Hacker News Reader

Comment by arendtio | Hacker News Reader

> We built Warp around WireGuard

So basically Cloudflare created an app with Cloudflare branding and set up a Wireguard server for everyone. No bad, but just check out the original:

https://www.wireguard.com

While I am not a big fan of VPNs in general, I have to admit, that Wireguard performs exceptionally well. I tested it a week ago and the added latency is pretty much just the network latency and the bandwidth loss is minimal (so small I couldn't even measure it reliably). What I found most interesting, was that there were some use-cases when the network with Wireguard performed even better than without it (probably related to congestion control).

View on HN

> So basically Cloudflare created an app with Cloudflare branding and set up a Wireguard server for everyone.

Not just one -- servers in 175 (and growing) locations spread around the world, and the app will always use the closest one to you. That's arguably a lot more important that what protocol it uses, and is not something you could easily DIY.

I mean, for DIY you only need one because you're only one user. Pick a VPS host with a data center near you... done.

It's only near you when you're at home though. This works around the world.

wouldn't be that difficult to write a script that checks geoip and launches a VPS in the region closest to your current devices public address. You could even create an iOS shortcut to allow you to do it from your iPhone

What's the chance that there are a lot of unknown unknowns that you are not counting on?

I'd say that even the known unknown that ips and networks change routinely should make it a headache to maintain.

Classic HN comment. I predict that Warp will fail just as hard as Dropbox.

Several billion-dollar businesses have been built doing things that "wouldn't be that difficult".

In this case, I agree that a single VPS is usually enough for most but never underestimate the market power of making things simpler and faster.

https://patents.google.com/patent/US9736710

(Not implying anything, just providing a discussion point.)

Not sure how hard it would be to install WireGuard fully unattended, I tried it with OpenVPN months ago and still haven’t completed it.

Once you get your script to work, you’d have to wait minutes for the VPN to spin up in a new region.

WireGuard is much easier to get configured than OpenVPN.

Check out algo: https://github.com/trailofbits/algo

I think you could bake your configuration into a custom image, so it would be fast to get a VM started (about 30 secs on GCE, not sure about EC2).

If you use stopped instances, it's even faster.

(I work at GCP so know more about GCE than EC2)

maybe works better. But I used mine hosted in the US while I was traveling abroad in the UAE. Worked fine. I often saw better service with it turned on.

Probably all depends. I tried to use my west coast US VPN in Australia and it was atrocious. I had to deploy to AWS Sydney instead.

For me, VPS hosts with data centers near me isn't a thing, but CloudFlare has edge locations near me.

Color me curious. Where is that? And by what definition of near? There isn't even an AWS AZ near you? A t2.micro is literally free and is bigger than the one I'm running mine on (which I'm paying for, so maybe I should swap... though, I don't think AWS has AZs closer than my current $1/mo host).

The t2.micro is only free for a year, no? After that it's expensive vs normal providers, like aws stuff generally.

sometimes people move around

I mean, I guess. But not often. If you are flying around the world, then sure, this is probably better. But if you're like the vast majority of people, then you will be in the same city most of the year.

Even if you change residences, you'll typically be in the same state. Even if you change states, you can just set it up again in, what, super conservatively, under an hour (you've already done it once so fewer missteps).

DIY has benefit of trust, but disadvantage of unique to you IP address. With 3rd party VPN you share the IP with many, much like hiding in the crowd.

I was lucky to find small paid VPN provider, that doesn't do marketing, pay for referral and stuff, and I'm sticking to it.

If you’re traveling a lot, which is often the use case for a VPN, this immediately becomes annoying.

or a feature

> That's arguably a lot more important that what protocol it uses

I'd disagree. Many VPN protocols suck even if the gateway is in-house. I guess there's a reason they introduced that with Wireguard specifically.

I consider myself fairly competent, and I couldn’t understand the wireguard documentation enough to setup my own install without resorting to algo [0]. There’s real value in wrapping a system like WireGuard into a product, because it democratizes technology rather than making it available only to those knowledgable enough to understand how to set it up. I think Warp is great in that regard.

[0]: https://github.com/trailofbits/algo

I was in the same boat, hopefully this will help:

https://www.stavros.io/posts/how-to-configure-wireguard/

It's actually very easy to set up, I don't know why the official docs make it seem super hard.

What's the reasoning behind embedding the private keys directly in the config?

Mostly convenience, since it's a "getting started" guide. I'd prefer a better way than the config file to specify devices, but unfortunately there isn't one right now. Maybe I should write a WireGuard config manager tool.

you have to store them somewhere with appropriate access rights anyway. Since the config is mainly a private key and an ip address it makes sense to not complicate the setup with another file to manage

> I couldn’t understand the wireguard documentation enough to setup my own install without resorting to algo

Not sure what you mean. Algo has no relationship to WireGuard; it's basically a customized StrongSwan setup under the hood, which utilizes IKEv2 (not WireGuard) as the transport.

