Comment by mikl | Hacker News Reader

Comment by mikl | Hacker News Reader

This is an excellent example of motivated reasoning. The author wants to keep selling his IPSec tool and thus throws together a word salad loaded with conjecture and theoretical concerns.

It appears he’s not even tried WireGuard. The argument that it does not work for road warriors is a misunderstanding of where static IPs are required (inside the tunnel, not outside).

As one who has tried WireGuard, I’m happy to say it can already replace OpenVPN and IPSec for the 80% case. And not only that, it is in practical experience much easier to install and set up, and much faster to connect and has excellent latency and bandwidth. It is great for road warriors, I’ve been using it for that purpose for six months or so and have never had any problems with it.

Sure, there are some VPN features WG will not implement, for those you’ll have to stick with legacy VPNs like IPSec or OpenVPN.

The rest is just FUD.

>and much faster to connect and has excellent latency and bandwidth

I have my own ipsec deployment and this argument always seems shaky to me.

Here is how long it takes to establish ipsec connection on my laptop: https://streamable.com/27des

The cipher suite used is aes256gcm16-prfsha384-ecp384 for IKE and aes256gcm16-ecp384 for ESP which is in line with CNSA https://apps.nsa.gov/iaarchive/programs/iad-initiatives/cnsa... I'm using Strongswan which I highly recommend mostly due to their comprehensive set of tests for virtually every scenario https://www.strongswan.org/testing/testresults/

I did not see any meaningful difference in bandwidth between ipsec and wireguard. As a bonus, ipsec is natively supported by Windows 10.

I don't use OpenVPN which I think is worse in that regard due to packet shuffling between the kernel and userspace but between ipsec and wireshark the only discernible difference for me is the effort in setting it up.

Static IP addressing inside the tunnel is still a major pain point for significant use-cases, e.g. company-wide VPN access for all employees. How do you do static addressing for 200+ people with their own devices?

You provision them. How do you create user accounts for 200+ people?

These end users likely do not already have wireguard on their devices so as part of the software rollout you assign them an ip. A /24 gives you enough addresses for over 200 people and a /8 future proofs you for a much larger company size. You can also just spin up different wireguard networks for different departments or even think about using IPV6.

This is the same for any large rollout of technology really. There may be some hands on effort but nothing that couldn't be automated with a spreadsheet and a script.

Reply on news.ycombinator.com