Wireguard?

124

Comments

  • sgwatts
    sgwatts Posts: 1  Freshman Member
    First Comment
    I agree - wireguard support would be fantastic. After using openvpn for quite some time, the ease of use and flexibility of wireguard is just fantastic. I very much support this idea.
  • Omnia
    Omnia Posts: 57  Ally Member
    First Comment Friend Collector Sixth Anniversary
    +1
  • xPremiumHDx
    xPremiumHDx Posts: 1
    First Comment

    Is this already integrated in the ATP? It would be very useful. +1

  • ESupport
    ESupport Posts: 23  Freshman Member
    First Comment Friend Collector Third Anniversary
    https://community.zyxel.com/en/discussion/comment/61305#Comment_61305

    Nope

    I watched the introduction of the Flex-H-Firewall and there were questions regarding wireguard and the technician in the video said they would not implement it because of security conserns because there where CVEs in the past. The only thing i could find would be https://nvd.nist.gov/vuln/detail/CVE-2023-35838 but this is for the windows-client. I really think they don't care about wireguardsupport.

  • PeterUK
    PeterUK Posts: 3,727  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited January 2024

    StrongSwanVPN should work

  • FelixSchneider
    FelixSchneider Posts: 49  Freshman Member
    First Comment Friend Collector Third Anniversary

    Also regarding their vulnerability track record they should be the last one's complaining…

    Remember the built-in backdoor...

    CVE-2020-29583

    So guess wireguard is not profitable, I don't blame them but it's still a bummer, and this non excuse also does not help.

    The thing is I would have upgraded solely for Wireguard...

    Have a nice day.

  • ESupport
    ESupport Posts: 23  Freshman Member
    First Comment Friend Collector Third Anniversary
    https://community.zyxel.com/en/discussion/comment/61386#Comment_61386

    But that's not wireguard. The new FlexH creates an openvpn-File for SSL-VPN which is a nice step forward but still, no wireguard. I need the always on resilience that in my opinion only wireguard delivers.

  • StefanZ
    StefanZ Posts: 202  Master Member
    First Comment First Answer Friend Collector Second Anniversary

    Tried WireGuard on my Fritzbox for the first time today.

    Client (Ubuntu) connects and I can even ping, use RDP etc. instantly.
    Configuration is super simple since there are only a handful of parameters.

    So yeah, I guess this question is gonna come up more and more.

  • best_heygman
    best_heygman Posts: 10  Freshman Member
    First Comment Friend Collector
    https://community.zyxel.com/en/discussion/comment/61318#Comment_61318

    Said the company whose Ipsec implementation could be exploited for executing OS commands directly on the firewall.

    https://www.cve.news/cve-2024-42057/

    And I don't even blame them for that. Let me explain:

    Wireguard can be implemented with as little as 4 thousand lines of code. Strongswan (an Ipsec implementation) has half a million lines of code. Plenty of code where mistakes and bugs can hide. And that in a protocol that can give an attacker access to my network, or let them execute commands on my firewall, however Zyxel managed to get it wrong like that. But I don't really blame them, Ipsec and Openvpn are just gigantic complex monsters when compared to Wireguard, so it's just expected that Zyxel didn't get it right. I'm pretty sure no one really has and there are security vulnerabilities in every Ipsec implementation. Openvpn I'm not sure.

    I mean, look, that's exactly why I will only even think about using a device as a vpn endpoint when it supports Wireguard.

  • best_heygman
    best_heygman Posts: 10  Freshman Member
    First Comment Friend Collector

    Well, in the mean time, since Zyxel is so tight lipped about this, we could find out if it is at least theoretically possible for them to implement Wireguard on their current devices (in a performant way).
    Wireguard has been integrated into the Linux kernel in version 5.6, so if a device does not have kernel version 5.6 or above, we can be quite certain that it won't receive Wireguard support. That's because you can run Wireguard in userspace instead of directly in the kernel, BUT this impacts performance and cpu usage quite a bit (here is a comparison: https://nordvpn.com/de/blog/wireguard-kernel-module-vs-user-space/ ).

    So, how can we find out the kernel version? I only have a Zyxel scr 50axe, so I can tell you how it works there, it should be similar on their other devices.

    One option is through the diagnostics data. In the scr 50axe you have to login on the local webui, then, in the bottom left you can, at "Diagnostics Collection", you can click "collect" and after it is done, you can download the archive. You should be able to extract it via 7-zip on Windows. On Linux you probably won't even need to install anything and this is probably not even the first time you see a tar archive :)
    On the Flex h series I think you can download it under "Maintainance → Diagnostics", but on the Live Demo device, the demouser can only collect the diagnostics data, but not download it, so I can't look at it myself, since I don't have a flex h personally, but if you have, please take a look for the kernel version :)
    Then, after extracting the archive, you go to "diaginfo-…/tmp/diagnostic/debug/diag_system" and open the file "diag_system_log" in your text editor. Then search for "Linux Version". So, on my scr 50axe I have:

    Linux version 4.4.60 (chung-yu.chiang@a30d3dd1d98d) (gcc version 5.2.0 (OpenWrt GCC 5.2.0 efd04e534+r49254) ) #11 SMP PREEMPT Mon Aug 26 10:54:37 CST 2024

    Which means, since it is version 4.4, it will most probably never get Wireguard support :(

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）