Hacker News Reader

These things aren't WireGuard's job any more than they were IPSEC's job. What's supposed to happen for people who care a lot about these things is for systems to get built on top of WireGuard to provide them. That's happened for the commercial market, where things like roaming and NAT traversal are key features, and so we have Tailscale. It sounds like you're identifying an open source privacy project built on WireGuard that want to exist. Why not try to put one together?

This is when what makes WireGuard very performing also makes it very difficult to extend. Being in the kernel means extending it in userspace hurts its performance.

Check out innernet, they seem to be doing just fine.

Why extend when most of you might need can be built atop a very performant base layer. Combining wg and namespaces is quite the amazing swissknife.

Please let me know how to build an obfuscation layer on top of kernel-based WireGuard without sacrificing performance.

I'm curious what you mean by 'an obfuscation layer' and the use case around that?

Well then how can you claim “most of you might need can be built atop a very performant base layer” without understanding what the grandparent comment (https://news.ycombinator.com/item?id=28579704) says about WireGuard lacking obfuscation?

WireGuard encrypted UDP packets have obvious signature due to the packet type field in the header being in cleartext. DPI can easily filter/drop WG traffic just by checking the first few bytes of each UDP packet and doing simple statistics.

To obfuscate in this context means to morph WireGuard encrypted UDP packets to look like something else (e.g. VoIP traffic).

Current kernel-based official WireGuard implementations leave no possibility of doing so while staying in-kernel.

So use the userland version. The "obfuscating" VPNs you're talking about all tend to be userland as well.

There goes the performance advantage.

I was answering to the first part of his comment, about bringing the whole kitchen sink in a tunneling protocol instead of having composable tools allowing for things the designers never imagined.

But OK, this doesn't cover the second need, I'm guessing what you need is down one layer, and should be done in kernel if you really think it important, but how does wg prevent you from doing that?

Build your tunnel obfuscator one layer down (I did some stateful, user-land driven, packet patching not long ago, with ebpf, it is not easy but the tooling is getting better. It seems the new way to do things nowadays anyway... And it runs in-kernel. Then lay wg above it. But having the wg codebase do what in fact the kernel should propose (pluggable transports, etc.) seems... asking the wrong team.

The Linux kernel network stack is already plenty composable without ebpf...

These things, like user accounts, more auth methods, flexible endpoints, IP pools, ..., should be integrated in a product in a secure manner. What wireguard does is the irresponsible lazy approach of leaving everything up to the VPN providers and webinterface-monkeys. Who will surely mess up a lot of the upper layers that provide all the necessary "comfort" features. After which the wireguard crowd will wash their hands with the Jobsian "you are holding it wrong".

No, to all of this.

>Last I checked, dynamic server IPs were not supported

you can specify a domain name to connect (so can use a dyndns service)

>it is relatively difficult to say: use this connection for these addresses

you can specify addresses that will go through wireguard. For example: AllowedIPs = 192.168.1.0/24,

Yep! I have a domain on cloudflare (wg.<mydomain>.tld) that my OpenWRT router automatically updates when my IP changes.

I just point my peers at wg.<mydomain>.tld and i'm set! This effectively costs just the registration fee annually (about $7 on cloudflare currently) but could also be done with a free service like no-ip or similar.

I would like a VPN which has pluggable transports, and can, say, look like ssh or http or a game, and route over 20 random servers. I know of shadowsocks etc., but I could never get it to run.

To be pedantic, shadowsocks is a proxy not a VPN but it does what you describe very well, and anecdotally it is better at circumventing the great firewall than wireguard(with its predictable signature it's quickly blocked). Granted I'm not in China anymore and you probably aren't there either, so both wireguard and shadowsocks work really well, but you might want to consider using a proxy over a VPN. If you've had trouble installing SS before, I recommend the streisand ansible script. Connect it to a VPS and it'll install wireguard, shadowsocks with V2ray plugin pointing to github for obfuscation, TOR, OpenVPN and more all at once.

https://github.com/StreisandEffect/streisand

If you're an iOS user and have multiple shadowsocks server, the shadowrocket app makes it very easy to make rulesets that look like so(don't worry there's a UI for it):

https://raw.githubusercontent.com/a00789123/rules-bak/main/S...

You can get specific like "BBC traffic goes through my london proxy, leave netflix un-proxied, twitter traffic goes through germany, etc."

I also do the opposite of VPNing, where I use home PC as a server too so that when I'm traveling I don't get flagged with anti-fraud stuff when I want to check my bank apps and I can watch American Netflix without every worrying about it being blocked.

edit: looks like streisand got archived at the same time as Ubuntu 16.04 got EOL'd. I didnt know because some of my instances have run for years. You can read the discussions on github for some alternative projects.

On your last point, I have a similar problem. I'd like to use WireGuard in a large fleet but the authentication/encryption is just too barebones. You have to generate a keypair for each host and then add that public key to a file on the server. In other words, you can't do it with X509 certificates.

I appreciate WireGuard is designed for simplicity but I don't see how it can scale with this limitation.

Other VPN software will change out their lower layers for wire guard, while keeping things like key management as is.

This is a tempting idea, and maybe it's actually happening, but I do wonder if it's a bit like the hope that git would eventually sprout 'better porcelain' that would obsolete all the clunky bash, perl, etc. scripts that it started out as.

In the end most everyone who uses git puts up with the slowly improving 'mainline' porcelain and all the replacements never go anywhere.

In particular, I imagine it was important for initial adoption to create the android/ios apps but it really feels like now we're stuck with the kind of clunky (super easy for the user, but super hard to get right for the admin of the network imo) flow they created.

> There is a capability in Windows for this, but I never found a VPN where it works properly.

This works with Cisco AnyConnect and Palo Alto GlobalProtect (I've seen it work). Those products are pretty terrible, but that one thing works.

You can use Linux network namespaces to apply it only to processes in that namespace.

Or vrf-lite, ip vrf run <vrfname> <command>

Quite easy to use