Wireguard?

1235»

Comments

  • tczauderna
    tczauderna Posts: 30  Freshman Member
    Zyxel Certified Network Administrator - WLAN Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Nebula

    In my opinion, OpenVPN would be a better choice than WireGuard, especially in the context of Zyxel's UTMs.

    WireGuard is indeed very lightweight, fast and uses modern cryptography, but it is still relatively young and has limited configuration options - e.g. no support for advanced routing policy or integration with X.509 certificates, which can be problematic in an enterprise environment.

    OpenVPN is a more mature and proven solution - it offers extensive configuration, better integration with existing infrastructure (PKI, certificates, UDP/TCP, L2/L3), and works practically everywhere, even in difficult network conditions.

    For someone who wants a reliable and flexible VPN in UTM, OpenVPN may simply be a more practical choice. WireGuard works great where maximum efficiency and simplicity count, but in more complex scenarios it may not yet be as good as OpenVPN.

  • best_heygman
    best_heygman Posts: 10  Freshman Member
    First Comment Friend Collector

    Well, you can already use OpenVPN on many Zyxel firewalls, like the flex h, so that choice is already here. I also don't think that will go away. OpenVPN and Ipsec will stay for the time being, don't worry about them, because there is stuff like FIPS in the US and the BSI standards in Germany, which mandate certain algorithms. And you can't just change the algorithms in Wireguard willy nilly like you can in OpenVPN or Ipsec (downgrade attacks ahoi), so whenever you're bound to compliance you can't use Wireguard anyway (in the foreseeable future).

    But as an IT Security professional I would really like to have the choice to use Wireguard whenever I can. The design is just so elegant. Like, you can't even discover an open Wireguard port via portscan or whatever, because the server won't even respond when a client can't authenticate in the very first package sent. No variable length header fields, no attack surface for downgrade attacks, no worrying about DDos attacks. And if you care about post quantum security, you can use a pre shared key in addition to ed25519. Just beautiful. Whenever you can, I strongly recommend using it. Whenever you can't, OpenVPN and Ipsec will not go away anytime this decade, probably even longer.

  • Zyxel_Melen
    Zyxel_Melen Posts: 3,149  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate

    Hi @best_heygman,

    The USG FLEX H series supports Tailscale VPN, a WireGuard-based VPN, in firmware V1.32 patch 0. Does this match your requirements?

    Release note link

    Zyxel Melen


  • best_heygman
    best_heygman Posts: 10  Freshman Member
    First Comment Friend Collector

    @Zyxel_Melen
    Yes, I do think it does. Sure, with Tailscale there are many more moving parts than with statically configured Wireguard, however I do think that the added complexity is worth it in relation to the features it brings. Maybe the option to configure an own Tailscale control server (like a self hosted Headscale) instead of only tailscale.com would be nice, either for cost reasons or to not entrust the configuration of the VPN infrastructure to an external provider.
    Other than that, I do think this is a big step forward 👍

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）