Hacker News new | ask | show | jobs
by willangley 2668 days ago
IPsec is pretty much universal in networking hardware and cloud provider networks nowadays. There's a better chance it'll work for you if you can't or don't want to control both ends of the connection.

Hardware:

* Cisco: https://www.cisco.com/c/en/us/td/docs/net_mgmt/vpn_solutions...

* Juniper: https://www.juniper.net/documentation/en_US/junos/topics/top...

Cloud:

* AWS: https://docs.aws.amazon.com/vpc/latest/userguide/vpn-connect...

* Azure: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gatew...

* gcloud: https://cloud.google.com/vpn/docs/concepts/overview

Also, some software environments have better support for IPsec than Wireguard; a glance at the Algo docs (https://github.com/trailofbits/algo) suggests that Windows and OpenWRT are both in this category today.

FWIW, I work for Google, I haven't configured IPsec in forever, and I'll probably reach for Algo first the next time I think I need IPsec; I don't think I have enough endpoints in my home network to need hardware offloading :)

2 comments

Last time I configured IPSec it was so horrible, really-really-really horrible, I will never touch it again with a ten-foot-pole. Starting from the fact that the software was hard to configure, so was it hard to find working (new) configuration examples as well as secure configurations. It never felt right after setting it up and I did not want to spend any more time on it, wireguard has been a blessing in that aspect.
Right, but this is a solution in which you're meant to control both ends (IPSEC runs from Vita to Vita). That's an ideal environment for WireGuard.