linux-kernel - Re: [RFC] WireGuard: next generation secure network tunnel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b41c6b79-1c62-b3b2-4f8f-71a53e2babc4@zx2c4.com>
Date:	Sat, 2 Jul 2016 01:03:17 +0200
From:	"Jason A. Donenfeld" <Jason@...c4.com>
To:	bruno@...ff.to
Cc:	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [RFC] WireGuard: next generation secure network tunnel

Hey Bruno,

Sorry I didn't reply to this earlier; the message didn't make it to me
somehow.

Bruno Wolff III <bruno@...ff.to> writes:
> I tried this out on 4.7 kernels and it seemed to work OK. I can't tell
> about security, but the packets made it to where they are going.

Happy to hear!

>
> My eventual use case, is to be able to reach a machine behind NAT by
going
> though a fixed machine in another location. The machine behind NAT will
> keep a tunnel usable by occasionally pinging through the tunnel to make
> sure that NAT has state information allowing packets to make it back and
> that the fixed machine knows where to send packets.

That seems like a setup that would work fine.

>
> This seems much easier to use than ipsec and should be faster than
> tunnelling over ssh or openvpn.

Absolutely! That's the goal.

Thanks for the feedback,
Jason