Algo added WireGuard support at least several months ago.

Algo does not have a relationship to Wireguard, but Trail of Bits does. We made a substantial donation to them prior to including Wireguard support in Algo. You can find us on their donation page here: https://www.wireguard.com/donations/

I am still trying to figure it out how to setup a Wireguard server on Kubernetes/GKE to personal use. Outline and OpenVPN clients have some problems that's why I want to try Wireguard.

Is that even possible? I thought Wireguard was essentially a kernel module... Which is basically the only thing you can't dockerize, as the kernel is shared between all containers?

Could be mistaken though .. not sure

Cloudflare has their own implementation that runs in userspace. [1]

1 - https://github.com/cloudflare/boringtun

There is also an official user space implementation. The performance is not bad at all.

[1] https://github.com/WireGuard/wireguard-go.

You could put it in a micro VM in the same VPC as the GKE cluster, and then have a 2019-grade bastion host.

When did Algo get WireGuard support? Used to use Streisand as it has more protocols, but WireGuard is all I would want now.

Might have to set this up again!

> What I found most interesting, was that there were some use-cases when the network with Wireguard performed even better than without it (probably related to congestion control).

It could be the different routing.

Your ISP's routing might be sub-optimal to certain destinations. After all, it chooses routes based (at least in part) on cost, not performance.

There are commercial products that do this sort of tunneling (among other things) to lower routing latencies.

Could also be packet-shaping/QoS on the ISP side

Sure. Especially in countries that don't have network neutrality...

I wonder what first world country would do that!

Possible but I am not exactly sure what caused the difference. I used fast.com for testing and when I increased the number of parallel connections the performance degradation was lower when using Wireguard. I assumed that it is related to congestion control as Wireguard uses UDP AFAIK and otherwise I would use TCP on the bottleneck part of the connection.

The ISP might be doing it knowing you're connecting to Netflix. But if you do a VPN, they don't know those specific packets are going to Netflix, so they can't shape the packets.

They certainly can shape any traffic you cause to transit their network. What you mean is they can't selectively shape that traffic. But then why would they want to do that?

"Why" doesn't matter when it has already been proven that they do.

Just search through HN for any discussion of net neutrality.

If they can degrade your traffic from 1080p to 720p without a customer complaining, then they don't need to expand their network to support more users which increases their profit margins.

In short, because they can and they're assholes.

Wouldn't it be appear more performant to queue latency insensitive packets separately to others?

Wireguard might be using UDP, but you're still tunneling TCP on top of it. So the congestion control is still there and kicking.

The congestion control is less likely on the server side, whereas congestion control on an ISPs network is much more so.

They've also written they're own client in rust https://github.com/cloudflare/boringtun

From personal experience:

When coupled with an DNS based ad blocker Wireguard can actually make your internet faster than when not using it.

More so on Android than iOS and more so on mobile than fixed, but still feels so much smoother.

you can even only forward the DNS requests and not the rest of the data so your home upload speed won't become your bottleneck.

This is precisely my setup, and I couldn't be happier. I have a lot of internal infrastructure including pi-hole, confluence and a number of self-hosted services. WireGuard lets me go anywhere on my laptop and its like I never left home, and I just keep two configurations for when I want to forward only internal IP addresses, or all my traffic.

Any pointers on setup instructions for WireGuard split tunneling on iOS?

not for wireguard. but for openvpn here's a howto https://ba.net/adblock/vpn/doc/howto.html

Instructions for wireguard in general:

https://www.ckn.io/blog/2017/11/14/wireguard-vpn-typical-set...

Then you'd just need to use the iOS app, I hope?

You have issues with WireGuard split tunneling in general or only on iOS ?

To make split tunneling work in WireGuard I changed AllowedIPs = 0.0.0.0/0 in the config file into: AllowedIPs = 92.13.14.15/32 10.192.122.0/24

where 10.192.122.0/24 is the subnet of my tunnel, and 92.13.14.15/32 is the ip address of my home computer

this works on iOS and macos for me

> I have a lot of internal infrastructure including pi-hole, confluence

Confluence as in the Atlassian software? What do you use it for at home?

Torturing people

Yep. A 3€ Hetzner server with Wireguard and pi-hole. Running several private services on my server that are just available in my private network. Like an extension to my phone that's always on and working perfectly.

The only thing I was never able to get working was the IPv6 support. Oh well...

For a business solution for this try https://ba.net/adblockvpn

Disclosure. It is my day job

Well right now this only tunnels DNS traffic so it’s not quite the same.

You can go on the wait-list for WARP+ which sounds like it’ll route everything over the VPN.

VPN does not usually add appreciable latency from the processing, unless either peer is overloaded.

Reply on news.ycombinator.com