2 ms·

IPSec may be a pain... but WireGuard is as simple as it gets in my opinion. Yeah, you may need to know basic IP concepts, like MTU... NAT traversal is a differ

IPSec may be a pain... but WireGuard is as simple as it gets in my opinion. Yeah, you may need to know basic IP concepts, like MTU... NAT traversal is a different topic, WG won't help in that, and that can actually be a pain. I guess we should be using IPv6 already, and this tool would be largely redundant already. (not completely, encrypted access to isolated networks is a valid use case)

derkades 2mo ago
Even without NAT, the same hole punching techniques must be used for IPv6 since there is usually a firewall blocking inbound traffic. Only in CGNAT type scenarios where the network behind NAT is still "WAN" will be helped by IPv6.
- jcgl 2mo ago
  This point applied to normal NAT as well as CGNAT specifically. And hole punching gets a lot simpler when you’re behind NAT since you don’t need any kind of rendezvous server to determine port mappings. In other words, IPv6 does help substantially—the same hole punching techniques are not needed.
podocarp 1mo ago
WG is totally fine for home labs etc. But pushing configs to the server or networm when onboarding a new peer, making sure the new peer IP doesn't collide with someone else, etc. Can be quite annoying sometimes. NAT is honestly smaller of an issue and rarely encountered, but it's useful for example to expose services on my laptop to my phone, kind of like ngrok. That can be quite hard on vanilla wireguard. For me the biggest thing tailscale/netbird solves is still the automatic handling of the peers, acls, or in other words automating fireguard config.