Hacker News new | past | comments | ask | show | jobs | submit login

Wireguard also suffers from having static routing. It could be argued that it is somewhat worse with Wireguard because there is no means for a client to announce networks for routing. I would argue that dynamic routing is a complicated task which goes far beyond just announcing networks and should be handled outside the vpn client. Wirguard's use of allowed ips and NBMA network model complicates doing so.

It could also be argued that Wireguard's support for roaming clients is not much better. Roaming clients really only work properly in a model with a centralized wireguard server with a fixed ip address where the roaming clients connect to the server when they roam so the current ip address for the roaming client is updated.




Aside from the cryptorouting concept and some convenience functions in wg-quick, Wireguard doesn't really have strong opinions on routing. It's perfectly legitimate to setup an interface with a single peer and global (0.0.0.0/0, ::/0) routes then use BGP to announce networks across it and manage the kernel route tables.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: