▲ 331 points
back
181 comments
I started using Wireguard two days ago to access my home LAN and love it, I can access everything with one command, as if I'm home. The only problem I have with it is the complete lack of documentation. The tutorial refers to a configuration file, but nowhere on the site does it tell you how to write one.
It also took me days to set up what I think is a common use case, logging in to a server/router at home and accessing the rest of the computers in the LAN. I I couldn't find how to forward/masquerade traffic, and it took some help from the good people at #linux to get it set up. I think it would be a great help if they had a configuration file on their site detailing how to set that up.
Lacking that, I'll write an article with my config so the info is at least out there, but I believe Wireguard is held back by its lack of documentation.
> but I believe Wireguard is held back by its lack of documentation.
Indeed having good documentation is super important. I'm not so arrogant as to proclaim, "I don't have time to write docs! Understand it yourself!", but I am stretched super thin, and I suspect that often times documentation from somebody who _isn't_ the creator winds up being a bit better, because exterior perspectives are useful. So it's my hope that somebody can chip in and help out writing tutorials and docs and walkthroughs and whatnot. We really do need it.
From the sound of your message, though, I wonder if maybe you haven't found the man pages (primary documentation source):
https://git.zx2c4.com/WireGuard/about/src/tools/man/wg.8
https://git.zx2c4.com/WireGuard/about/src/tools/man/wg-quick...
I agree. I've been using Wireguard for about 6 months now. The quick start is great for getting a quick overview but it doesn't really document properly how a configuration file should be made.
There is no real detail about how a wg-quick config differs from a wg one, and they're not compatible; it'll complain about unknown keys/values or something if you use a wg-quick config with extra firewall rules and the like with plain wg.
I also saw nothing anywhere about how if you modify your config file and down/up with wg-quick it'll delete anything you entered in your config as the 'down' will write back the current state of the interface. It's not a big deal, but it messes with the usual workflow of editing the config file of a service (you don't want to down it while updating your config, which could take time).
otherwise, wg has been great, it is generally quite reliable on Android but I'd like to see an easier way of doing the exclusions, inverse CIDRs are not my forte.
I've been using wg for over a year now and never had any difficulty finding documentation.
`man wg` works just fine as does `man wg-quick`
https://www.wireguard.com/quickstart/ also shows you how to make a config file
I actually gave up after trying for a while. They mention an "easy" way to do traditional VPN usage, but it never worked, and various blogs have differing opinions on how to properly do that.
I wish there was better hands-on documentation for WG, but I guess it really is an addition to iptables and thus restricted to people versed in that area. Which I am not.
I do intend to try again though.
We have a guide [1] up on using Wireguard and go into some detail on the configuration and how it works. But we mainly use it to build container networks.
[1] https://www.flockport.com/guides/build-wireguard-networks.ht...
The lack of a forum for discussion is also a problem. (Or maybe I'm just spoiled by github.)
There is one feature that I want that should be trivial to add that I don't know how to voice it. There is an AllowIPs config directive, but not an ExcludeIPs directive.
I assume this is what you want?
https://wiki.archlinux.org/index.php/WireGuard#Setup_a_VPN_s...
I've been using Wireguard on both my laptop and my Android phone for about two months. I've been using the wg-quick systemd units, and everything has worked amazingly well. The only downside I've notice is slightly increased battery consumption on my phone, but that's to be expected (it uses approximately 5% of the battery per day).
I use dnsmasq to resolve DNS queries on the server side. Dnsmasq's configuration file includes entries to block connections to ad networks, based on Steven Black's host file [0]. It's a great to achieve ad blocking on Android, since Google has banned ad blockers from the Play Store.
Jason Donenfeld, Wireguard's author, has a Patreon page: https://www.patreon.com/zx2c4
> The only downside I've notice is slightly increased battery consumption on my phone, but that's to be expected (it uses approximately 5% of the battery per day).
Note that if you run a phone that has the WireGuard kernel module (rather than the userspace implementation), battery usage winds up being basically nil in my tests.
As for the userspace fallback, we expect performance (and hence battery life) to increase on that once these are merged:
https://go-review.googlesource.com/c/crypto/+/107628 https://go-review.googlesource.com/c/crypto/+/105896
> The only downside I've notice is slightly increased battery consumption on my phone, but that's to be expected (it uses approximately 5% of the battery per day).
I believe that Android does not accurately represent the battery usage of VPN apps. It seems to count all the radio (i.e. mobile and Wi-Fi) usage against the VPN app, but actually the traffic was sent only because some other app requested its transmission. WireGuard itself uses zero battery if no network traffic is being passed and the NAT keepalive mode is off. (at least this is true in the abstract, it might run occasional timers to update system information as Android requires)
You can install pretty easy the F-Droid repository / store and download DNS66 from there. ( FOSS Ad-Blocking via DNS ).
> it uses approximately 5% of the battery per day
OpenVPN uses about 20% of mine, so I guess it really is a step forward.
