WireGuard: next generation in-kernel modern VPN

Re:WireGuard: next generation in-kernel modern VPN by viraptor on Tuesday June 28, 2016 @08:19PM (#11998629)

You seem to talk about a completely different use of VPN. The "VPN server you route all internet access through" is a glorified encrypting web proxy. There's no "server" in WireGuard as far as I can tell - it's only peers which expose whole networks behind them. Both use cases call for very different solutions: The corporate-style VPN protects your networks and remote endpoints from someone random connecting to them. The glorified web-proxy style VPN needs to mainly encrypt all the outgoing traffic.

I doubt WG is a real candidate for the case you're talking about.

[ Parent | on HN ]

Re:WireGuard: next generation in-kernel modern VPN by comex on Tuesday June 28, 2016 @09:23PM (#11998885)

It's very common to use existing VPN protocols for proxying - Google "VPN" and you'll find many commercial services. And the WireGuard white paper mentions passing all traffic to a single peer as a possible configuration, so I think it should be usable for it as well, modulo OS compatibility. Which is good, because existing VPN software suffers from the same configuration and security headaches whether it's used for proxying or corporate networks, and non-VPN proxies are an inadequate solution.

Web proxies are suboptimal because they only work with web traffic, or even if you use HTTP CONNECT, only TCP. SOCKS is mildly better at a protocol level, with SOCKS5 supporting both TCP and UDP, but still suboptimal if the server end is able to give each client its own IP address (not so common with IPv4 but easy with IPv6), due to the existence of protocols other than TCP and UDP. More importantly in practice, SOCKS clients are typically implemented in userland rather than the kernel, so each individual application needs to be configured to use the tunnel. There is software that lets you use any program with SOCKS by hooking socket API calls, but that's essentially a hack, and has many practical issues. Much nicer to just have the tunnel as a network interface like any other, and let the kernel's network stack work as it was designed - which is usually done with VPN software. VPN also lets one host transparently handle proxying for another, e.g. a router for a home network, or the host in the VM setup I mentioned in my original post.

[ Parent | on HN ]

Re:WireGuard: next generation in-kernel modern VPN by viraptor on Tuesday June 28, 2016 @09:54PM (#11999014)

I think you missed my point. Sure, every VPN solution can be turned into "proxy all internet traffic through there" with enough configuration. What I meant is that tptacek was talking about commercial/serious VPN as in corporate usage, not commercial as in "it takes money from anyone".

You're talking about two completely different use cases with very different goals and potential issues.

[ Parent | on HN ]

Re:WireGuard: next generation in-kernel modern VPN by comex on Tuesday June 28, 2016 @11:23PM (#11999289)

You said that WireGuard was not "a real candidate for the case you're talking about", and I explained why it being (eventually) widely adopted for that case is both possible and desirable. I don't see much point in arguing over what tptacek meant.

[ Parent | on HN ]

Re:WireGuard: next generation in-kernel modern VPN by tptacek on Wednesday June 29, 2016 @01:45PM (#12003249)

I think your point, about people using VPNs in situations where their personal computer is more valuable than the VPN connection, is well taken.

[ Parent | on HN ]