Quick straw poll... [LWN.net]

Quick straw poll...

Posted Sep 7, 2022 14:54 UTC (Wed) by mathstuf (subscriber, #69389)
In reply to: Quick straw poll... by somlo
Parent article: OpenWrt 22.03.0 released

> Suboptimal due to double-NAT, but works well enough in practice.

At this point it really seems like Wireguard is a better solution for getting access to my inner network than faffing about with firewall rules…

to post comments

Quick straw poll...

Posted Sep 7, 2022 15:21 UTC (Wed) by somlo (subscriber, #92421) [Link] (3 responses)

> At this point it really seems like Wireguard is a better solution...

I assume that would require one to have access to (control over?) a gateway node with a publicly routable IP to set up a tunnel from one's inner network, and to use as a relay to connect *into* said inner network from the outside.

A reasonable tradeoff compared to tracking one's ISP router's public dhcp address as it (rarely, but reliably) gets re-assigned (after e.g. a power outage), and connecting to it from the outside when needed (the forwarding rules don't need any adjustment if set up correctly).

Quick straw poll...

Posted Sep 7, 2022 15:33 UTC (Wed) by mathstuf (subscriber, #69389) [Link]

I already have a VM in the cloud, so it's not too much to add the gateway node there. AFAIK, the "commercial VPNs" that deploy WG work fine for those without a cloud/DNS presence (Tailscale?).

Quick straw poll...

Posted Sep 8, 2022 2:38 UTC (Thu) by pabs (subscriber, #43278) [Link]

Tor onion services are a good way to connect to machines behind NAT, or there are lots of commercial services that provide that sort of thing, some of them with FOSS client software, others without.

Quick straw poll...

Posted Sep 9, 2022 0:54 UTC (Fri) by flussence (guest, #85566) [Link]

I've got this setup myself, here's what I ended up doing:

The outer router has RIP2M turned on (one of the few useful things it does), the inner router runs bird and automatically maintains two kernel routes to the IPs both ends of the PPP connection. When those routes change or expire I have a script do a UPnP query for the correct address (slow and flaky, so I can't just poll using this method) and then it goes off and updates a dynamic DNS pointer with the result.

That sounds like a whole lot of busywork (it sure is!), but it does mean I don't have to rely on an external IP address checker service and I get pinged instantly at home when there's a problem. It recovers from power outages, line disconnects and ISP DHCP expiry with at most 2-3 minutes of lag provided everything else is up and running. Room for improvement on that number, but I'm not winning any medals for going fast.

WireGuard on top makes most of this transparent, to the point where I didn't even realise I had an outage last week until cron sent my phone an angry email.

Quick straw poll...

Posted Sep 9, 2022 0:19 UTC (Fri) by julian67 (guest, #99845) [Link]

Yes, it really is. Wireguard on OpenWrt (or any good router OS I guess) is excellent. I used to use OpenVPN and then Strongswan. They were hugely complex to configure and in real world situations were frustrating to use (or try to use). Version updates could render them useless until fascinating but unwanted new issues were identified and dealt with. Wireguard has really taken the pain out of config and the unreliability out of usage. My clients are Android (phone and tablet) and also an ancient Lenovo Thinkpad which dual boots Win 10 and Debian Testing. It all works, has worked for ages, survives huge updates of wg and OS, and continues to work (fingers crossed and I hope I didn't just curse my luck).