Also, for your DNS lying file, you might be interested in: https://gitlab.com/moviuro/moviuro.bin/blob/master/lie-to-me (which sources multiple domain lists)
>slightly increased battery consumption on my phone, but that's to be expected (it uses approximately 5% of the battery per day).
Are you using the user-space implementation or the kernel module? I'm curious as to the difference in battery consumption.
What's the benefit of running this on your Android phone? Are you connecting back to a home/cloud server and accessing the Internet through that?
I can't wait until pfSense supports it. That'll be the moment I'll set the OpenVPN config on fire, because honestly, OpenVPN configs are magic and if it's not generated by some UI wizard, it's probably broken in some scenario. And even if you do the wizard, it's probably broken.
Atm I have that funny bug where my laptop drops connection after 3 seconds but my desktop does fine. With the same configuration! Thank OVPN for that annoyance!
> Thank OVPN for that annoyance!
Certainly, you reported that issue through proper channels, and attached detailled information regarding your hardware, software, as well as packet logs?
OpenVPN is really not that hard to configure, and I'm pretty darn sure my config isnt broken (it's been audited at least twice.)
I've been using WireGuard on my router for the last 6 months, and it's fantastic. I get the full speed of my line through it, when OpenVPN was only giving me 20%. Because of the great plugin they have for Vyatta I'm going to be looking at using it for some stuff at work now too.
How did you install it on your router? I'm assuming this isn't a throwaway $30 consumer router?
Only 20%? How did you test this? I'm currently using OpenVPN but am looking at Wireguard.
Great news. I started using Wireguard instead of OpenVPN and won't look back. Actually it was easy to set up even with DKMS kernel modules but having it in mainline will be great.
Can you explain what makes it better than venerable old OpenVPN?
Do you only use it to connect remotely into your home network or are there VPN Services for wireguard available?
They are trying to get a completely new crypto interface into the kernel, and they are posting the patches to linux-netdev mailing list.
This is not gonna fly.
You may want to check out the very nice presentation on WireGuard at Kernel Recipes:
https://www.youtube.com/watch?v=9Rk4doELmwM
The biggest issue we’ve encountered with WireGuard is that it doesn’t (yet?) support GRO, which means the kernel doesn’t combine multiple sequential TCP frames inside the tunnel into one before presenting it to a program. This increases RTT by a significant amount.
There's no next message in this thread? Huh?
This mail archive works:
I had the pleasure to meet Jason at 34C3 past winter, he's incredibly capable and I really hope this goes through somehow.
After using WireGuard you really don't want to go back to the horrible IPSec/OpenVPN solutions.
I can foresee a long, long and mostly pointless discussion/argument about code line length.
Why does this need to be included in the kernel directly and not just as a loadable module?
How would this compare to ZeroTier? (zerotier.com)
The only downside with WireGuard for me is that it only works over UDP. I am in a situation where I only have two or three TCP ports available for a VPN, so I won't be moving off OpenVPN anytime soon.
I was following WG development for a while now and I think it's a great project, but sadly not for my particular use case.
So, since lots of people here have experience with VPN, I'd like to ask theoretical project question:
I have distant family memebers, and it'd be nice to have a simple way to get devices on the same network easily.
My initial thought would be to setup a VPN server somewhere central and fast, and then distribute wireless routers with custom firmware that they could plugin to their network. Then anything they connect to that router would be connected to the VPN (because the router is pre-setup to connect to the VPN).
Is that doable? Is it a good idea? I know just enough about networking to be dangerous...
I have a VPS I use for VPN, which means, unfortunately, no custom kernels or kernel modules. So, I'm stuck with OpenVPN. It would be awesome to have WireGuard included in the kernel by default.
I'd love to see this included as part of the next macOS / iOS.
The only thing I don;t like about current WireGuard is that the single config file contains both the private key in clear, and all the public keys.
IMHO the private keys should be in a separate file.
It's super easy to configure overall. But I know how to configure networing under Linux. The only thing I struggled with was AllowedIps concept, because that was the most unfamiliar thing to me.
I use WireGuard to give my IPv4 only home computers fixed IPv6 addresses and connectivity via my VPS. It also serves as a sort of overlay network, where my devices despite not having a fixed IP address, are still reachable on a WireGuard network via my VPS.
Great to hear that.
What's the status with the official Windows client?
So I can use this as a secure proxy to get around region restrictions? In the same way I do ssh -D? And then configure the proxy on my browser?
Really recommend if your systemd is up to date, describing your wg interfaces in .netdev files. Really clean, starting to really like systemd with things like this...
is there a way for linux desktop to have some apps go through wireguard tunnel, and other apps to go through regular network interface?
Is there any paid VPN provider that supports it?
This is great News!
Which of the popular VPN offer wireguard? Pia doesn't.
this news is lit!
i remember using wireguard seems decent.