Hacker News Reader

Comment by mjl- | Hacker News Reader

i've read up on wireguard a week or so ago. it seems awesome. i've rarely been so excited about new software/protocol. the design philosophy feels so right.

a few months ago i concluded i needed a secure vpn to servers. ipsec seemed the better option. but i haven't set it up yet. it all seems so complicated for what i want to achieve: a simple secure tunnel between a few machines.

hopefully we'll get easy to use software for macos/windows. no idea how hard that is to create (i.e. adding tunnel types to these OS'es so you can easily add a tunnel and configure them).

View on HN

> hopefully we'll get easy to use software for macos/windows

This is certainly in the works. A fella is working on a Go implementation right now that will be cross platform.

Have a look at zerotier then. It's user space, so no kernel requirements. It's super simple: start up the servers and join a network you create on the website. All the traffic still goes directly if possible. Lots of clients available for popular platforms.

ZeroTier is cryptographically inferior to Wireguard, but also isn't really a VPN: it has centralized configuration and rendezvous. If you're running VPNs to get the US Netflix from your UK vacation, this is probably fine. If your VPN is how remote employees access your prod network, it is way less fine.

I think it's a bit unfair to judge ZeroTier in comparison to VPNs, because that's not strictly speaking what it's trying to be. I like overlay networks!

I agree about the cryptography part of course. But I'm not sure about other points. You can run your own directory nodes, rather than use the public ones, so in practice the model looks like OpenVPN replacement. Is there a reason apart from the cryptography part why you wouldn't want to use it for remote workers?

Sure, it does much more, and it's probably better to call it an SDN / overlay. But if you can call OpenVPN a VPN, then I think ZT can do VPN as well.

I actually would love to hear more about your perspective on the crypto used in Zerotier and why it shouldn't be used for remote workers and those sorts of things.

I've been a user for quite a while and it's been really nice (and generally I've really only had trouble using Zerotier on really locked down wifi networks), but given their Technical FAQ info it sounds pretty convincing to a lay non-security-expert person that it is relatively secure: https://www.zerotier.com/tech_faq.shtml#security

As far as using it for remote workers, in comparison to how our current VPN option at work functions (currently a SonicWall Firewall/VPN) it definitely seems to work more easily/consistently so it's been something I've wanted to share so we can try out (but if there are big security issues with doing so I'm sure myself and others would love to get your thoughts on Zerotier in particular).

Thanks!

Reply on news.ycombinator.com