Proxy UDP connections over HTTP(s). The main use case is to proxy WireGuard packets.
BoringTun is an implementation of the WireGuard® protocol designed for portability and speed.
This repository contains code to run Deuxfleurs' infrastructure on NixOS.
Our abstraction stack
We try to build a generic abstraction stack between our different resources (CPU, RAM, disk, etc.) and our services (Chat, Storage, etc.), we develop our own tools when needed.
Our first abstraction level is the NixOS level, which installs a bunch of standard components:
- Wireguard: provides encrypted communication between remote nodes
- Nomad: schedule containers and handle their lifecycle
- Consul: distributed key value store + lock + service discovery
- Docker: package, distribute and isolate applications
WireGuard is a fast and modern VPN protocol.
It is a point-to-point VPN, which means it does not have a client-server architecture, but peers, and does not rely on a PKI, unlike OpenVPN. It is super simple to setup to connect multiple machines together.
WireGuard supports roaming, which means you can switch between network connections and not have to reconnect to your peers. On servers, it’s rarely useful, but when one of the peer is a mobile client like a laptop or a smartphone, it’s a life saver, because the usage of WireGuard is completely transparent.
I’m used to OpenVPN, I even maintain a quite popular script, but WireGuard is better in pretty much all aspects.
Algo VPN is a set of Ansible scripts that simplify the setup of a personal IPSEC and Wireguard VPN. It uses the most secure defaults available, works with common cloud providers, and does not require client software on most devices. See our release announcement for more information.
Heute möchte ich darüber berichten, was für ein großartiges Tool wireguard ist. Ich beschreibe hier, was es macht, wie man es konfiguriert und welche Möglichkeiten sich daraus ergeben.
Wireguard wird gerne als das neue, schnelle VPN des Linux Kernels beschrieben. Dabei gibt es aber zwei Probleme. Patches liegen für den mainline Linux Kernel schon seit einiger Zeit vor. Dennoch dauern die Diskussionen um eine Aufnahme weiter an, da wireguard eine neue crypto-api einführen möchte. Zweitens vermuten Menschen unter VPN eine Lösung, die einen Client mit einem Netz oder zwei Netze untereinander verbindet, dies leistet wireguard aber gar nicht von Haus aus.