Comment by vbezhenar | Hacker News Reader

Comment by vbezhenar | Hacker News Reader

Parent Full thread

I tried OpenVPN and IPsec and IPsec works much better for Windows client and Linux server. Also CPU load for server was much lower (I'm using very low power VPS). I don't think that it's because of userland implementation, but rather because OpenVPN has some implementation issues. So I'm using IPsec now. Unfortunately I've hit some problems with IPv6. I managed to configure real IPv6 address from /64 VPS subnet for each client, but this configuration does not work reliably.

Another problem is that I did not found a way for Windows to keep tunnel up all the time. There's some way for "Always on" connection, but I couldn't configure it, there's no GUI option and it seems to require a lot of powershell magic and no easy to follow tutorials.

Another problem with IPsec is that only strongswan can provide adequate implementation. OpenBSD iked daemon can't send certificate chain, so I can't use Letsencrypt certificate. Libreswan does not support MSCHAP-V2 protocol, so easy configuration with username/password is not possible. Also default strongswan configuration does not allow Windows clients to connect without further tweaks (Windows does not want to use strong ciphers and strongswan does not want to use weak ciphers).

It's a mess.

So, yeah, wireguard might be interesting for me, as I still did not find a suitable solution which checks all the boxes. IPsec works for me, but it's not ideal.

Last time I checked, wireguard for Windows was in beta, but it looks like it's stable now according to the website. I guess it's worth to try it now.

IPsec worked best for me too, until recently. Suddenly, I couldn’t send e-mail while on VPN, but I could when I was off VPN. I did an nmap of the mail server provided by my ISP, and ports 465 and 587 simply weren’t open to me while I was on VPN, but were when I was off. Oddly, when I was on VPN, that server also appeared to be open on ports 22 and 80 but not when off VPN. That machine definitely should not be open on 22 and 80, so something really strange is going on.

So, I had to find an alternative. So far, I’ve tried WireGuard, ZeroTier, and now OpenVPN via Mullvad.

I just couldn’t get reliable connectivity with WireGuard and ZeroTier on all my devices, regardless of the configuration I used. OpenVPN is known to be slow and a CPU hog, but at least it seems to work. And I’ve done speed tests with fast.com and DSLReports, and both show me getting ~20-30 mbps or faster download speeds while on VPN, and that’s not much slower than what I was getting when off VPN. And “wehe” shows that I was getting throttled by the carrier even when on WiFi, not just on cell. Now, I’m not throttled at all.

I have not yet noticed any problems with extreme battery loss or high CPU, but we will just have to wait and see.

>Another problem with IPsec is that only strongswan can provide adequate implementation.

Is this regarding server or client implementation? Are the client implementations of major operating systems (eg. Windows, Mac, iOS, Android) secure?

It's regarding server implementation. My aim was to use built-in IPsec IKEv2 implementations for Windows, iOS and macOS.

Regarding security: I had to reduce cipher strength to allow Windows client without further configuration. I'm using aes128-sha1-prfsha1-modp1024 which IMO should be relatively secure for home usage, but it's not very secure against governments. It's possible to use stronger ciphers, but you need to use some registry changes or powershell snippets for that, and I wanted to keep configuration to GUI dialogs. I have no idea why Windows by default does not accept strong ciphers.

TunSafe client for Windows works just fine. I configured the tunnel about two months ago, and it has kept it working since then. It also has a killswitch mode in case it fails to establish the connection.

That's a very nice IPsec summary!

Reply on news.ycombinator.com