I have to deal with it via a vendors product and have spend about 4 weeks in the past 6 months trying to fix a flaky connection by guessing and restarting a lot. Just like anything things will go wrong. But, with wireguard you have no idea what it could even be if it's not an obvious thing that you can diagnose with ping.
The kernel already has this:
# modprobe wireguard && echo module wireguard +p > /sys/kernel/debug/dynamic_debug/control
The thing about simple, key-based authentication is that it's very extensible, without changing the actual protocol.
What?
Well, what Wireguard's auth actually means is that you can use whatever authentication you want to communicate a shared secret to both ends.
Want to authenticate with, say, SSH keys? Sure- SSH into a server, run a command that generates a new Wireguard key, connect in with that key.
LDAP? Same situation. Whatever SSO you want- as long as you can stick up authentication in front of a service that's able to pull bits from /dev/urandom. Multifactor? Sure.
Wireguard does one thing well. What's missing is not features in Wireguard- it's the ecosystem around it to actually handle key management. For enterprises, Hashicorp Vault or something should probably look into supporting Wireguard; for smaller situations, some SSH-based key exchange, like the way Mosh handles things, seems reasonable.
Complex, pluggable authentication is sometimes necessary...but you want as few implementations of it as possible, and you sure don't want it in the kernel if you can help it.
By this standard, no website supports 2FA- ultimately it's just a cookie that's used to authenticate requests, even though to get that cookie you may have to go through 2FA. Nothing prevents an attacker from just grabbing the session cookies.
In fact, I doubt any VPN supports 2FA by this definition- it would mean requiring authentication on every packet. Instead, of course, what you do is do authentication once, when setting up a tunnel, and then use bearer tokens from then on.
Edit: Also OpenVPN, which is the tool I’m comparing it with, only ever has session keys in memory. The 2FA part (password+OTP) isn’t saved by OpenVPN.
WG has the concept of sessions already, the only change would be allowing a process in userspace to instrument the sessions directly without going through the key system.
The the default key-routing system would be just one method of issuing and managing sessions making the core protocol even simpler!
1. Is it open-source?
2. When am I going to see the "you have to pay us now" screen, and how much will it cost? I realize it's a business and am fine with that, but want to know what I'm spending before setting stuff up.