Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Why stop there? Give use Wireguard certificate auth already!by pamcake
- Because then it would be DTLS.by mlhpdx
- I think this would nerf wireguard similarly to how a "null" encryption effectively nerfed IPSec. Fine for a specific use case (debugging comes to mind) but should never be upstreamed imho.by tosti
- That's not the case at all. The security here is more like HTTPS/TLS with the client not really being validated (just the server). The encryption remains just as strong as if the peers we're locked down.
It's different than the VPN use case where you absolutely want to lock down access to known peers.
by mlhpdx - I don't understand why you would want to over-complicate WireGuard like this.
The default setup is perfect - you set up your profiles, and the server doesn't respond if you try to connect with an invalid one. Any other addon to this is just reducing security.
Why muddy that perfect process with this?
- How is this making it more complicated?
The “why” is pretty simple: the WireGuard protocol is really nice and makes a better protection layer than DTLS in my opinion.
All this implementation does that is different is make hosting public services (accessible to unknown peers) possible.
by mlhpdx - This is confusing to me, and I'm not a novice to WireGuard.
WireGuard is a layer-3 protocol. Given that WireGuard does not natively support DHCP or dynamic internal IP allocation within its encrypted tunnels, and it instead relies on static tunnel IP configurations (Address and AllowedIPs for each pre-registered client), how would a new unregistered client be assigned an IP address within the encrypted subnet?
by anonymousiam - I actually came to post this, I am to confused, what does exactly do?!by tamimio
- >the Listener rejects any handshake from an unknown key.
It never responds, there's no indication of rejection.
The client can't even be sure a service is actually there or they've hit a default drop firewall rule.
by cube00 - Indeed. That's how the WireGuard handshake works, partly to avoid abuse/spam.by mlhpdx