Hacker News Reader

Comment by ghostpepper | Hacker News Reader

The ball's in your court, Ubiquiti

Yeah well don't hold your breath :(. Ubiquiti has been a cluster fuck for a while now and are busy redoing and downgrading the UI again for like the 3rd or 4th time in the last few years rather then add desperately needed basic features. They've released new gateway devices with their own new distro based around containerization, then not actually put that to work at all. DNS still a joke. Zero story for key&certificate management/let's encrypt/etc.

Maybe Pera will get hit by a bus and things will get turned around but otherwise it's a sad mess and waste of potential.

What features are they needing to add?

Not ubiquiti's doing but this repo has pre-built kernel modules of wireguard and vyatta integration for I think most of the edgerouter series: https://github.com/WireGuard/wireguard-vyatta-ubnt

I haven't updated/tested in awhile but last I remember I was seeing 800+ mbit/s on my dinky mips ER-X. Pretty amazing and easy to use.

We built an Ansible role to install and configure Wireguard on EdgeOS. It works well on EdgeRouter Infinity ER-8-XG and EdgeRouter X.

https://github.com/dynamist/ansible-role-wireguard-vyatta

This repo appears to use Lochnair's old builds, which are unmaintained/deprecated and replaced with the official ones linked to by GP.

Can confirm, way back I wrote a small guide on how to install and configure Wireguard on the ER-X (and other EdgeRouters), and to date this article is still by far the most read one: https://merlinscholz.name/post/wireguard-on-erx/

Unfortunately 3rd party software installs are lost on updates, so you need to be local to the router before upgrading (or have a secondary VPN available).

Development of EdgeOS has really slowed down though, there hasnt been a stable firmware update in 6 months (and that was just a small hotfix).

It's not.

Why would one want that workload on their router when they can offload it to a $35 Pi?

Because then you don't have to run an additional $35 Pi.

And apply updates to it...

I understand that amateurs love the Pi and other underpowered, junk hardware, but not everybody wants yet another science project in their life.

"It's free!" they say, if you can get it to run The Geeks say, "Hey, that's half the fun!" Yeah, but I got a girlfriend, and things to get done The Linux OS SUCKS (I'm sorry to say it, but it does.)

https://genius.com/Three-dead-trolls-in-a-baggie-every-os-su...

I was about to be annoyed by this comment until I saw it in the context of a song about how every operating sucks, which, when framed like that, I can't help but agree with. ;) (although I will say that I've been having a better time w/ arch linux + dwm lately than any OS / setup I've ever used-- but then again I also love raspberry pis, have like 3 of them, and am, in fact, using one to run dnsmasq / wireguard, so... xD)

IDK if you know, but it seems you're shadow banned. Which I find annoying because I wanted to reply to another post you wrote.

One of the main selling points of Wireguard is that it runs much leaner than OpenVPN or IPSec tunnels, especially on embedded hardware, so there isn’t much of a workload in the first place.

Crypto used by IPSec (aes, sha) is often accelerated by hardware - and the above mentioned Ubiquiti has hardware for that. Chacha/Poly used by Wireguard are not.

There’s a benchmark done with the EdgeRouter that shows that Wireguard’s throughput exceeds that of hardware accelerated AES + IPSec:

https://an.undulating.space/post/181227-er_alternate_firmwar...

Of course, benchmarks from random strangers are not gospel, and the results aren’t particularly damning. But even then, you’re assuming that you have the luxury of running on a chip that comes with a hardware crypto engine. Good luck trying to get AES encryption/decryption speeds at anywhere near line rate with a Raspberry Pi or a run-of-the-mill router.

IPsec is pretty light.

Doesn't feel light to setup if you're trying to get a tunnel working between different providers. We had a strange dead peer issue between Fortigate and Mikrotik and could never figure it out as it happened so rarely. All phase 1 and phase 2 settings were identical. I can imagine that happens elsewhere too.

Try enabling Dead Peer Detection (DPD).

Both sides had that on from the beginning.

everything's a lot easier if you can do routing on the router

There are also benefits to running your VPN endpoint on your network gateway - otherwise it can be difficult to configure routing tables to allow a user connecting from outside the network to access both internal and Internet IPs from the tunnel endpoint.

Reply on news.ycombinator.com