WireGuard for iOS
lists.zx2c4.com
lists.zx2c4.com
I'm sorry it didn't make it into the kernel this cycle though, granted maybe that was a little much to hope for at this stage of things, and I really hope Vancouver goes well for you and Zinc. It's not that WG is hard to get setup on any given system, but I think kernel integration will lower the bar towards getting it available as a standard feature in a lot of turnkey appliance systems that I see a ton in SMB usage in particular. I can understand being conservative there but man do I already want it everywhere :)!
Also a big thank you. There's nothing wrong with charging for an app or VPN service, charity is unfortunately not a sustainable business model and the app can still remain FLOSS but that's just my two cents.
There shouldn't be a problem from Microsoft's side since they're not the ones distributing it. You are free to assemble a module that has incompatible licenses terms and use it personally because the GPL only really activates on distribution (like if you sell your laptop with this module installed).
So even in the worst case, Microsoft shouldn't care. Does Windows even have the concept of MODULE_LICENSE like Linux?
[1]: https://tunsafe.com/
It's solving all my problems - inter-DC communication, IPv6 tunnel and now mobile VPN.
Sent some $ your way :).
Wireguard itself is already super simple to setup and configure, and Algo makes it even easier by automating most of the surrounding process.
I personally used it to setup a VPN a few days ago, and then manually tweaked it a bit to turn it into a site-to-site VPN instead of having it be just for tunneling (fun fact: wireguard works on Vyatta (AKA Ubiquiti) [2], and is currently running flawlessly on my Edgerouter Lite).
Seriously, this is amazing software that just works and runs incredibly fast. Huge thanks to Jason and all the contributors to the various projects for their great work.
[0]: https://www.wireguard.com/
Is it? I personally & professionally prefer Debian over Ubuntu: by default it’s free-software–only, and I find that it’s somewhat more stable & predictable (which are important in a production server system). Of course, some people don’t care as much about software freedom as I do, and others may have had different experiences with respect to stability & predictability.
Ubuntu is nice on the client side, given the reality of proprietary drivers in which we live, but even there I prefer e.g. Mint if I’m not using pure Debian.
A bon entendeur, salut
It wasn't hard to check so it's actually 1.75% domestic cards (Australia) or 2.99% international, $0.30 flag fall.
On $30 that is $0.83 - $1.20, or 2.75% - 3.99%
On $3.99, this is $0.37 - $0.42, or 9.27% - 10.51%
There are some ready made docker containers [0] that set up an IKEv2 VPN and can generate an IOS mobileconfig file for your phone.
This has rapidly become my favourite solution for a VPN setup because it uses only built-in software on the client and it's extremely stable.
One particular feature I like with Shadowrocket on iOS is the VPN-on-demand feature it offers. I can tell the app to only turn my VPN on when on wifi, for example, since global roaming is itself essentially a VPN back to my home telco. In that instance, I don't want to route my traffic back up from Australia to the US (which I pick for my VPN due to its close routing from China). Can I expect the Wireguard app to feature something similar in time?
The GFW is not a monolithic entity though so be aware that performance and blocking characteristics can vary widely between cities, ISPs, and sometimes even between cell towers.
VPN on demand features are on the iOS todo list. iOS supports the idea of making a VPN on demand for cellular or WiFi so it will be able to do what you want once that feature is merged.
I'm aware that them blackholing all UDP traffic is always going to be an issue, but it's good to hear that Wireguard recovers gracefully. So, too, does Shadowsocks.
Alternatives are always good, and having something more reflecting a true VPN rather than a SOCKS proxy will be useful once it makes it to Windows.
The really nice thing is the full in-kernel implementation, and the lack of configurability.
An interesting related talk: https://www.youtube.com/watch?v=QBp6opkcxoc
Does the GFW start dropping UDP packets between two endpoints beyond a certain threshold? Is WG generating that message or something else?
For example, there's suggestions that people have had better success if they're sending HTTP obfuscated data to an endpoint that also responds to HTTP requests. The implied situation here is that the GFW might see mass HTTP data to an IP, then try to query it itself. If it gets no results, it's probably not a HTTP server but rather obfuscated VPN data. It'll then choose to drop or aggressively throttle data to that IP.
In my experience, I've had a VPN go more or less dead for a couple of days after about 30 days of use, before recovering after I leave it for a bit. In the interim, I can spin up a second IP and be fine on that one. That said, it was also to a streisand instance, which does respond to a HTTP(S) request on the IP, so maybe this heuristic wasn't my tell.
So maybe I was instead picked up because I globally routed all traffic directly at one IP and never went outside that. Others have suggested success on keeping VPNs active longer if they occasionally browse directly to random sites, so that the GFW sees their IP accessing a multitude of sites and therefore doesn't look as much like all data is going to a single IP. I've not had any noticeable anecdata to go either way on this.
The reality is, no one trying to jump the GFW truly knows how the GFW does its DPI. Moreover, as a reply said to my original post, the GFW isn't a single entity and differs across cities and regions in China.
The Wireguard code would need the ability to mask itself as other types of traffic. Maybe a module, so people could add or change the behavior as required? I only mention this so you don't build a dependency on it. Every time Tor evolves, it takes about a day and it's blocked again.
For SOCKS, that would be a SOCKS server (not sshd). (ssh <-> sshd happens to have an option to spawn a limited SOCKS server, but it is not the only SOCKS server in existence.)
However configuration to make forwarding of all packets and thus making it usable as a full VPN requires a few extra steps on the server:
* net.ipv4.ip_forward = 1
* net.ipv4.conf.all.proxy_ARP = 1
* AllowedIPs = 0.0.0.0/0
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o enp2s0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o enp2s0 -j MASQUERADEIf you're looking for anonymity as well I would recommend you take a look at Mullvad [0] who offer a great service with full Wireguard support [1].
I've ran Wireguard on a $5 DO Droplet for a while, but decided to support Mullvad instead and get the benefit of their infrastructure for the same monthly price.
Not a plug or anything I just genuinely am impressed by the performance and ease of use. For transparency's sake, AzireVPN is their primary competitor in the Wireguard space.
[0] https://mullvad.net [1] https://mullvad.net/en/download/wireguard-config
Going to China soon and was wondering if anyone has tried if this works through the GFW?
Was with OpenVPN though, not Wireguard.
>I use WireGuard (including WireGuard iOS) every day in Shanghai. It’s mostly fast and performant but nothing escapes the occasional “drop all UDP to your endpoint”. Typically this manifests as windows of time (typically a few minutes) where no traffic to the VPN gets through. However, unlike an openVPN solution WireGuard recovers without having to bounce the tunnel or constantly reconnect. The GFW is not a monolithic entity though so be aware that performance and blocking characteristics can vary widely between cities, ISPs, and sometimes even between cell towers.
>VPN on demand features are on the iOS todo list. iOS supports the idea of making a VPN on demand for cellular or WiFi so it will be able to do what you want once that feature is merged.
Just as telnet.exe is available on Windows but ssh isn't, so telnet must be more secure.
It depends on your threat model and also on the tech below.
Yes, amazing projects like Algo exists, but you can't use these on all platforms (ex: OpenWRT).
My hope is that wireguard will provide a much easier (and safer) setup experience.
Yes, but most people will use commercial VPN providers, with added benefit of obscure IP address, with your own server IP is still unique to you.
Personally I use a VPN to connect back to my homenet when I'm out on the road, or to connect to my company's network when out of office.
If you think the only usage of a VPN is anonymizing your IP, you have an incredibly lacking understanding of the history and use-cases for a VPNs.