{"slug": "wireguard", "name": "WireGuard", "category": "networking", "category_name": "Networking and VPN", "description": "Lightweight open-source VPN protocol and tunnel software built into the Linux kernel.", "recommenders": 29, "commenters": 63, "warners": 1, "score": 33.657, "rising": 6.11, "first": "2025-11-01", "latest": "2026-10-28", "why": "HN commenters use it for simple, reliable remote access to their home networks and for self-hosted tunnels through a VPS.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 29, "neutral": 32, "compare": 4, "warn": 1}, "spark": [1, 4, 3, 1, 2, 0, 0, 2, 4, 3, 5, 4], "listed": true, "loved": ["Home remote access", "Simple setup"], "caveat": "Mesh scaling", "short_quote": "I use Wireguard for several site-to-site VPNs. It just works.", "icon": true, "domain": null, "github_repo": "github.com/jawj/wireguard-setup", "official_url": "https://www.wireguard.com", "pricing": "open source", "aliases": ["WireGuard"], "verdict": [{"text": "HN commenters use it for simple, reliable remote access to their home networks", "cites": [{"id": 801864098, "item_id": 50116506, "url": "https://news.ycombinator.com/item?id=50116506", "by": "cromka", "date": "2026-10-16", "stance": "recommend", "quote": "Then I use Wireguard to seamlessly access my home setup.", "excerpt": "I use Brave and never had a kneed for AdGuard, specifically because of how it uses VPN. Then I use Wireguard to seamlessly access my home setup. Honestly, I choose security and very little admin anxiety over random ads in other, non-browser apps or sites.", "context": "", "use_case": "access home network", "switched_from": "", "story": "What I self-host"}, {"id": 791291538, "item_id": 49455721, "url": "https://news.ycombinator.com/item?id=49455721", "by": "matheusmoreira", "date": "2026-08-26", "stance": "neutral", "quote": "Set up wireguard in my router and now I've got remote access into my LAN.", "excerpt": "Android phone with termux and all the usual Linux tools. I use vim to write code, and I type with the touch screen. Not exactly peak ergonomics, but it works. For me, ability to code while lying down comfortably beats having a physical keyboard and bigger screen. Set up wireguard in my router and now I've got remote access into my LAN. My laptop has essentially become a Linux server. I just ssh in from the phone and ", "context": "", "use_case": "remote LAN access", "switched_from": "", "story": "New Mac Studio with M5 Max and M5 Ultra"}, {"id": 786069392, "item_id": 49129337, "url": "https://news.ycombinator.com/item?id=49129337", "by": "icedchai", "date": "2026-07-31", "stance": "recommend", "quote": "I use Wireguard for several site-to-site VPNs. It just works.", "excerpt": "I use Wireguard for several site-to-site VPNs. It just works. I never have to worry about it, and there are very few configuration settings to mess up (unlike, say, IPsec, which is a nightmare.)", "context": "", "use_case": "site-to-site VPNs", "switched_from": "", "story": "Tailscale didn't stop the Hugging Face intrusion"}, {"id": 797186848, "item_id": 49824178, "url": "https://news.ycombinator.com/item?id=49824178", "by": "davidee", "date": "2026-09-23", "stance": "recommend", "quote": "Wireguard is lightweight, simple, and easy to setup/configure.", "excerpt": "There are no certificates to share with Wireguard. Nothing to rotate if you don't want to. Once it works, it works. I've even got a backup wireguard server running on a Pi 1b. Works fine. We currently run wireguard on our router (and it seems more and more routers are supporting it). There are keys to configure for each client, but once you have the configuration for one client, the rest come very quickly and easily.", "context": "runs it on their router and a backup Pi server", "use_case": "tunneling traffic through home network", "switched_from": "", "story": "Making Tailscale Faster"}]}, {"text": " and for self-hosted tunnels through a VPS.", "cites": [{"id": 804338080, "item_id": 50271130, "url": "https://news.ycombinator.com/item?id=50271130", "by": "LeBit", "date": "2026-10-28", "stance": "recommend", "quote": "Using Wireguard, you connect from a always on server in your home to your VPS.", "excerpt": "Having a VPS gives you a static, non-shared, stable IP with a whois that doesn\u2019t resolve to a residential ISP. Lot\u2019s of ISP have moved to CGNAT where port forwarding has become a nightmare. That\u2019s one reason. You can look at it as if your router moved from your home behind a public CGNAT, dynamic, shared IP to a public non-shared, static, stable IP on the internet. In a workplace setting, connecting to your residenti", "context": "", "use_case": "connecting home server via VPS", "switched_from": "", "story": "Tailscale SSH: Investigation and remediation update"}, {"id": 799274960, "item_id": 49954685, "url": "https://news.ycombinator.com/item?id=49954685", "by": "newsoftheday", "date": "2026-10-04", "stance": "recommend", "quote": "I use the cloud for one thing, to run Wireguard VPN to have a public point of presence", "excerpt": "Completely agree, I use the cloud for one thing, to run Wireguard VPN to have a public point of presence but all hardware and services run right here where I'm looking at them right now and can put my hands on them.", "context": "runs all hardware and services at home", "use_case": "public point of presence for home services", "switched_from": "", "story": "We want you to build the next Git platform on Cloudflare"}, {"id": 779771648, "item_id": 48735728, "url": "https://news.ycombinator.com/item?id=48735728", "by": "khurs", "date": "2026-06-30", "stance": "recommend", "quote": "There are lots of guide online of getting a cheap VPS and installing Wireguard on it.", "excerpt": "What's the best alternative for the more privacy/safety paranoid? Run your own? There are lots of guide online of getting a cheap VPS and installing Wireguard on it.", "context": "", "use_case": "self-hosted VPN", "switched_from": "", "story": "Ask HN: Mullvad Alternatives?"}, {"id": 783418544, "item_id": 48963659, "url": "https://news.ycombinator.com/item?id=48963659", "by": "doawoo", "date": "2026-07-18", "stance": "recommend", "quote": "I use a Wireguard VPN to tunnel traffic to a tiny public facing Caddy server", "excerpt": "Yup, I have a similar setup where I use a Wireguard VPN to tunnel traffic to a tiny public facing Caddy server, which proxies the traffic to the server under my own roof. No Cloudflare!", "context": "self-hosts a server at home", "use_case": "tunnel to self-hosted server", "switched_from": "", "story": "Hardcore IndieWeb: Run your own website 100% independently for only $0.01/day"}]}, {"text": " The most common caveat is that managing peer keys by hand gets unwieldy as the number of devices grows,", "cites": [{"id": 800335986, "item_id": 50020999, "url": "https://news.ycombinator.com/item?id=50020999", "by": "AlexAltea", "date": "2026-10-09", "stance": "compare", "quote": "I initially used WireGuard, but as my home lab scaled, it became unwieldy.", "excerpt": "Once you get to N = >10 devices, and expect some degree of decentralized communication between them you find yourself maintaining N^2 entries. Every change to the set of public keys, require you updating N entries. Things get worse once you want consistent rules on what-device-should-access-what. I initially used WireGuard, but as my home lab scaled, it became unwieldy. Some people could work around these limitations", "context": "home lab with 10+ devices", "use_case": "emergency access to key servers", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 761514161, "item_id": 47594635, "url": "https://news.ycombinator.com/item?id=47594635", "by": "imiric", "date": "2026-03-31", "stance": "neutral", "quote": "you can also manage this configuration yourself", "excerpt": "Tailscale is not different. It simply makes managing WG configuration easier, and adds some useful value-added features on top. But, as you know, you can also manage this configuration yourself, either via traditional config mgmt tools, helpers like wg-meshconf, or even plain shell scripts, if you like. I'm aware this is a very HN-Dropboxy comment, but it's really not that complex[1], and is easily manageable for a s", "context": "", "use_case": "VPN", "switched_from": "tinc", "story": "I traced my traffic through a home Tailscale exit node"}]}, {"text": " where Tailscale is easier for a full mesh.", "cites": [{"id": 800409492, "item_id": 50025593, "url": "https://news.ycombinator.com/item?id=50025593", "by": "MayeulC", "date": "2026-10-09", "stance": "recommend", "quote": "I like Wireguard, but Tailscale is much easier to manage for full mesh and just adding personal devices.", "excerpt": "Well, I have a VPS, plus multiple physical servers in different locations (parents, etc). The VPS is useful for: - sending e-mails (hard to improve your