News for hackers. Stuff that matters.
Re:A Mechanised Cryptographic Proof of the WireGuard VPN Pro... by KaiserPro on Monday May 13, 2019 @06:51AM (#19897912)
it is usable.

For ubuntu/debian there is a package that installs everything. The config is very simple, more simple than openvpn.

For mobile there are "official" clients, that use QR codes for config.

Re:A Mechanised Cryptographic Proof of the WireGuard VPN Pro... by dewey on Monday May 13, 2019 @07:01AM (#19897962)
I'm probably not the target audience but I'd say that it's usable but still not very straight forward to set up. Yes it has less options than OpenVPN but with a bunch of tutorials I was usually able to get OpenVPN set it up and have my traffic flow through it in 30 min.

Following tutorials like this https://www.stavros.io/posts/how-to-configure-wireguard/ (which seems like a good one from a fellow HN user) always seems to work that I'm able to connect to the server but my internet doesn't work after running it. Probably something related to the IP tables rules or firewall I assume?

I'm using the official mac client and Ubuntu 18.10 running on a server at OVH.

Re:A Mechanised Cryptographic Proof of the WireGuard VPN Pro... by cyphar on Monday May 13, 2019 @07:35AM (#19898187)
I have a script that will generate the server config and auto-generate the client configurations for you[1]. In short, the primary thing you need to remember to add is:

    PostUp   = iptables -A FORWARD -i %i -j ACCEPT
    PostUp   = iptables -A FORWARD -o %i -j ACCEPT
    PostUp   = iptables -t nat -A POSTROUTING -o $HOST_NIC -j MASQUERADE
    PostDown = iptables -D FORWARD -i %i -j ACCEPT
    PostDown = iptables -D FORWARD -o %i -j ACCEPT
    PostDown = iptables -t nat -D POSTROUTING -o $HOST_NIC -j MASQUERADE
To your server's .conf file (using wg-quick). HOST_NIC is eth0 or whatever your server gets its internet from. You also need to enable IP forwarding:

    sysctl -w net.ipv4.ip_forward=1
(If you want to use IPv6 too, make sure to add the corresponding ip6tables and net.ipv6.conf.all.forwarding=1 bits.)

[1]: https://github.com/cyphar/dotfiles/blob/master/.local/bin/wg...

Re:A Mechanised Cryptographic Proof of the WireGuard VPN Pro... by IOT_Apprentice on Monday May 13, 2019 @12:03PM (#19900626)
That is very slick.

I'm still working on getting ipv6 working correctly configured when I'm on work wifi, which is both ipv4/ipv6. Traffic flows fine on my personal iphone X with wireguard from home.

Our IT has reddit.com blocked and somehow my connection to reddit is being blocked still even though wireguard and 1.1.1.1 are setup on my VPS/wireguard setup.

Re:A Mechanised Cryptographic Proof of the WireGuard VPN Pro... by pR0Ps on Monday May 13, 2019 @01:09PM (#19901339)
Something you may want to look into is the client MTU setting.

When I was setting up WireGuard on macOS Mojave it would connect but I wouldn't be able to load pages. Other devices didn't have any issues so the server config was fine. Turns out the autodetected MTU was too large and the packets were getting dropped. A dead giveaway that this is happening is that pages will (mostly) load over HTTP, but get stuck negotiating a secure connection over HTTPS. I'm guessing this is because of the larger packet sizes required to do the handshake.

Try setting to something really low like 100 to see if things start working and adjust from there.