WireGuard: Great protocol, but skip the Mac app

https://rachelbythebay.com/w/2020/12/24/wg/

by picture • 6 years ago

115 104 6 years ago

Making a bug report would be better :)

But yeah Apple doesn't make it any easier with vpns on big Sur, they have to use a new type e of extension now and they exclude their own services automatically.

Not something that seems related to these issues but it make macOS one again less interesting for me as daily driver

boardwaalk• 6 years ago

and they exclude their own services automatically.

Unless you have information otherwise, I don't think that the whitelist applied to the filtering features used by Little Snitch et al also applies to VPNs.

st3fan• 6 years ago

Correct. There is no exception for apples own apps to skip the active VPN connection.

How could there be? Things would break and it would be a privacy nightmare.

tssva2• 6 years ago

While it may be good from an encryption and basic security configuration perspective I find wireguard lacking from a networking and administration perspective.

Networking wise it implements a point to multipoint model which is just awful to deal with. I had hoped that moving on from frame relay and ATM had killed this model but wireguard brings it right back. Then you also have to deal with complications of wireguard interfaces always being up. The two combined means doing anything but the most basic setups means more complicationd with more chance for incorrect configuration than an ipsec or openvpn alternative.

Then there is the whole troubleshooting problem. When it doesn't work wireguard provides much less information to troubleshoot the issue than ipsec and openvpn.

Also there is the irritating lines of code comparison vs ipsec and openvpn when for the most part it is comparing apples to oranges since wireguard doesn't include many of the features of either which are required for an enterprise site to site or road warrior VPN solution. Once the solutions are in place to provide comparable functionality the attack surface is likely to be pretty comparable.

tptacek6• 6 years ago

I've done a lot of professional work over the past few months† with WireGuard and can't think of a piece of information I've ever needed to troubleshoot it that it doesn't provide. You know about `dynamic_debug`, right?

There's also just not that much to debug! You've got keys, allowed IP lists, and endpoint addresses. There aren't a lot of other knobs to turn!

I think a thing that gets people into trouble with WireGuard is not understanding how modest its design is. The goal of WireGuard is to drop into the networking stack as just another interface. It doesn't intend to implement an entire new networking model on top of itself. My experience has generally been, if it's straightforward to express in the Linux networking model, it's straightforward with WireGuard.

I think this is a very good thing. I really don't want to have to think about what the OpenVPN developers believe about networking in general. I want to bring up secure transports and route packets over them the way I'd route over any other tunnel I want orthogonal, predictable interfaces that I (or Tailscale, or whatever) can build more complicated things on top of.

† https://fly.io/blog/ipv6-wireguard-peering/

3np3• 6 years ago

Could you elaborate on how these issues and limitations you mention can manifest in practice? I’ve set up a couple of different topologies and haven’t felt limited yet.

Though troubleshooting packet loss is not fun and I haven’t been able to figure out how to avoid that and fragmentation, but I believe that’s more due to me than WG itself.

tptacek6• 6 years ago

What's the fragmentation issue you're having?

mercora3• 6 years ago

not op but one issue i have with it is that it ignores the routing table as soon the packet hits the interface. what i mean is if i tell the linux network stack to route packets "via" some address (which normally would involve arp) this configuration is completely ignored and the packet gets routed to whatever endpoint has the destination address as (confusingly named) AllowedIP address set. I expected it to do the lookup based on that via address and was trying to figure out what went wrong way too long. I think it would be kinda trivial to do this as i expected it after some minor research but that also led me to think it is supposed to be this way for some reason or another.

Koiwai• 6 years ago

The philosophy is: use external tools to manage what you're describing, like cloudflare warp, WG itself is designed to be as simple as it is.

IPSec is just like that, it's just wireguard can be manually setup with the minimal wg command, while nobody uses IPSec barehanded.

Brian_K_White2• 6 years ago

Every communication method is point to point at some layer.

If wg is a low layer that only attempts to do the tunneling job and leaves the routing and directory jobs to others, that seems just fine to me.