reputation on residential IPs and get a reverse DNS record) - Unifi controller, though I appreciate Unifi less and less. - Uptime monitoring / status page - I think I'll move my headscale node there, since it has the highest availability -- Internet was out for a wee", "context": "", "use_case": "VPN links between nodes", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 800335986, "item_id": 50020999, "url": "https://news.ycombinator.com/item?id=50020999", "by": "AlexAltea", "date": "2026-10-09", "stance": "compare", "quote": "I initially used WireGuard, but as my home lab scaled, it became unwieldy.", "excerpt": "Once you get to N = >10 devices, and expect some degree of decentralized communication between them you find yourself maintaining N^2 entries. Every change to the set of public keys, require you updating N entries. Things get worse once you want consistent rules on what-device-should-access-what. I initially used WireGuard, but as my home lab scaled, it became unwieldy. Some people could work around these limitations", "context": "home lab with 10+ devices", "use_case": "emergency access to key servers", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}]}], "praise": [{"label": "Home remote access", "summary": "Gives secure access to home servers, files, media and LAN from anywhere.", "quotes": [{"id": 801864098, "item_id": 50116506, "url": "https://news.ycombinator.com/item?id=50116506", "by": "cromka", "date": "2026-10-16", "stance": "recommend", "quote": "Then I use Wireguard to seamlessly access my home setup.", "excerpt": "I use Brave and never had a kneed for AdGuard, specifically because of how it uses VPN. Then I use Wireguard to seamlessly access my home setup. Honestly, I choose security and very little admin anxiety over random ads in other, non-browser apps or sites.", "context": "", "use_case": "access home network", "switched_from": "", "story": "What I self-host"}, {"id": 791291538, "item_id": 49455721, "url": "https://news.ycombinator.com/item?id=49455721", "by": "matheusmoreira", "date": "2026-08-26", "stance": "neutral", "quote": "Set up wireguard in my router and now I've got remote access into my LAN.", "excerpt": "Android phone with termux and all the usual Linux tools. I use vim to write code, and I type with the touch screen. Not exactly peak ergonomics, but it works. For me, ability to code while lying down comfortably beats having a physical keyboard and bigger screen. Set up wireguard in my router and now I've got remote access into my LAN. My laptop has essentially become a Linux server. I just ssh in from the phone and ", "context": "", "use_case": "remote LAN access", "switched_from": "", "story": "New Mac Studio with M5 Max and M5 Ultra"}, {"id": 765079217, "item_id": 47817451, "url": "https://news.ycombinator.com/item?id=47817451", "by": "nightski", "date": "2026-04-18", "stance": "neutral", "quote": "can access them anywhere via a WireGuard VPN", "excerpt": "I have a smattering of books on Kindle, mostly fiction/novels. But the vast majority of my book conllection consists of non-fiction/textbooks and I recently switched to Booklore on my NAS. I have over 900 textbooks and can access them anywhere via a WireGuard VPN. It's so slick! Booklore seems great, but I'll admit there may be even better options. However this is the future of books for me. I'd like to start replaci", "context": "", "use_case": "remote access to NAS", "switched_from": "", "story": "Amazon is discontinuing Kindle for PC on June 30th"}]}, {"label": "Simple setup", "summary": "Commenters describe setup as quick and simple compared with OpenVPN, IPsec and strongSwan.", "quotes": [{"id": 797208528, "item_id": 49825533, "url": "https://news.ycombinator.com/item?id=49825533", "by": "havaloc", "date": "2026-09-24", "stance": "recommend", "quote": "up to 954mbps or so of Wireguard to right inside my home network. It took 2 minutes to set up.", "excerpt": "I use an Island Router with Wireguard server built in, it handles DDNS and even the base Island router is beefy enough to give me up to 954mbps or so of Wireguard to right inside my home network. It took 2 minutes to set up. That being said, I do understand the appeal of Tailscale and have used it.", "context": "", "use_case": "home remote access VPN", "switched_from": "", "story": "Making Tailscale Faster"}, {"id": 797186848, "item_id": 