Hacker News Reader

Comment by sys42590 | Hacker News Reader

I recently switched from Tinc to Wireguard (4 machines) due to simpler configuration and better support for road warriors. Transition was quite painless.

View on HN

When you say 4 machines, do you mean a mesh between 4 machines? And it's not hub-and-spoke? I'm looking for a solution like that but because my portable devices can be anywhere in the world I had to use a hub-and-spoke setup where there is one central VPS that they can all connect through.

It's full mesh with 3 fixed servers and one machine with a dynamic IP. Just configured all peerings in WG instead of Tinc. I don't need Tinc's mesh routing, so WG is sufficient for me.

You can do a full non-hub mesh with Wireguard if 1) you can find a NAT hole punching method that works (usually can), and 2) you have some means of passing peer information between them, which also means you need to use a means to get at your external IP and port. If you don't have a reliable way of getting the external IP and port for all of them, if one of them supports port forwarding, just a basic dynamic DNS provider to get one of the dynamic external IPs is enough - you can then get the rest by hitting the first one.

Note that "some means" of exchanging data here really is any way of communicating at all. Post an encoded string to a Mastodon server? Send you an e-mail that's automatically picked up?

Also if 3) if you have the energy to write and maintain some stateful thingy that manages this dynamic peer information you need to pass around. And while doable, a hack in bash won't cut it if you want reliability and the occasional introspection when things go wrong.

It's a no for me.

You could try https://nordvpn.com/meshnet/ - it's wireguard, cross platform and meshnet handles everything automatically for you. Also meshnet is free so if you don't want to use vpn you won't have to pay anything.

A hack in whatever language works just fine, and depending on your setup you may not need any hacks at all - e.g. of you have dynamic DNS and port forwarding set up for one of your peers. It's not a beginner option, but it's an option that is simple for most common setups if you know what you're doing.

Reply on news.ycombinator.com