Hacker News Reader

Comment by jchw | Hacker News Reader

I’m using WireGuard daily on Linux and iPhone. It’s hard to describe how much better of an experience this is than OpenVPN. Connections are reliable and durable, latency is pretty low, and you can actually understand the software.

View on HN

I've been using WireGuard on my Android phone for a good while now using a free digital ocean droplet via https://github.com/trailofbits/algo

It's fast. It's easy. You never have to think about it. It just works.

Using myself a Wireguard road warrior install script:

https://github.com/l-n-s/wireguard-install

> using a free digital ocean droplet

I can't seem to find any "free" option on their pricing page. Could you elucidate?

> Could you elucidate?

I sure can.

It looks like I'm using the $5/month 1GB/1CPU/25GB droplet running Ubuntu 18 LTS, and just imagined that I was using a free one.

Memory sucks.

An engineering approximation to free?

It’s free given sufficiently small values of 5

Assuming a spherical VPS in a vacuum...

I saw this from IBM which doesn't appear to even need a credit card. :0 https://www.ibm.com/cloud/free/ But I haven't checked it out yet.

I think that Azure and GCE have better free tiers than AWS, but I'm guessing the bandwidth metering may work against a vpn use.

Do you have any issues with sites blocking the DO IP addresses? I ran this for a while and a number of sites block connections for coming from a data center.

Yep. DO is industry-blacklisted by the consortium of online content providers who collude on VPN ip-ranges. BBC, Netflix, Sky all are blocking it.

DO is also commonly blacklisted for being slow to deal with network abuse.

I used to build a DDoS mitigation product and we would regularly see 50+ Gbps of inbound attacks originating from DO.

If you want to set up a VPN from a VPS, consider something like LunaHost, it's what I use and I find less issues with it due to being far less known I'd guess.

While noting what the other commenters have said, I don't recall running into any blocks, though I don't visit the sites they mentioned.

I also do this, but with Linode. The only hangup I hit every once in a while is that some services will block access to VPS IP blocks due to spam/malicious traffic. E.g. occasionally I can't get Google search results while on VPN, or Pokemon Go won't connect as they block VPS providers to prevent spoofing.

I see a lot more capchas which is annoying. Also paypal doesn't seem to work most of the time either, which is lame, as I use 2FA for any paypal transaction

I setup WireGuard on my Ubiquiti router and have profiles installed on my phone and Mac.

Extremely convenient for some basic privacy when on a public hotspot.

I can’t install the official WireGuard on my Macs that are stuck on High Sierra. Love WireGuard for Android and iOS. I think there’s a way to do it on High Sierra with brew but I haven’t dug too deep.

Nice! Is it one of the UniFi ones?

No, it's an EdgeRouter.

I'm not sure if UniFi equipment supports the run times necessary for WireGuard.

----

UniFi has its own VPN type of software. Not sure what it is or how secure it is, though.

It sucks. It doesn't work on Windows reliably. If you're going to do VPN on Ubiquity gear I either install OpenVPN on the EdgeRouter or pass the traffic through to another device to handle the VPN.

Have not tried this myself [1]; But I do have a USG, so I might when I have the time.

[1] https://graham.hayes.ie/posts/wireguard-%2B-unifi/

To anyone interested in running Wireguard on Ubiquiti have a look at https://github.com/dynamist/ansible-role-wireguard-vyatta

I am considering this to (on a ER4) but since they're are no dedicated ASICs I wonder what the cpu overhead it is for the router.

Same but Linux and Mac. I have the feeling that online live conferences/meetings are working with Wireguard very good. With OpenVPN I always had the feeling to turn the VPN off to reduce the latency overhead.

I can’t install the official WireGuard on my Macs that are stuck on Sierra. Love WireGuard for Android and iOS. I think there’s a way to do it with brew.

In the same situation, it is indeed in brew.

   brew install wireguard-go wireguard-tools

Pretty painless to use and I haven't experienced any issues.

I’ve been playing with wireguard for the past few days for my personal network. It is likely that I just don’t know what I’m doing yet, but I’ve been having connection issues that I haven’t had with openVPN. One set of issues is from overlapping IP ranges (192.168.1.0/24 is bad news) and another with something I haven’t figured out yet when connecting from work. OpenVPN doesn’t have issues but wireguard does. My thought is the specific port is filtered by my work, but I’m using a rather obscure and high value port.

I've run into both issues, for the first I moved my internal network to a subnet in the 10.0.0.0 range and the second was a DPI firewall at a hotel I stayed at - in the end I have a dual mode setup where if I HAVE to I connect to an OpenVPN endpoint in my network, otherwise it's wireguard all the way.

That’s irritating at best. The whole point of using wireguard, to me, was to move away from openVPN. If I can’t do that then why would I bother hosting a second way to punch through to my network?

Well, it's a lot faster for one, and I suspect it will be allowed through like OpenVPN is once traction is higher.

My greatest misunderstanding before getting it to work was that Wireguard uses the `AllowedIPs` setting both for defining which source IPs to allow, and also for routing traffic back. Means you can't have multiple peers on your machine with the same set of `AllowedIPs` - you need to configure each separately with their exact IP address.

Since WireGuard doesn't do NAT hole punching etc, you'd most likely need to connect from work to your network, and use the `PersistentKeepalive` setting. You can't initiate the connection the other way round.

Yep, AllowedIPs should really be called IPs (or PeerIPs).

Same here. It also seems to use a bit less battery than openvpn as well on my phone.

Reply on news.ycombinator.com