Re: about wireguard-go

2018-10-09 Thread Brian Candler
On 09/10/2018 11:00, wireguard-requ...@lists.zx2c4.com wrote: In fact : [nicolas@linux wireguard-go-0.0.20180613]$ printf 'package main\nconst UseTheKernelModuleInstead = 0xdeadbabe\n' > ireallywantobuildon_linux.go [nicolas@linux wireguard-go-0.0.20180613]$ make Makefile:7: *** Do not build thi

Re: Sending just ssh traffic via wg

2018-10-06 Thread Brian Candler
On 06/10/2018 11:27, Roman Mamedov wrote: (Aside: I wish ssh had a feature like SNI, so that you could build an ssh proxy that forwards incoming connections to the right host.  I have done this before using an inbound SOCKS proxy, but it's messy to use) What insane things people invent only not

Re: Sending just ssh traffic via wg

2018-10-06 Thread Brian Candler
On 06/10/2018 11:00, wireguard-requ...@lists.zx2c4.com wrote: This may be a stupid question, but why do you need OpenVPN any more, if you have Wireguard? Because it's already there?:) Furthermore, some members of our IT team use macs (gasp!) and for them it would be much easier to continue to u

Re: Connection issues with Google Fi

2018-09-28 Thread Brian Candler
On 28/09/2018 11:00, wireguard-requ...@lists.zx2c4.com wrote: Failed to send data packet write udp6 [::]:49896->[2607:7700:0:8::48ca:860f]:51820 This is interesting because the DNS name my client interface is pointed at does not have a record. But does it have IPv4 address 72.202.134.15

Re: Let's talk about obfuscation again

2018-09-06 Thread Brian Candler
Domain fronting seems like the stealthiest option to me (and if anyone has a reliable way to detect domain fronting, I would love to hear about it!). But that doesn?t get you UDP (and NAT traversal); perhaps VOIP/WebRTC mimicry could work? I think this is a game you can't win against a suitabl

Re: wg-quick IPv6 same route on different interfaces

2018-08-25 Thread Brian Candler
I'm setting up an WireGuard tunnel between my VPS and my home network. This tunnel should be IPv6 only. I assigned the IPv6 subnet fd00:1:a/64 to my home network and my wireguard client got the static IP fd00:1:a::1. On the VPS I assigned the IP fd00::1 to the wg0 interface. Here're the configs:

Re: Reflections on WireGuard Design Goals

2018-08-10 Thread Brian Candler
On 10/08/2018 16:03, Roman Mamedov wrote: But I'd feel a lot happier if a second level of authentication were required to establish a wireguard connection, if no packets had been flowing for more than a configurable amount of time - say, an hour. It would give some comfort around lost/stolen devi

Re: Reflections on WireGuard Design Goals

2018-08-10 Thread Brian Candler
For whatever reason, in the last several weeks, WireGuard been receiving a considerable amount of attention, and with that comes various parties interested in the project moving in this direction or in that direction. And more generally, over the last year or so, we've seen a decent amount of inte

MTU on public wifi

2018-07-03 Thread Brian Candler
ndom bs=1024 count=100" and it did send the whole random splurge without locking up the TCP connection. I also wonder if wireguard could automatically reduce its MTU in response to ICMP "frag needed" packets, at least down to a c

Automatically add host route when peer address is within AllowedIPs?

2018-07-01 Thread Brian Candler
nk the answer is straightforward: I would like this rule to be added when the target IP is within any AllowedIPs subnet, not just for 0.0.0.0/0.  Would you agree? If I add this route manually, everything seems to work fine. Thanks, Brian Candler. ___