List of software and things that use or support WireGuard

https://ianix.com/wireguard/wireguard-deployment.html

by _3lin • 6 years ago

109 38 6 years ago

jorvi3• 6 years ago

It is recommended to use official WireGuard software whenever possible.

I don't agree with his sentiment at all. With OpenVPN Viscosity is by far the best OpenVPN client and both the 'official' client (OpenVPN) and the open source alternative (Tunnelblick) are buggy and have crappy UI. I'm hoping Sparklabs either repurpose Viscosity to include WireGuard as well, or write a new client specifically for WireGuard (which I'd happily buy).

Edit: wow, what the hell. I guess HN hates improved clients with a violent passion.

catalogia2• 6 years ago

What does OpenVPN having a shitty official client have to do with wireguard?

kylek2• 6 years ago

I think it's less about openvpn and more about having the protocol integrated with existing enterprise products/infrastructure/paradigms.

jorvi3• 6 years ago

Both the iOS and macOS Wireguard client are functional but they aren't shining examples of great UI, UX or feature richness. Often 3rd party clients (as happened with OpenVPN) will fill that gap.

ecnahc515• 6 years ago

All of the "clients" you mentioned are just "frontends". They all just produce openvpn configuration files and run the official OpenVPN client. Some of them (Viscosity) use the remote control daemon protocol, to more directly integrate with the openvpn client, but it's still the standard openvpn client doing the bulk of the work. These frontends are just UIs, not full fledged clients.

jorvi3• 6 years ago

I obviously mean the clients as in the GUI clients, not the core binary. For OpenVPN that would be OpenVPN-GUI[0]

[0] https://openvpn.net/community-downloads/

leeoniya4• 6 years ago

OPNsense 19.7 supports WireGuard

yep, can confirm :)

currently running on this passively-cooled thing:

https://www.amazon.com/Firewall-Micro-Appliance-Gigabit-AES-...

oneplane4• 6 years ago

That's pretty expensive for what is essentially a rebranded Qotom. On the other hand, if you are in the USA, it's probably a good choice.

OPNSense 20+ also support WireGuard just in case someone gets confused about that specific version reference.

leeoniya4• 6 years ago

i think still in the ballpark for an Atom, 8GB RAM, 128GB mSATA config. could not find exactly that model, but this one's close:

https://www.aliexpress.com/item/32740319382.html

anyways, the price difference is not terribly relevant at this pricepoint for a qty of 1 upgraded every 5-10 years.

mech422• 6 years ago

I really like the Odroid H2's... https://ameridroid.com/products/odroid-h2 On backorder atm - but I have 3 currently tricked out with 16G RAM and 2x200G SATA SSD. Total cost was less then $250/unit.

jms703• 6 years ago

The ProtectLi boxes might cost a little bit more, but they seem to be really well made and of good quality. I moved from a PCEngines APU to a ProtectLi because I needed faster packet forwarding performance when I upgraded my home internet connection to 1 Gbps.

leeoniya4• 6 years ago

i should mention, it also acts as a pi-hole via dnsmasq configured with these hosts:

https://github.com/StevenBlack/hosts

lonelappde• 6 years ago

Why are you dedicating a full power desktop computer as a firewall?

ac29• 6 years ago

Most of us here wouldn't want to use an Atom processor from 2013 for our "full power desktops"...

More seriously though, there are lots of tasks that can go on a home router that take it past a simple firewall. IPS/IDS systems, Advanced QoS, OpenVPN -- all these things can require fairly significant hardware resources to run anywhere close to the 100-1000Mbps speeds on internet connections that are reasonably widespread and affordable in many countries now.

leeoniya4• 6 years ago

OPNSense requires AES-NI, which is an intel feature so you're stuck with an Intel CPU. Atoms are one of the more efficient intel options if you want passive cooling. as a sibling comment mentions, another option is an odroid-h2.

either way, i'd rather over-provision for an extra $150 than discover i need all new hardware when my requirements change.

kgersen• 6 years ago

managed wieguard: https://tailscale.com/

ornornor• 6 years ago

I’d like to try it but why force users to login with either gmail or Microsoft? What’s wrong with a plain old username/any other email provider and password?

cpuguy83• 6 years ago

They addressed this in another post on HN.

Basically they don't want to manage U/P. They are looking at other services as well (such as github).

microtherion2• 6 years ago

Yes, its omission from the article seemed like an important oversight to me.

v8engine• 6 years ago

I see it in the "Other WireGuard goodies" section.

clairity• 6 years ago

"wireguard-vanity-address[0] — generate Wireguard keypairs with a given prefix string"

generating 4-5 character-prefixed keys seems to up the chances of collision by many orders of magnitude, right? but even so, is that enough of a concern to not use such a tool?

[0] https://github.com/warner/wireguard-vanity-address

devttyeu• 6 years ago

It doesn't, you still have to do the same amount of work to find the collisions.

Znafon• 6 years ago

It's just a brute force so I think it should not matter. Once you find a public key that match what you are looking for you have the same amount of work to do to find the private key.

It would be different if it was to generate a private key that matches the prefix.

geraldcombs• 6 years ago

Is there a way to suggest additions to the page? Wireshark supports WireGuard dissection and decryption[1], and the pcapng[2] file format has a block type defined for WireGuard secrets.

[1]https://wiki.wireshark.org/WireGuard

[2]https://github.com/pcapng/pcapng

st3fan• 6 years ago

You can add Firefox VPN to the list too.

roamerz• 6 years ago

Maybe a little OT but any word of a FIPS 140 implementation of this protocol? Would make the adoption of this in an enterprise environment possible.

ausjke• 6 years ago

a very good questions indeed, but that means you need certify lots of kernel crypto modules for whatever wireguard depends on, redhat has fips-140 kernel so I assume it will do something similar to wireguard, as redhat will want to sell this to governments etc

mobilio• 6 years ago

TunSafe also works on iOS, Android, Linux and Windows. Not just on macOS!

kamyarg• 6 years ago

https://github.com/trailofbits/algo Also supports it.

Have been using it for personal VPN deployments, very easy to use and each time I notice they have made moves to be more secure.

List of software and things that use or support WireGuard

Related Stories