49824178, "url": "https://news.ycombinator.com/item?id=49824178", "by": "davidee", "date": "2026-09-23", "stance": "recommend", "quote": "Wireguard is lightweight, simple, and easy to setup/configure.", "excerpt": "There are no certificates to share with Wireguard. Nothing to rotate if you don't want to. Once it works, it works. I've even got a backup wireguard server running on a Pi 1b. Works fine. We currently run wireguard on our router (and it seems more and more routers are supporting it). There are keys to configure for each client, but once you have the configuration for one client, the rest come very quickly and easily.", "context": "runs it on their router and a backup Pi server", "use_case": "tunneling traffic through home network", "switched_from": "", "story": "Making Tailscale Faster"}, {"id": 788533088, "item_id": 49283318, "url": "https://news.ycombinator.com/item?id=49283318", "by": "gmac", "date": "2026-08-13", "stance": "recommend", "quote": "I have now mostly switched to Wireguard for this, which is much more sane", "excerpt": "Yes \u2014 configuring strongSwan as a bog-standard VPN server was so hard to fathom I made GitHub repo for it [1]. To be fair, some of the complexity comes from OS support that seems specifically designed to make secure setups difficult, presumably at the behest of various Three Letter Agencies. I have now mostly switched to Wireguard for this, which is much more sane [2]. [1] https://github.com/jawj/IKEv2-setup [2] http", "context": "", "use_case": "VPN server", "switched_from": "strongSwan", "story": "Tailscale Traces Database Corruption to 16y/o SQLite WAL-Reset Bug"}]}, {"label": "Self-hosted VPS tunnels", "summary": "Pairs with a cheap VPS for a public endpoint, an exit node or a way around CGNAT.", "quotes": [{"id": 804338080, "item_id": 50271130, "url": "https://news.ycombinator.com/item?id=50271130", "by": "LeBit", "date": "2026-10-28", "stance": "recommend", "quote": "Using Wireguard, you connect from a always on server in your home to your VPS.", "excerpt": "Having a VPS gives you a static, non-shared, stable IP with a whois that doesn\u2019t resolve to a residential ISP. Lot\u2019s of ISP have moved to CGNAT where port forwarding has become a nightmare. That\u2019s one reason. You can look at it as if your router moved from your home behind a public CGNAT, dynamic, shared IP to a public non-shared, static, stable IP on the internet. In a workplace setting, connecting to your residenti", "context": "", "use_case": "connecting home server via VPS", "switched_from": "", "story": "Tailscale SSH: Investigation and remediation update"}, {"id": 799274960, "item_id": 49954685, "url": "https://news.ycombinator.com/item?id=49954685", "by": "newsoftheday", "date": "2026-10-04", "stance": "recommend", "quote": "I use the cloud for one thing, to run Wireguard VPN to have a public point of presence", "excerpt": "Completely agree, I use the cloud for one thing, to run Wireguard VPN to have a public point of presence but all hardware and services run right here where I'm looking at them right now and can put my hands on them.", "context": "runs all hardware and services at home", "use_case": "public point of presence for home services", "switched_from": "", "story": "We want you to build the next Git platform on Cloudflare"}, {"id": 778740672, "item_id": 48671292, "url": "https://news.ycombinator.com/item?id=48671292", "by": "pSYoniK", "date": "2026-06-25", "stance": "recommend", "quote": "setting up a VPS to act as an exit node for Wireguard, my article covers most things", "excerpt": "I have submitted this before, but for those maybe a bit uncomfortable with setting up a VPS to act as an exit node for Wireguard, my article covers most things: https://psyonik.tech/posts/a-guide-for-wireguard-vpn-setup-with-pi-hole-adblock-and-unbound-dns/ For this particular use case, I would probably suggest something like OVH/Scaleway as they have nodes in France so physical distance between UK and \"somewhere els", "context": "", "use_case": "VPN exit node", "switched_from": "", "story": "Pondering routing more of my traffic via nodes outside the UK"}]}, {"label": "Just works", "summary": "Commenters report stable connections they rarely need to think about.", "quotes": [{"id": 786069392, "item_id": 49129337, "url": "https://news.ycombinator.com/item?id=49129337", "by": "icedchai", "date": "2026-07-31", "stance": "recommend", "quote": "I use Wireguard for several site-to-site VPNs. It just works.", "excerpt": "I