I prefer seperation of concernes.

tssva2• 6 years ago

wireguard interfaces aren't point to point. Point to point would be much better than the point to multipoint interface model wireguard has chosen.

Wireguard claims separation of concerns but then sticks itself in the routing and packet filtering process instead of leaving those wholly to the existing established solutions.

pthreads3• 6 years ago

I have had the opposite experience to OP. I have the macOS app installed on several Macs (laptops and desktops). They have all worked so well to the point that I even forget Wireguard is running. On top of that I upgrade macOS almost as soon as Apple releases a new version.

It is true that for updating WG you need to first disable the on-demand setting (probably only on Big Sur). But to me that is such a trivial hiccup considering it is free and generally bug free! On the rare occasions that I have had a non-trivial issue looking at the log file has provided clues.

My VPN cost is only about $5/month as I run my own instance of WG server in the cloud. Worth every penny! It is possible it could be lower if I use one of those #3.50/month AWS lightsail instances but I never tried.

Go WG!

syntaxing• 6 years ago

Any tips on how to run your own server safely? I get all paranoid because I’m terrible with security.

mfcl2• 6 years ago

By practicing. Run it anyway and get good at it.

colesantiago4• 6 years ago

or you can use mullvad.net (supports wireguard protocol)

no activity logs

does not ask for personal information

anonymous payments via cash or cryptocurrencies

no subscription

hides your device's activity.

pthreads3• 6 years ago

Just replied to another comment. Hope that helps.

scaladev2• 6 years ago

https://github.com/trailofbits/algo

https://github.com/StreisandEffect/streisand

ncmncm• 6 years ago

Wireguard Bounce Server setup: <https://news.ycombinator.com/item?id=25447805>

daboosh• 6 years ago

https://github.com/boosh/dawg

One command, and allows you to shut the server down when you don't need it. I might add support for lightsail too.

joveian• 6 years ago

I use a Debian OpenVZ based VPS for this and uninstall or disable any services except the one I want (surprisingly this isn't the default :(, check what is listening with "ss -l46n"). The advantage of OpenVZ is that kernel patching is the job of the provider, so if you only have one service listening remotely then you should be ok as long as that service is ok.

I use SSH so far since WireGuard isn't supported yet. I also configure SSH to only allow the type of connection I want to use: public key authentication only, ports 80 and 443, plus (on both local and remote sides):

  Ciphers=chacha20-poly1305@openssh.com
  KexAlgorithms=curve25519-sha256,curve25519-sha256@libssh.org
  HostKeyAlgorithms=ssh-ed25519-cert-v01@openssh.com,ssh-ed25519
  MACs=hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com

Install unattended-upgrades and edit /etc/apt/apt.conf.d/50unattended-upgrades as desired. For SSH proxy, locally set "ALL_PROXY=socks5://127.0.0.1:2000" (with DynamicForward localhost:2000 locally). Or change socks5 to socks5h if you want DNS to be handled on the remote system, however this will prevent uMatrix and other blockers from getting DNS info needed to avoid considering some 3rd party content as 1st party so it is better to set up encrypted DNS locally (I use stubby but with just the provider I want). Many applications check ALL_PROXY these days but not all and I think Firefox needs explicit settings to use the proxy.

I use ramnode.com's $15/year OpenVZ and it works great like this for getting an encrypted connection past your local ISP and/or wifi (I think they ask for everyone's ID when you start). There are issues with some websites due to the IP address, but it is not nearly as many as using an annonymous VPN from what I've heard.

m3nu• 6 years ago

Same here. Using the Mac app every other day and works well.

