Comment by puzzlingcaptcha | Hacker News Reader

Comment by puzzlingcaptcha | Hacker News Reader

Parent Full thread

puzzlingcaptcha

>IPSec (IKEv2)/strongSwan: lots of brittle config that's different for each OS, NAT busting setup is very manual and involves updating the central server and starting all the others in the correct order, not great at reconnecting after network downtime, had to be manually restarted often

I don't follow, NAT traversal is integral to IKEv2 and pretty much "just works" [1]. Reconnecting after network downtime is not an issue either, with either on demand connection setup (auto=add) or pretty standard ifupdown scripts/networkmanager. I don't believe I had to restart my strongswan daemons in the past few months either...

I also disagree that config is 'brittle'. Quite to the contrary, I think strongswan with its exhaustive documentation and a complete test suite which provides configuration for every host in every scenario in the test suite is a great accomplishment and an incredibly useful resource [example: 2].

I think wireguard has a great niche to fill as OpenVPN replacement (which has a lot of issues) but some of its supposed benefits over ipsec are a bit overblown and a confluence of 'I couldn't be bothered to read the manual', failure to understand a difference between host-based and policy-based routing [3] and a pinch of hype-driven development.

[1] https://wiki.strongswan.org/projects/strongswan/wiki/NatTrav...

[2] https://www.strongswan.org/testing/testresults/ikev2/rw-cert...

[3] https://wiki.strongswan.org/projects/strongswan/wiki/Introdu...

I ran IKEv2 2-3 VPNs for multiple years with a few dozen users, I have to say from experience I disagree with you there (I'm the author of the repo, @pirate). For various reasons, StrongSwan required manual intervention much more frequently than WireGuard has for far. Often I'd have to manually restart the service, or adding a new host would break stuff for all the others. The minimal config required to match my current WireGuard config was about 3x the number of lines, which meant 3x the number of things that could break each time I added a host. Even if it's better documented, that surface area is painful to deal with from a Sysadmin perspective when all I want is something that just works.

Initial setup for IKEv2 is convoluted at best, but once it’s setup there are very few problems with it.

I (used to) run L2TP/IPSec and WireGuard on my Edgerouter 4, and both would give “acceptable” speeds (30-40 MBit on a 300/300 connection), but when recreating my firewall in PfSense, I went full IKEv2, and have not regretted it. With my SG-3100 I get ~100 MBit with IKEv2.

On thing I hated about WireGuard is the fact that all clients require configuration on the server.

I do still run it on one of my servers, as a client to Mullvad VPN, which in turn is used by a few docker containers. It could easily be replaced by IKEv2, but sadly most VPN providers only support OpenVPN and WireGuard, or have horrible speeds.

> OpenVPN replacement (which has a lot of issues)

Care to elaborate?

A few off the top of my head: juggling packets between userspace and kernel resulting in poor performance, tacked-on hacky features (hmac authentication), fragmented and often outdated documentation (the community wiki is a mess), homebrew key generation helper tools with hardcoded openssl versions, no native support on Windows/MacOS, autostart services on Windows are a mess (OpenVPNService, OpenVPNServiceInteractive, OpenVPNServiceLegacy), faffing about with socket buffer sizes on windows to get any sort of throughput and so on...

I don't know where you got your information...but you can achieve wire speed with OpenVPN over a 1gb link. If I had a bigger pipe, then I could run a bigger test, and expect the same results. The rest of your points fall under "it's not easy for average users" - which I agree with.

That depends on how much horsepower you have on both ends. I run my vpn off of a cheap cloud vps, which does the job, but doesn't have a lot of cpu power. I probably tripled my speed from openvpn to wireguard, all though both fail to max out my internet connection.

This. I'm using OpenVPN for ethernet bridging, which Wireguard cannot do.

I've done bridging over wireguard. You just set up a gretap tunnel to run over the wireguard tunnel.

Tinc would be a nice choice for this purpose.

Reply on news.ycombinator.com