Hacker News Reader

Comment by eximius | Hacker News Reader

Use Wireguard. It is wonderful and the community is friendly. `wg-quick` is easy to use but if you need it, I believe Streisand supports automatically provisioning a wireguard setup.

View on HN

Yes! Algo also sets up Wireguard for you.

I tried using it but unlike IPSEC/SSL VPNs, it doesn't punch through many firewalls.

Not Wireguard fault, but in my case IPSEC worked better. I guess I could encapsulate it, but it's just annoying to do and on some platforms it's just too much trouble.

WireGuard supports persistent keepalives to punch through most firewalls[0].

If your firewall blocks UDP packets in general, you're in a world of pain either way, since TCP over TCP is pretty bad.

[0] https://www.wireguard.com/quickstart/#nat-and-firewall-trave...

Try Wireguard on port 4500; this is usually allowed by any firewall/filter that allows ipsec.

Algo supports it as well although the docs currently make it sound like it's for Android clients only. But you can grab the generated config (and perhaps add a keepalive line to taste) and use it on other platforms.

Wireguard is awesome, but the kernel module is so far a mess. If you're paranoid I wouldn't rely on it until the code has been cleaned up and perhaps audited.

you are not mistaken

Based on what evidence?

I just think being cautious is wise, given how new WG is. And, AFAIK it is userland only, like OpenVpn, not in linux kernel, think performance.

There is a WireGuard kernel module, and it also seems weird to me to say "This is a mess" when what you actually mean is "Nobody yet knows if it is a mess or not and I have no evidence either way."

I'm not sure where you're getting your information; the /de facto/ primary WireGuard implementation is a Linux kernel module.

So, you don't have any evidence that Wireguard is "a mess" (the claim that you are supporting).

A mess in what way out of interest? (I've not looked at the source)

> a mess

by @mistaken, not Linus: http://lists.openwall.net/netdev/2018/08/02/124

You are mistaken

I'm not sure I've seen a more accurate handle before. I'd welcome any evidence to convince me otherwise though.

Ordinarily I would appreciate comments calling for an audit of security-critical software, but spoken with such derision and apparently ignorant of the fact that the author audits code for a living I can't get behind. As for "cleaned up", LKML's only objections to it so far are formatting; think variable declarations, line wrapping (or lack thereof), et al.

Having actually looked at the code a bit, it is dramatically cleaner than any other firewall code I’ve ever seen. And the crypto is pretty nicely done, too.

OpenVPN is a mess. IPSEC and basically all implementations thereof are messes.

(As a personal anecdote, have you ever tried to get OpenVPN to do anything remotely sensible with MTUs or MTU-related ICMP errors? You can’t, because every possible configuration gets it at least partially wrong [0]. Wireguard get it entirely correct AFAICT.)

[0] https://community.openvpn.net/openvpn/ticket/375

Reply on news.ycombinator.com