867-5309• 6 years ago

what made you choose trusting a cloud provider with your ingress/egress rather than a VPN provider?

pthreads3• 6 years ago

a. I don't trust any VPN provider's claims. Plus I wanted more control including ability to turn on/off logs if needed. As an experiment I started with an AWS lightsail instance. It worked so well that I now I don't feel I need anything with more resources (up to about 10 clients). That doesn't mean I trust AWS entirely but for now I will live with it. I like using a CLI and AWS's browser based CLI is pretty good (but be wary of copy-paste snafus).

b. The other reason I went with a cloud provider like AWS is that their static IP seems to be whitelisted fairly well especially with their own service - Amazon Prime. So I have had not problem watching videos while traveling. Also in the past macOS and iOS updates were problematic via VPN. But that seems to have gone away. Maybe because they bypass VPN? I don't know for sure.

c. Many of my friends have been asking for help. I figured if I went with one of the big 3 cloud providers it would be easy for me to basically create an instance image preloaded with all the scripts and WG etc. that they can then run from their own accounts.

d. The big 3 cloud providers uptimes are far better than many of the VPN providers.

viraptor• 6 years ago

There's an internet provider (usually unknown / changing) behind every VPN provider. Whichever VPN provider you use, you may be implicitly trusting any of the good provider at any point in time.

sneak6• 6 years ago

It is true that for updating WG you need to first disable the on-demand setting (probably only on Big Sur).

Which means shutting down the VPN, and exposing your hardware serial (the MAS app transmits this to Apple, along with your Apple ID) and true IP (which is equivalent to your city-level location) to Apple.

Not a great state of affairs.

cpach• 6 years ago

If one does not want the serial transmitted to Apple, a better solution is probably to switch to another OS.

I honestly see no problem with Apple knowing the IP address. It’s the same with Windows 10, since it will check for Windows updates frequently.

If you see these things as a problem it’s probably best to use Qubes OS instead.

zacharyozer• 6 years ago

Had exactly the same experience. Definitely annoying, but more that anything else, I’m impressed that Rachel was able to turn it into cogent blog post.

Jamie99123• 6 years ago

Skip the Windows app too, I wish it was exactly like this client https://tunsafe.com/ (made by the Spotify dev Strigeus)

tptacek6• 6 years ago

Does Donenfeld vouch for Tunsafe? I'd be reluctant to use a WireGuard client he didn't endorse, if only because I've been on the sidelines in conversations about VPN client software vulnerabilities and I know he's careful about this stuff (Donenfeld's background is in vuln research). There is more to get right than just the protocol.

Jamie99123• 6 years ago

I don't think he does, Tunsafe implements Wireguard, but it hasn't been updated for maybe 2 years now. Still, the UI is so much nicer than the Wireguard one

drummer• 6 years ago

I used this, was easy to setup. Recommend checking it out as well.

StavrosK• 6 years ago

Why not just use that? Looks like it uses WireGuard under the hood.

Jamie99123• 6 years ago

It sadly doesn't get updates anymore, but still works for now at least

pvg• 6 years ago

If the UI is more important to you than the security of your VPN, by all means but I think for most uses this is questionable advice. TunSafe development has been dormant for years, the official WireGuard client fixed one of its bigger Windows UI quirks just recently.

alibert• 6 years ago

Did you try the recent v0.3.x series? It fixed a lot of Windows specific bugs.

I have been running the official Windows version for a while now, using it almost 8h/day and it's working flawlessly for me.

Shank• 6 years ago

I’m still sad about the state of WireGuard for average consumers. The protocol and the underlying tools are a simple and nice in a UNIX-like way, but for average people, it’s a wash. WireGuard would benefit greatly from a set of robust, easy to understand clients.

The current state of the world, where many VPN providers ship questionable apps of varying quality, is just sad for a solution that claims to prioritize security and privacy. The WireGuard app is somewhat useable, but it is by no means “easy to setup” unless you’re already familiar with how WireGuard works.

pxeboot• 6 years ago

I found the Android client very easy to use. You can import a config file or scan a QR code to setup a profile. If you know what you are doing, you can setup it up manually.

Compared to the Cisco client we use for work, wireguard seemed better in every way.

SomaticPirate• 6 years ago

Isn’t this what Tailscale claims to fix? Zero config VPN on top of Wireguard? Would love for one of the creators to weigh in.

BostonEnginerd• 6 years ago

I totally understand why the Tailscale folks do it this way, but I don't really want to link my Google or MS accounts to my private VPN. The product looks fantastic though!!

tptacek6• 6 years ago

It is a disgustingly well designed product. Go kick the tires and you'll see what I mean. It's just alarming.

