upvote

points

by gonzalohm9 hours ago |
comments
upvoteby bradfitz9 hours ago|
next
[-]
(Author here)

WireGuard doesn't do NAT traversal. That's the main thing this adds. And this also adds a CLI tool + library to do streams over WireGuard w/o installing kernel routings, requiring root, etc.

reply
upvoteby fodkodrasz7 hours ago|
prev|
next
[-]
IPSec may be a pain... but WireGuard is as simple as it gets in my opinion. Yeah, you may need to know basic IP concepts, like MTU...

NAT traversal is a different topic, WG won't help in that, and that can actually be a pain. I guess we should be using IPv6 already, and this tool would be largely redundant already. (not completely, encrypted access to isolated networks is a valid use case)

reply
upvoteby derkades6 hours ago|
parent|
[-]
Even without NAT, the same hole punching techniques must be used for IPv6 since there is usually a firewall blocking inbound traffic. Only in CGNAT type scenarios where the network behind NAT is still "WAN" will be helped by IPv6.
reply
upvoteby zikduruqe8 hours ago|
prev|
next
[-]
> it's a pain in the ass to configure it

Public/private key pairs are hard? It's no more terrible than other projects that require configs.

reply
upvoteby gonzalohm6 hours ago|
parent|
[-]
For me the complicated part was understanding the IP assignment for peers and how to set that up correctly
reply
upvoteby mystifyingpoi9 hours ago|
prev|
[-]
> pain in the ass to configure it

Idk? I found it pretty easy to configure by blindly following the tutorials and copy-pasting keys. The only footgun is the keepalive setting, which will screw up the tunnel if one end is behind NAT, that tripped me hard, but besides this, no issues at all.

reply