Hacker News Reader

Comment by dragonsh | Hacker News Reader

I hope WireGuard can come to feature parity with TincVPN will be nice. Especially automatic routing and mesh VPN formation, it can really help our multi-cloud container clusters connected using TincVPN to be bit more performant.

The difference is WireGuard is part of Linux kernel so speed of processing packets is faster than TincVPN.

Still experimenting with WireGuard and manually creating peer to peer mesh.

View on HN

One suggestion would be to submit a feature request to Tinc to add detection / support of Wireguard. Tinc could still handle the mesh routing and just hand off the encryption bits to WG. There have been some brief discussion in email threads [1] Probably more, have not checked all the archives.

[1] - https://www.tinc-vpn.org/pipermail/tinc/2017-February/004755...

Fascinating idea! I've been really interested in Tinc, but it seems to be languishing where WireGuard is really taking off. The meshing in Tinc seems quite interesting. Though, honestly, I'm pretty happy with OpenVPN.

Tailscale looks promising. (https://tailscale.com/)

I was impressed how quickly I could go from 0 to VLAN with Tailscale on Windows. Unfortunately I did not have as nice of an experience with the AUR package on Arch. However, it looks like the maintainer replied with a link to instructions on their website with how to get it working!

Is it the AUR package that is the problem or the Linux application itself?

AUR package maintainer here (also tailscale employee). The poor experience was definitely on me. Relaynode's initial setup flow is a bit weird, and I didn't make the package explain anything. I think you were the first user of the Arch package other than me, so you got to experience the fun :)

Next release will have a better daemon, with a more typical setup flow. If you want to test drive it, `tailscale-unstable-bin` is the AUR package for it.

I am sick of people shilling to this thing here. Stop exploiting HN for free advertising. Every Wireguard post here has become a free ad for this company.

EDIT: Stop supporting parasites repackaging and rebranding open source and selling it while leaving the author who single handedly made this entire thing possible begging for donations on Patreon

Last time I talked to him about it, Jason Donenfeld was not upset about Tailscale. You'll have to find someone else to be vicariously outraged for.

Of course I am sure he is extremely happy spending 5 years developing the next big thing then others rebrand it for enterprise and become rich.

Jason comments here all the time and is quite easy to talk to, and I think we're all better off hearing from real Jason, not some imaginary angry Jason you've invented. Not least because there are actual abuses in the WireGuard ecosystem, and your imaginary Jason is obscuring them behind fake abuses.

I didn't say he is angry, my main point was not advertise for free for a company that is built off the work of a single man, especially when it's FOSS, especially when it's a technically piece of genius like WireGuard, while not supporting the man himself. There are known ways for companies to market their paid product, it's called ads.

This is not how opensource works.

You realise most VPN providers offer OpenVPN (for years) and now Wireguard support right? Some bundle the software & drivers on their own GUI. I'm happily using a paid OpenVPN client for mac (won't name it here to avoid upsetting you further) for years.

What I'm trying to say is that tailscale is doing nothing new or sinister.

Actually, I haven't heard of them and they look like a pretty nice way of connecting different resources over the internet. I am not sure what you mean by parasites. I am glad they posted the link in this thread. Wireguard is an opensource project, Tailscale is a paid service. Do you think they compete with each other or you think that people should not share product recommendations at all on HN?

One could just as easily make the opposite complaint that WireGuard is receiving undeserved hype because it is just a tunneling protocol without a control plane.

You've been breaking the site guidelines repeatedly, both in this thread and unfortunately in others (and we've had to ask you about this before). We ban accounts that do that. Would you mind reviewing https://news.ycombinator.com/newsguidelines.html and sticking to the rules when posting here? The intended spirit is curious conversation.

Again, please do your job and delete astroturfing comments and ban these users. This company has been exploiting HN for so long to promote itself whenever a post about Wireguard go to the frontpage. They don't even have a ready product. This website encourages really sneaky types of marketing if you don't take action.

I appreciate your concern for the integrity of this site, but if you really care about that you should follow its rules, which say clearly what to do with these insinuations, and it isn't posting them here.

I haven't seen any evidence of astroturfing in this case. The user you were accusing above seems entirely legit.

You've posted such accusations to HN several times before. Given how little data we have about each other online, it's easy to connect the dots in a way that jumps to nefarious conclusions about others. If you come here and post those, the odds get pretty high that you're accusing innocent people of bad things. That's not cool, which is one reason the site guidelines ask everyone not to do that. We'd be grateful if you'd stop doing that.

I will stop doing that. But HN should give the priority to FOSS projects and commercial projects made by single developers and small companies that have no money or other way of reaching out to users instead of helping big companies and startups made by millionaires. As of Wireguard case, if you've been following all popular threads about it throughout the last 2 months you will know what I am talking about.

Don't let HN to become another ProductHunt.

Is tailscale open source like Tinc?

From the website cannot see it.

I am not saying I don't want those features, but I do hope that a VPN in the kernel with one of its primary features being small, lean, auditable code, will think twice about adding a bunch of stuff.

Have you considered Nebula?

Most of tinc's functionality could be implemented in userspace using the wireguard kernel module, and so wireguard itself won't really need to grow.

The one thing I wish wireguard had was overlapping AllowedIPs with 'ip route via' to distinguish (although this isn't a tinc feature either, unless you run it as an ethernet segment). The same result can be achieved using a separate interface for every peer and 0/0 at each end, but it's a bit unwieldy.

For WireGuard there's the official https://github.com/WireGuard/wg-dynamic, or also this: https://github.com/costela/wesher.

Or generally for mesh networks as others mentioned: Slack's Nebula, ZeroTier (wait for v2) or Tailscale.

k8s already uses Wireguard for the service mesh internally.

For a globally routed overlay mesh, have a look at https://yggdrasil-network.github.io/

The latest version actually uses the Wireguard TUN library https://yggdrasil-network.github.io/2020/02/21/release-v0-3-...

> k8s already uses Wireguard for the service mesh internally.

No it doesn't. There are some CNI plugins that use Wireguard, but it's not standard in any way (like any other network plugin, really).

> k8s already uses Wireguard for the service mesh internally.

Kubernetes does not use anything for the service mesh internally - as it does not provide a service mesh.

By this I can only assume you mean some popular CNI provider uses wireguard, but out of the ones I know of (flannel, weave, calico, canal, romana) I don't believe any use wireguard.

Reply on news.ycombinator.com