UI_at_80x24• 6 years ago

To make the WireGuard windows app better (for non-admin users) you need to make your user(s) a member of the "Network Configuration Operators" group.

This allows you enable/disable (or choose if you have multiple) the VPN without needing to be a member of the Administrators group. You also need to add a line to the registry.

Here's the powershell code to do that:

  New-ItemProperty "hklm:\software\wireguard" -Name "LimitedOperatorUI" -Value 1 -PropertyType "DWord" -Force

  Add-LocalGroupMember -Group "Network Configuration Operators" -Member "$username"

grandinj• 6 years ago

That sounds like a good idea that should be added to the WireGuard installer? Perhaps log a feature request?

est• 6 years ago

it used to just 2 clicks on a control panel.

control userpasswords2

A simple user account managing interface hidden in a myriad of crap dashboards.

nominated12• 6 years ago

Wireguard won't upgrade itself if it's still running…

This is not unique to Wireguard. I’ve had this happen with the Lockdown app too. This is an Apple problem. Apple should notify you that the VPN app needs to close in order to upgrade then offer you a simple way of doing that.

I don't know exactly, and I don't really care.

This about sums it up. This is a rant and it’s difficult not to just close tab half way through.

pram• 6 years ago

Strange omission, considering automatically updating Safari extensions asks you to exit Safari when it happens.

plussed_reader• 6 years ago

Purposeful 1st party omission.

Or maybe an oversight by Wireguard, but with the way Apple limits API access in iOS for 3rd party I'm non-plussed.

lrossi2• 6 years ago

A rant can be useful. The article is just misleading clickbait. Not sure how it got upvoted here.

sevagh• 6 years ago

This about sums it up. This is a rant and it’s difficult not to just close tab half way through.

Every single rachelbythebay article:

Here's a vague condition. I encountered it at vague companies that I may have worked at. Anyway, whatever, it vaguely caused problems.

Here's my vague workaround or suggestion. Whatever. Bye.

arthurcolle• 6 years ago

ZeroTier is so much better than WireGuard. I literally spend 2 weeks futzing about with a WireGuard config and was able to set up a VPN between my homelab and my new apartment in less than 15 minutes with ZT.

Day and night difference in quality and ease of use.

AMA?

laingc• 6 years ago

I’ve never really figured out whether ZeroTier can be trusted. WireGuard has an excellent reputation among people I respect.

What is it about ZT that made you trust it with your traffic?

chipsa• 6 years ago

I've got Tailscale setup. It uses Wireguard under the hood, so I don't have to worry about the security of the protocol, just whether I trust the company providing the management. Took just as much time to setup as you did with ZeroTier.

sneak6• 6 years ago

Wireguard can only be installed via the Mac App Store, which, upon opening, transmits your permanent/unchangeable hardware serial number and Apple ID (required to download even free apps), which is linked to your phone number, to Apple, thus deanonymizing your VPN's public IP.

I don't use the Mac App Store. I run my VPN on a second device, because I no longer find the macOS to sufficiently preserve my privacy.

It's insane to me that Apple thinks it's okay to demand hardware serial number, name, street address, email, and phone number to download free privacy apps. An organization that had privacy as a value simply would not do that.

Apple has banned apps that want to use the NetworkExtension API from being self-signed, OR by being Apple-approved-developer signed and distributed outside of the App Store. You can download the windows Wireguard client from the Wireguard website, but not the mac one.

They even recently censored the donations link in the Wireguard mac client, because App Store.

perryizgr8• 6 years ago

Wireguard can only be installed via the Mac App Store

I think you can also use brew.

sneak6• 6 years ago

That uses a different API that is widely assumed will be removed soon in a future macOS, and as such nobody wants to rely on it or build around it. It also requires root. It is not used by the Wireguard GUI app in the Mac App Store (MAS).

