Hi.
So, we've been looking at Wireguard for a while and to be honest I'm not much impressed, yet.
- there is no dynamic address management, client addresses are hard-coded into the configuration
That means we'd need to register each and every active device and assign it a static address on every server. We'd need to store last login timestamps per device and reclaim "idle" addresses, so users couldn't expect to reconnect a device after a few weeks/month because their addresses would have been reassigned. "Unlimited devices" and "no logging" are not really compatible with Wireguard.
- no userspace-hooks, everything runs inside a kernel module
That means we couldn't offer any of our features on a Wireguard tunnel. TrackStop, NeuroRouting, Random exits etc. rely on VPN addresses being added to and removed from IP sets when a user connects or disconnects.
- we can't verify the battery life claims yet. but maybe we were holding it wrong
Stephan ran some battery tests. Maybe he's using a different Android than everybody else but the results were not that much different between Wireguard and our Android IPsec app.
EDIT:
Some details: I tested OpenVPN, built-in IPSec and Wireguard being connected for 24h on a Xperia Compact with Android 7 with medium internet activity (push/pull notifications, twitter running, occasionally loading a website). After 24h all connection methods depleted the battery between 59 and 52 percent. Wireguard was in the the middle. Note this was only a one time run test, so not necessarily reliable. But the difference was so small I did not look further into it so far. -- Stephan
- the hype is great but the code is still young
This may be superstition and there have been bugs found in very old code. But in times of "move fast and break things", we're reluctant to include code that's been explicitly marked "not for production" by the authors and with its core parts still changing rapidly in the kernel of our VPN servers
So, where does that leave us? We're monitoring Wireguard development and are debating whether we should try and implement some of the "missing" features (Wireguard authors may not agree) ourselves. But then we'd run even more experimental code.
It is difficult
