Pro Custodibus writes practical guides on WireGuard, covering network topologies, configuration, DNS, high availability and encryption setups.
HN commenters call it super useful for setting up WireGuard and link its topology, point-to-point config and AllowedIPs calculator posts.
Edit: Sorry for what an opinionated mini rant this comment has become while typing it ;;
> The so called ‘rootless’ Podman seems to be advertised as being on the same level of isolation as Jails – but only if You run that Podman with properly configured and enabled SELinux/AppArmor solutions.
That ignores user namespacing, the subsequent namespacing for mounts, networks, etc. So I'm confused as to where the it-only-is-secure-with-selinux comes from.
> Then the Jails are better isolated again
How so.
- - -
> Even ‘rootless’ Podman has full access to all Linux kernel syscalls
from https://podman.io/blogs/2019/10/15/generate-seccomp-profiles.html
Most container tools use a default seccomp filter which was initially written by Jesse Frazelle for Docker
- - -
> Jails have restricted use of FreeBSD kernel syscalls without any additional tools
Which ones
> You can NOT dedicate any physical interface to the ‘rootless’ Podman container
I'm confused by what you mean "physical" here.
Can also disable networking, which is mentioned for jails for some reason. So is other VPN-like options, not mentioned for Podman.
https://www.procustodibus.com/blog/2022/10/wireguard-in-podman/ as an example
> firewall
https://discuss.linuxcontainers.org/t/how-does-nftables-work-inside-an-unpriviledged-container/14409
> comparing CVE counts and nothing else
Come on
- - -
This article seems like it would strongly contribute to people misunderstanding things.
It's not just that they're suspect or unreliable. They're complete bullshit.
The actual use of VPN technology is to create virtual networks that are private (hence the name). It's a system level technology. There are several types of network topologies you can set up, when I was learning about this I found this article which is quite nice: https://www.procustodibus.com/blog/2020/10/wireguard-topologies. You can proxy traffic through a VPN, but the only scenario I can think of in which it makes sense is if you are an OSINT researcher and you need a safe system on which to conduct your research.
If you need to proxy traffic and "hide" your IP, just use a flipping proxy. It's an application level technology (e.g. for torrenting, every torrent client under the sun supports a SOCKS5 proxy). If you don't have the patience to set up a VPS yourself, you can even use something like Outline (https://getoutline.org) which automates that (and it has a mobile client app as well).
If you need privacy (and to actually hide your IP), then use Tor.
Yes, it is wrong. You just misunderstand how routing works.
Say you’re at work, and the office router (192.168.1.1) gives you access to 10.3.0.0/16. This is where your company’s cloud is or whatever. You want all your traffic to go through your home network for whatever convoluted reason, except for the 10.3 stuff.
You just add
PreUp = ip route add 10.3.0.0/16 via 192.168.1.1 dev eth0
And
AllowedIPs = 0.0.0.0/0
(Edit: remember to add a post up)
And bam, you’re done. No crazy allowedip rules. When your computer generates packets to the company cloud, your OS won’t even try to talk to the VPN. Because the route table makes it go somewhere else entirely.
I don’t know if this was the exact use-case you described in your blog, but I’m sure you can figure it out from here.
Oh and this is also fully documented online in many places, including the AllowedIPs Calculator: https://www.procustodibus.com/blog/2021/03/wireguard-allowedips-calculator/
Tailscale is not different. It simply makes managing WG configuration easier, and adds some useful value-added features on top.
But, as you know, you can also manage this configuration yourself, either via traditional config mgmt tools, helpers like wg-meshconf, or even plain shell scripts, if you like. I'm aware this is a very HN-Dropboxy comment, but it's really not that complex[1], and is easily manageable for a small deployment.
Another VPN tool I used before WG gained momentum was tinc, which supports mesh networking out of the box. It's even easier to configure and maintain, and supports all platforms. It does run in userspace, which should make it slower than WG, but I found the performance acceptable for my modest use cases. Highly recommended.
[1]: https://www.procustodibus.com/blog/2020/11/wireguard-point-to-point-config/
Isn't this use case covered in the article that you mentioned? Specifically under the very last heading.
https://www.procustodibus.com/blog/2021/03/wireguard-allowedips-calculator/#a-better-alternative
That is you could specify a single Wireguard peer that you send all the traffic to by setting AllowedIPs to 0.0.0.0/0 and also set more specific routes than 0.0.0.0/0 in the main routing table of your device in order to send traffic to certain networks via a different gateway.
I don't think you need Tailscale for this.
You need tailscale when:
1) You have a lot of road-warriors
2) You need decent ACLs that isn't just IP based.
3a) You don't ability to directly connect to a site (just one needs to be accessible)
3b) You can't add 3rd site to relay traffic or punch holes in NAT.
4) You're afraid of terminals and/or text editors.
Here is a good write-up on the subject: https://www.procustodibus.com/blog/2021/11/wireguard-nftables/