use Wireguard for several site-to-site VPNs. It just works. I never have to worry about it, and there are very few configuration settings to mess up (unlike, say, IPsec, which is a nightmare.)", "context": "", "use_case": "site-to-site VPNs", "switched_from": "", "story": "Tailscale didn't stop the Hugging Face intrusion"}, {"id": 742713120, "item_id": 46419570, "url": "https://news.ycombinator.com/item?id=46419570", "by": "acheong08", "date": "2025-12-29", "stance": "recommend", "quote": "Wireguard literally just works (to a VPS).", "excerpt": "Currently in China (as a visitor). Wireguard literally just works (to a VPS). Mullvad works as a commercial provider, just slower. Xray-core (vless, Trojan) if you're paranoid. I have my own proxy over syncthing relays https://github.com/acheong08/syndicate which I use to proxy to my home in the UK (residential IP) without exposing any ports. I get rate limited to around 10mbps in Chongqing. Was slightly higher in Be", "context": "visitor in China", "use_case": "bypassing censorship in China", "switched_from": "", "story": "Tor staying ahead of censors in 2025"}, {"id": 797184272, "item_id": 49824017, "url": "https://news.ycombinator.com/item?id=49824017", "by": "fitblipper", "date": "2026-09-23", "stance": "recommend", "quote": "raw wireguard more stable (I don't have to fight the DNS issues on my mobile phones) it feels faster and is amazingly simple to set up", "excerpt": "I used to LOVE tailscale. Then I put wireguard on my home network exposed to the internet with a dynamic DNS provider and it immediately became irrelevant. Not only is raw wireguard more stable (I don't have to fight the DNS issues on my mobile phones) it feels faster and is amazingly simple to set up.", "context": "runs WireGuard on home network with dynamic DNS", "use_case": "home network VPN", "switched_from": "Tailscale", "story": "Making Tailscale Faster"}]}, {"label": "Router support", "summary": "Runs directly on routers such as OpenWrt, so it can cover a whole LAN or work with travel hotspots.", "quotes": [{"id": 797224993, "item_id": 49826562, "url": "https://news.ycombinator.com/item?id=49826562", "by": "fitblipper", "date": "2026-09-24", "stance": "recommend", "quote": "I have an openwrt router running wireguard.", "excerpt": "I have an openwrt router running wireguard. I use it to provision the peer keys and routes. I also use openwrts cloudflare ddns which is super simple to setup. Any new client I want to add I jump into the wireguard interface in the GUI, go to the peer tab, and it does everything for me there.", "context": "", "use_case": "remote access VPN", "switched_from": "", "story": "Making Tailscale Faster"}, {"id": 737309218, "item_id": 46081826, "url": "https://news.ycombinator.com/item?id=46081826", "by": "oliwarner", "date": "2025-11-28", "stance": "recommend", "quote": "Install the Wireguard packages, create a connection to your VPN of choice", "excerpt": "This is quite easy with OpenWRT. Install the Wireguard packages, create a connection to your VPN of choice in a nearby country (I chose Sweden). Then I used the \"vpn-policy-routing\" package to route Imgur IPs (199.232.196.193 199.232.192.193) through the VPN. Works for websites that keep nagging you for age verification too. But seriously, it's been more emotional than I'd expected to get my cat memes back.", "context": "", "use_case": "VPN connection", "switched_from": "", "story": "Imgur geo-blocked the UK, so I geo-unblocked my network"}, {"id": 791936723, "item_id": 49496045, "url": "https://news.ycombinator.com/item?id=49496045", "by": "nunez", "date": "2026-08-30", "stance": "recommend", "quote": "since it's just WG, it works perfectly with my GL.iNet travel hotspots", "excerpt": "I have a Firewalla. They run a WireGuard proxy (sort of like a DERP in Tailscale), so I use that. It actually works more often than Tailscale somehow, and since it's just WG, it works perfectly with my GL.iNet travel hotspots. Firewalla also has ad blocking baked in with less restrictive blacklists, so that's what I use. Before I got the FW, I used Tailscale and AdGuard Home.", "context": "", "use_case": "VPN", "switched_from": "", "story": "\u201cIt works better in the app\u201d"}]}, {"label": "Speed", "summary": "Reported as fast, with near-gigabit throughput and strong bulk performance in the kernel.", "quotes": [{"id": 797208528, "item_id": 