5 ms·

Maybe a bit off-topic, but genuine curiosity - why would anyone go for OpenVPN these days, when there is Wireguard available? It makes sense if UDP is blocked,

by Jnr 2y ago

Maybe a bit off-topic, but genuine curiosity - why would anyone go for OpenVPN these days, when there is Wireguard available? It makes sense if UDP is blocked, but in this case OP is clearly using UDP for OpenVPN.

mr_mitm 2y ago
Unrelated to OP's story, but besides tunneling traffic over TCP or even an HTTP proxy (which OpenVPN supports OOTB): plain Wireguard doesn't support 2FA, which is a requirement in some places. Unless there is an open source 2FA VPN solution built on Wireguard that I haven't heard about yet, in which case I'm interested.
- dongcarl 2y ago
  I believe Tailscale has 2FA? Headscale is an open source implementation: https://github.com/juanfont/headscale https://github.com/juanfont/headscale
wruza 2y ago
Is there a oneliner for setting it up on a ubuntu box akin to https://github.com/angristan/openvpn-install https://github.com/angristan/openvpn-install ? How does it work with iphone, android, windows? Can a regular person set up a client by receiving a single profile file? Idk about wg, but ovpn ticks all these boxes.
- mr_mitm 2y ago
  There is this by the same author: https://github.com/angristan/wireguard-install https://github.com/angristan/wireguard-install Mobile users simply scan a QR code and are good to go.
  - wruza 2y ago
    Thank you very much, I’ll try it soon! My relative has an android device that can’t run ovpn but may work with this.
- Jnr 2y ago
  Wireguard works on Windows, iOS, Android, MacOS, Linux. It is supported on multiple routers. And it can be configured with a single file, which on mobile devices can be imported as a QR code. And the "server" side is set up the same way as client side - with a single config file per tunnel. Wireguard is popular because it is simple to configure. And then there are many different solutions built on top of Wireguard, like Tailscale, which simplify some other aspects of setting up tunnels.
wink 2y ago
It's been a while but e.g. with OpenVZ containers you couldn't do anything in the kernel, i.e. Wireguard. I don't have access to that VPS anymore, but I was already using Wireguard but had to use OpenVPN here, so I can't tell you if this is still a widespread problem or a historical curiosity. Also sometimes, especially cross-organization, the chance that OpenVPN is already in use is much higher (if they're not doing Open/StrongSWAN anyway).
- martheen 2y ago
  It depends on the OpenVZ kernel, some later version can use WG. But OpenVZ is dying anyway so if someone use a still supported container technology, WG is probably available. Depending on the ISP setup, sometimes WG can be less reliable due to MTU and/or UDP filtering, I remember an ISP from years ago where WG don't work only on certain hours, while OpenVPN running on the same server still work.
  - Jnr 2y ago
    Wireguard can run in userspace mode if the kernel module is not available. Changing the MTU for Wireguard to 1280 usually helps a lot with reliability and throughput.
jmclnx 2y ago
OpenVPN is can hid your IP if set up correctly. Wireguard can in a way. But on the server your IP can be identified in some manner, maybe even after you sigh-out. Wireguard is good for places like Europe and North America. But if in Mainland China, Russia, Iran and countries like that, you need use OpenVPN.
- Jnr 2y ago
  Wireguard should leak less since the interface is up even if the connection is not established, it will still try routing packets through the Wireguard interface. Not sure why Wireguard would be less useful in the mentioned countries, but I guess it is because of blocking of UDP traffic? And as far as I know, China and Russia does not block UDP traffic.
  - mingus88 2y ago
    Wireguard seems to be something they can reliably fingerprint and block in Russia and China Previously HN discussion: https://news.ycombinator.com/item?id=39067213 https://news.ycombinator.com/item?id=39067213

by Jnr 2y ago

mr_mitm 2y ago

Unrelated to OP's story, but besides tunneling traffic over TCP or even an HTTP proxy (which OpenVPN supports OOTB): plain Wireguard doesn't support 2FA, which is a requirement in some places. Unless there is an open source 2FA VPN solution built on Wireguard that I haven't heard about yet, in which case I'm interested.

dongcarl 2y ago
I believe Tailscale has 2FA? Headscale is an open source implementation: https://github.com/juanfont/headscale https://github.com/juanfont/headscale

wruza 2y ago

Is there a oneliner for setting it up on a ubuntu box akin to https://github.com/angristan/openvpn-install https://github.com/angristan/openvpn-install ? How does it work with iphone, android, windows? Can a regular person set up a client by receiving a single profile file? Idk about wg, but ovpn ticks all these boxes.

mr_mitm 2y ago
There is this by the same author: https://github.com/angristan/wireguard-install https://github.com/angristan/wireguard-install Mobile users simply scan a QR code and are good to go.
- wruza 2y ago
  Thank you very much, I’ll try it soon! My relative has an android device that can’t run ovpn but may work with this.
Jnr 2y ago
Wireguard works on Windows, iOS, Android, MacOS, Linux. It is supported on multiple routers. And it can be configured with a single file, which on mobile devices can be imported as a QR code. And the "server" side is set up the same way as client side - with a single config file per tunnel. Wireguard is popular because it is simple to configure. And then there are many different solutions built on top of Wireguard, like Tailscale, which simplify some other aspects of setting up tunnels.

wink 2y ago

It's been a while but e.g. with OpenVZ containers you couldn't do anything in the kernel, i.e. Wireguard. I don't have access to that VPS anymore, but I was already using Wireguard but had to use OpenVPN here, so I can't tell you if this is still a widespread problem or a historical curiosity. Also sometimes, especially cross-organization, the chance that OpenVPN is already in use is much higher (if they're not doing Open/StrongSWAN anyway).

martheen 2y ago
It depends on the OpenVZ kernel, some later version can use WG. But OpenVZ is dying anyway so if someone use a still supported container technology, WG is probably available. Depending on the ISP setup, sometimes WG can be less reliable due to MTU and/or UDP filtering, I remember an ISP from years ago where WG don't work only on certain hours, while OpenVPN running on the same server still work.
- Jnr 2y ago
  Wireguard can run in userspace mode if the kernel module is not available. Changing the MTU for Wireguard to 1280 usually helps a lot with reliability and throughput.

jmclnx 2y ago

OpenVPN is can hid your IP if set up correctly. Wireguard can in a way. But on the server your IP can be identified in some manner, maybe even after you sigh-out. Wireguard is good for places like Europe and North America. But if in Mainland China, Russia, Iran and countries like that, you need use OpenVPN.

Jnr 2y ago
Wireguard should leak less since the interface is up even if the connection is not established, it will still try routing packets through the Wireguard interface. Not sure why Wireguard would be less useful in the mentioned countries, but I guess it is because of blocking of UDP traffic? And as far as I know, China and Russia does not block UDP traffic.
- mingus88 2y ago
  Wireguard seems to be something they can reliably fingerprint and block in Russia and China Previously HN discussion: https://news.ycombinator.com/item?id=39067213 https://news.ycombinator.com/item?id=39067213