface, a wg command, and a utility script (wg-quick). I think there are some gui based clients for non-linux based OSes, but it's the same principle. DNS is nothing to do with the wireguard kernel or userspace, it's configured in the "wg-quick script" (there's a bash function called set_dns), but you can do that however you want. Wireguard alone isn't what an enterprise would consider to be a "VPN solution", it doesn't push configs from a central location, it's very much a peer-to-peer tool. You can build "enterprise" features like centrally defined routes or DNS on top of that, or not, it's not opinionated.
- vbezhenar 3y ago
  I'm generally comparing it with OpenVPN and it allows to do all that.
justsomehnguy 3y ago
> there's no way to push routes to the client or DNS configuration Yep, this one too.

tuetuopay 3y ago

nothing prevents you from running bgp over wireguard for route exchange. and there are many quality bgp daemons available* (* for linux and bsd)

vbezhenar 3y ago
How do I configure my iPhone with BGP routes? Write my own app for VPN? Android, Windows? Linux users who have no idea what BGP is? That won't work, if you're small.
- tuetuopay 3y ago
  huh yeah, too focused on my infra side of things; mobile vpn is another can of worms. though I don't know what would prevent any bgp daemon from running in e.g. the wireguard iOS app? there are bgp daemons like gobgp that can be easily integrated in other software. but this was more meant to be a joke than anything. wireguard is batteries definitely not included, and is why tailscale and the like do exist.

LeBit 3y ago

You mean "dynamically" push routes and DNS configurations while the tunnel is already up? Because you can definitively configure routes and DNS at connection time.

ta1243 3y ago
What you'd normally think of as Wireguard allows routes at connection time sure, however OP wants a VPN which allows peer B ("server") to define a route and advertise that route to peer A ("client"). So one day the client would route 10.1.0.0/24 down the wireguard tunnel, but not 10.2.0.0/24, the next day however from changing peer B, the config on peer A would change. Obviously there are many things you could do to allow this (run a routing protocol, build a custom client which gets route information, etc), but the "out of the box" wireguard is a kernel interface, a wg command, and a utility script (wg-quick). I think there are some gui based clients for non-linux based OSes, but it's the same principle. DNS is nothing to do with the wireguard kernel or userspace, it's configured in the "wg-quick script" (there's a bash function called set_dns), but you can do that however you want. Wireguard alone isn't what an enterprise would consider to be a "VPN solution", it doesn't push configs from a central location, it's very much a peer-to-peer tool. You can build "enterprise" features like centrally defined routes or DNS on top of that, or not, it's not opinionated.
vbezhenar 3y ago
I'm generally comparing it with OpenVPN and it allows to do all that.

justsomehnguy 3y ago

> there's no way to push routes to the client or DNS configuration Yep, this one too.