Hacker News Reader

Comment by metalliqaz | Hacker News Reader

I've been using OpenVPN on my home pfSense box, it's working pretty good and didn't require I install anything except the OpenVPN app on my phone. Not sure if WireGuard has anything to offer that would motivate a switch.

View on HN

>WireGuard has anything to offer that would motivate a switch.

A lot slicker in my experience. Instead of support everything it assumes both sides speak wireguard. Increases speed, reconnects faster etc.

...whether I'd break an existing setup for it...probably not.

It's faster. But if you already have a working system that you are happy with it may not warrant a switch. I think it's main strength lies in how easy it is to set up though. First time setting it up from scratch I had a working VPN in less than 5 minutes.

I wrote a comment similar to this, not wanting to spend time learning new details. Then I set up Wireguard once.

Setting up Wireguard is actually quicker than refreshing your memory with the OpenVPN man page.

That part really is wonderful. I don’t show it in the guide, but I’ve set up three peers now, and my config file is still just 15 lines long (including headers), and once you wrap your head around what AllowedIPs means in the two different contexts, it’s really easy to read.

As people mentioned already it is much faster. The downside is - there's nothing close to automatic DHCP or something of that nature, you have to effectively hard-code client's IP addresses

Wireguard does claim to be faster. It’s also much simpler from a design perspective, so it might end up being more secure.

But other than that, there’s no big reason to switch if you have a setup you’re happy with.

It doesn't just claim to be faster; it's clearly, materially, obviously faster, at least in straightforward configurations (which is to say that someone could come up with some weird OpenVPN configuration that makes up the [large] gap, but I haven't see that yet).

IF you only use AH with strongswan then it is faster than either wireguard or openvpn

The question was if there was a reason to switch away from OpenVPN ;)

If you are just using AH you aren't encrypting your traffic so it isn't really comparable to wireguard or openvpn.

Or maybe you encrypt at another layer and just want strongswan for the interconnection without too much overhead.

Or maybe you do not care about the encryption, but care about the virtual and private part of VPN

There are many usecase. There is no one size fit all.

As others have said ... it's faster HOWEVER I've had some issues when travelling where OpenVPN wasn't blocked but WireGuard was in some hotels. So I have both, if I can, I use wireguard, otherwise OpenVPN is slower, but does the job.

You’re can choose a port number to run Wireguard on that should pass through all but the craziest firewall. 53 or 443 could work. Or run it OpenVPN’s port 1194.

Only limitation is that it has to be UDP, Wireguard doesn’t support TCP.

443 and 1194 only make sense for TCP since there's nothing of note that commonly runs on those UDP ports.

443/UDP is used for HTTP/3 (aka QUIC), and is pretty quickly becoming ubiquitous – and OpenVPN also supports UDP, so if the port is open for TCP, it might well also be open for UDP.

For UDP, the OP could try the SIP ports

Tried that ... looks like they were using a security gateway that did packet inspection and disallowed anything but "well known" VPNs.

Does WireGuard over https exist yet? Something that encapsulates WireGuard as HTTP/3 where UDP is permitted and falls back to HTTP/2?

WireGuard is supposed to be faster and more reliable. In addition it has a far, far smaller codebase than OpenVPN, which makes it easier to audit and therefor more secure.

WireGuard's codebase is so small because it is lacking many features that the vast majority of people don't need. For the people who do need those missing features, WireGuard is unusable.

https://news.ycombinator.com/item?id=17096899

Some of those criticisms are just wrong. I setup WireGuard to do split tunneling without any issue.

Reply on news.ycombinator.com