Comment by djsumdog | Hacker News Reader

Comment by djsumdog | Hacker News Reader

Parent Full thread

> take a look at an OpenVPN config file and you will appreciate this shortness

OpenVPN config files can be pretty small once you remove all the comments (my server is 22 lines)

That being said, I like WireGuard. I've switched over a lot of stuff to it. It does have some issues though:

* Road warrior configurations aren't easy. If you use a DNS name as an endpoint, and that DNS entry changes, you have to refresh it. They have a contrib script in the repo that you can put in cron and do this for you, but it's still not built in.

* You might need keep-alives in certain configurations

* You can't bind Wireguard to an IP address. It listens on all adapters. The devs argue it doesn't matter since WG won't respond via UDP unless it gets a valid key, but this does put WG into a weird state where it might send on an IP it's not receiving on.

There are others I'm probably forgetting. I do like it though. It's faster, the setup is clear. If you have one setting wrong in OpenVPN the connection could fail and you not get useful stuff in the logs.

> If you use a DNS name as an endpoint, and that DNS entry changes, you have to refresh it.

This is really frustrating for me. If you put a DNS name as a peer endpoint, wg-quick will resolve the name and then _replace the name with the ip address_. My IP address changes frequently and I have a script to update the A record when it does, but wireguard didn't have built in support for just keeping the domain name around when I last looked.

I haven't been arsed to do it yet, but I'm often concurrently connected to separate wireguard subnets with their own dns so the sane thing to do would be to run a local dnsmasq and map it there instead.

What's the alternative? Allow the Wireguard user to specify an FQDN in the config file and require Wireguard to perform a DNS query on every outgoing packet to check if the data in the RR has changed?

You could honor the TTL, that's why it exists. Just one DNS query every 1min, 5min, 1hour... whatever TTL you have.

Imo the free tier of tailscale is the best way to consume wireguard for me.

If you have or are willing to create a gmail account, yes.

>> take a look at an OpenVPN config file > OpenVPN config files can be pretty small

That particular jab was pretty strange.

The very first example in the OpenVPN documentation is of a server config:

  dev tun
  ifconfig 10.8.0.1 10.8.0.2
  secret static.key

That's three lines. The client needs a "remote" entry as well. How much more terse can it get?

There are many applications with complex configuration formats, but OpenVPN is not it. It has both a simple format and good defaults. It should be an example to others!

It seems like you are taking this personally. Why?

Not sure what you're trying to read between the lines, but it's not there intentionally. There was no sarcasm intended.

OpenVPN has a terse and logical configuration language. For all the complaints that open source projects do bad UX, someone put a bit of thought into this one, and it shows.

Reply on news.ycombinator.com