The wireguard-app-from-wireguard is only distributed via MAS, and you cannot build that GUI version that they distribute via MAS yourself, because that version uses the NetworkExtension API and that only works with the appropriate signed entitlement from Apple, which as of very recently didn't get issued outside of MAS apps.

opensmtpd• 6 years ago

If self and Apple-approved developer signing is not allowed, how do developers test their apps that use those APIs? I don't know a lot about how Mac apps work, but I've heard somewhere that you have to sign all apps to build and install on any device.

sneak6• 6 years ago

Presumably by disabling system integrity protection.

fmajid3• 6 years ago

The GL.iNet MNG-300v2 "Mango" is tiny and has built-in WireGuard support, and you can even set it up to switch WG on and off using the hardware switch:

https://www.gl-inet.com/products/gl-mt300n-v2/

sneak6• 6 years ago

I have a half-dozen GL.iNet products. The low CPU power means they become the bottleneck on 1gbps connections, like the ones I usually use.

I imagine it won't be an issue as much once traveling is possible again.

nuker3• 6 years ago

IPSec IKEv2. Look Ma, no apps! Native MacOS client.

tptacek6• 6 years ago

I would rather use a VPN client written in Perl than rely on macOS IPSEC support for anything, let alone have to configure the serverside for it.

nuker3• 6 years ago

Any specific bugs?

fmajid3• 6 years ago

IPsec on Apple devices works very well once it's running, even if debugging tools are abysmal for getting to that point.

If it helps, I have a shell-script to auto-setup an IPsec/IKEv2/MOBIKE and WireGuard VPN on top of an OpenBSD machine, including in the cloud:

https://github.com/fazalmajid/edgewalker/

lrossi2• 6 years ago

What’s the point of ranting on your blog about a free and open source app that is quite new as well? At least raise a bug if you’re not willing to put in any effort to help.

It’s people like this that make it so hard to stay motivated to do any kind of open source work. Choosing beggars.

upofadown2• 6 years ago

A friend recently attempted to chat with me over XMPP on macOS. The result was a nightmare of trying different out of date and poorly supported mac clients. They seemed quite used to the process. The logical choice for desktop (Gajim) did not have an app available. The MacPort is wildly out of date. Which is too bad because Gajim supports macOS. It seems that no one can be bothered to package it.

It's like everyone has abandoned MacOS but are too polite to admit it...

MattJ100• 6 years ago

For the record, Beagle IM and Monal are both in the macOS app store, open-source and actively maintained XMPP clients.

I generally agree with your observation though. I'm not really a macOS developer, but from the sidelines it appears it has become increasingly difficult to develop and ship open software for both Apple operating systems. See for example this discussion from a few months ago ("Can't you just right-click?"): https://news.ycombinator.com/item?id=24217116

neilalexander• 6 years ago

It’s not clear from your comment if everyone has abandoned macOS or if everyone has abandoned XMPP.

upofadown2• 6 years ago

Gajim specifically has support for macOS and is well maintained. It is available on pretty much every desktop OS. No one has even bothered to package it for macOS even though it would be quite easy to do so. So it would have to be the case that macOS users in particular have abandoned XMPP.

throwaway894345• 6 years ago

I’ve had really good luck with Tailscale (Wireguard-based mesh VPN) on Apple devices (and Linux).

freebuju• 6 years ago

Hic Hic Mac late to the party yet again! Steve Jobs really did create a cult Burp

SergeAx• 6 years ago

WireGuard works perfectly on my Windows box for like half a year now. Standalone installation, no WinStore, or how is this thing by Microsoft called. It asked for auto-update 2 or 3 times since install and did it with no effort.

I became interested in how exactly it works and found an original code repo. It turned out that a delay between repo tag push and auto-update notification was about 15 minutes. This includes CI/CD pipeline time!

I've instantly converted into Wireguard beleiver.

Titanous• 6 years ago

Jason (the creator of Wireguard) wrote a great response to this: https://lists.zx2c4.com/pipermail/wireguard/2020-December/00...

nominated12• 6 years ago

Being quoted by Jason Donenfeld as “correctly identified the technical nature of the problem” was quite a nice Christmas gift.

Thank you Jason for your hard work and wonderful wares!!

WireGuard: Great protocol, but skip the Mac app

Related Stories