Hacker News Reader

Comment by sjy | Hacker News Reader

For anyone else wanting to set this up at home, I’d recommend installing the vyatta-wireguard module [1] on an EdgeRouter X instead. It costs about the same as a Raspberry Pi, and you get a reliable network appliance with four gigabit ports and PoE, rather than a general purpose Linux box with graphics and USB. I’ve found the WireGuard module to be fast enough to keep up with my 100/40 Mbps internet connection, and now when my Linux server goes down, the network it’s connected to stays up.

[1]: https://github.com/Lochnair/vyatta-wireguard

View on HN

I upgraded from an ER-X to an ER-4 because the X can’t do full 1000 Mbit with PPPoE fiber without hardware offload. With hardware offload turned on there’s a bug in the hardware that causes some sites, most notably Netflix, to not route at all.

The ER-4 has been great with the Cavium hardware. No hardware offload issues like this.

Edit: The ER-X tops out around 500 Mbit with hardware offload turned off.

Love my ER-4 and all its offloading capabilities. I just wish it had a switch chip so you could bridge ports without a performance penalty.

Huh. I have a er-x with hardware offloading turned on. I have noticed no issues with netflix.

I get about 900 megabit on my gigabit fiber.

while i don’t use it it should be possible for ppoe with hw offloading, so i don’t get it either. maybe that’s disabled on the slow one...

https://help.ubnt.com/hc/en-us/articles/115006567467-EdgeRou...

but i’d assume it should handle fast rates like this if hw offloading was on.

I had an ER Lite, and hardware offload was re-validating packets. Things would come in as error, and come out the other side still invalid, but validated. And at the time my ISP was sending me a lot of uncorrectable errors. So a lot of services would refuse to run with hardware offload on, because the errors weren't being handled. (with it off, the errors were identified as errors and handled. slow, but accurate).

Then the pole outside my house got hit by lightning and fried the thing, and I replaced it with something from mikrotik.

I have this router and set up the wg interface but got stuck at how to route all my home traffic through wg. Any recommendations on how to troubleshoot this part?

I believe you can do this with policy based routing rules. Effectively you create a second routing table where the default route goes through your wireguard device and then you create firewall modify rules that assign traffic to that routing table by source, your local LAN range and interface in this case.

The following article has an example of using policy based routing. Your setup isn't all that different, you don't need to have more than one default route in each routing table is all and you also might only need one additional route table.

https://help.ubnt.com/hc/en-us/articles/204952274-EdgeMAX-Po...

As suggested in the sibling comment, use policy-based routing, specifically something like:

    set protocols static table <table-number> interface-route 0.0.0.0/0 next-hop-interface wg1

I recommend following this blog post. Helped me a lot: https://andrew.dunn.dev/posts/wireguard-from-your-isp/

Be careful with this module, lots of the `set` and `delete` commands aren't quite working right yet, leading to some commit failed errors for me. I was trying to get something working and ended up with an ERX that couldn't pass traffic last night. Luckily I had a serial-to-USB cable so I could fix it.

That's partially my fault. I wrote a lot of the configuration command stuff for that module and there are a couple of bugs when it comes to validation for setting and deleting items so you can get yourself in a bad position. Plus there are some issues with EdgeOS which this seems to trigger.

I migrated from Wireguard to ipsec quite a long time ago because it was less complicated for my particular needs. It has probably been close to 2 years. No one else seems to have taken up resolving the lingering problems with the configuration issues.

I'm running the latest 2.x firmware so I wasn't sure where to point fingers :)

I'll give it another shot at some point, but it was more just to try out. I've also got ipsec set up on that router and that continues to work just fine.

I may dust my personal ER-X off soon and take a look at addressing the issues. I would have more enthusiasm about it if it didn't involve writing perl scripts.

If you do attempt it again there are "generate" commands which will generate they keys needed and place them in the proper area in the file system. Most of the guides to configuring Wireguard on edgeos seem unaware these exist and have people using the "wg" command directly instead to generate keys.

Ahhh good to know!

I think part of my issue is just that I need to do some more reading around what IPs should be what. It's usually clear what's going on in WireGuard-land, but not clear how that interacts with the other interfaces or the networks on either side.

Reply on news.ycombinator.com