Hacker News new | ask | show | jobs
by axismundi 2385 days ago
Much faster, as it is UDP-based, it basically just keeps spraying network packets. I noticed that my SSH sessions are resumed after closing and reopening my laptop half an hour later.
2 comments

IPsec, at least using IKEv2, also uses UDP in most deployments where you are not using IPsec directly without encapsulation (not that it makes a real difference). You may be confusing with OpenVPN, which can run over TCP.

In terms of speed, they are comparable. The great benefit of WireGuard is simplicity on Linux compared to the configuration nightmare that is StrongSWAN, but implementing IPsec/IKEv2 on OpenBSD using OpenIKEd is roughly comparable if you use Let's Encrypt certificates.

You can get really inexpensive GL.inet GL-MT300N-V2 "mango" boxes (about $20) that will provide transparent WireGuard or OpenVPN encryption for a device that doesn't support VPNs out of the box (ahem, a Smart TV or streaming box, to bypass geo restrictions). They don't support IPsec.

https://www.gl-inet.com/products/gl-mt300n-v2/

> OpenVPN, which can run over TCP

Can run. OpenVPN is UDP 1194 by default.

TCP-over-TCP is a well known tricky problem, so it's not something you want to run unless you have to.

I've been really happy with the GL.inet Slate, if anyone's looking for recommendations.
IPSec is too (at least in tunnel mode).