49825533, "url": "https://news.ycombinator.com/item?id=49825533", "by": "havaloc", "date": "2026-09-24", "stance": "recommend", "quote": "up to 954mbps or so of Wireguard to right inside my home network. It took 2 minutes to set up.", "excerpt": "I use an Island Router with Wireguard server built in, it handles DDNS and even the base Island router is beefy enough to give me up to 954mbps or so of Wireguard to right inside my home network. It took 2 minutes to set up. That being said, I do understand the appeal of Tailscale and have used it.", "context": "", "use_case": "home remote access VPN", "switched_from": "", "story": "Making Tailscale Faster"}, {"id": 797184272, "item_id": 49824017, "url": "https://news.ycombinator.com/item?id=49824017", "by": "fitblipper", "date": "2026-09-23", "stance": "recommend", "quote": "raw wireguard more stable (I don't have to fight the DNS issues on my mobile phones) it feels faster and is amazingly simple to set up", "excerpt": "I used to LOVE tailscale. Then I put wireguard on my home network exposed to the internet with a dynamic DNS provider and it immediately became irrelevant. Not only is raw wireguard more stable (I don't have to fight the DNS issues on my mobile phones) it feels faster and is amazingly simple to set up.", "context": "runs WireGuard on home network with dynamic DNS", "use_case": "home network VPN", "switched_from": "Tailscale", "story": "Making Tailscale Faster"}, {"id": 801661489, "item_id": 50103843, "url": "https://news.ycombinator.com/item?id=50103843", "by": "tamimio", "date": "2026-10-15", "stance": "compare", "quote": "i found kernel wireguard performs better at bulk throughput", "excerpt": "Looks very interesting, I have been building few things on top of iroh past few weeks and I love it, from the ability to run it on some iot all the way to be rf agnostic (almost, can\u2019t use LoRa with iroh due to its datagram limit), and best part, MoQ runs natively on iroh where on wireguard you will need to encrypt twice so more cpu, but i found kernel wireguard performs better at bulk throughput, and layer 3 isn\u2019t b", "context": "", "use_case": "bulk throughput tunneling", "switched_from": "", "story": "Show HN: Flipflop \u2013 Iroh-powered persistent tunnels for filesharing"}]}], "caveats": [{"label": "Mesh scaling", "summary": "Keys and peer entries become hard to maintain by hand beyond about ten devices.", "quotes": [{"id": 800335986, "item_id": 50020999, "url": "https://news.ycombinator.com/item?id=50020999", "by": "AlexAltea", "date": "2026-10-09", "stance": "compare", "quote": "I initially used WireGuard, but as my home lab scaled, it became unwieldy.", "excerpt": "Once you get to N = >10 devices, and expect some degree of decentralized communication between them you find yourself maintaining N^2 entries. Every change to the set of public keys, require you updating N entries. Things get worse once you want consistent rules on what-device-should-access-what. I initially used WireGuard, but as my home lab scaled, it became unwieldy. Some people could work around these limitations", "context": "home lab with 10+ devices", "use_case": "emergency access to key servers", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 800409492, "item_id": 50025593, "url": "https://news.ycombinator.com/item?id=50025593", "by": "MayeulC", "date": "2026-10-09", "stance": "recommend", "quote": "I like Wireguard, but Tailscale is much easier to manage for full mesh and just adding personal devices.", "excerpt": "Well, I have a VPS, plus multiple physical servers in different locations (parents, etc). The VPS is useful for: - sending e-mails (hard to improve your reputation on residential IPs and get a reverse DNS record) - Unifi controller, though I appreciate Unifi less and less. - Uptime monitoring / status page - I think I'll move my headscale node there, since it has the highest availability -- Internet was out for a wee", "context": "", "use_case": "VPN links between nodes", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 761514161, "item_id": 47594635, "url": "https://news.ycombinator.com/item?id=47594635", "by": "imiric", "date": "2026-03-31", "stance": "neutral", "quote": "you can also manage this configuration yourself", "excerpt": "Tailscale is not different. It simply makes managing WG configuration easier, and adds some useful value-added features on top. But, as you know, you can also manage this configuration yourself, either via traditional config mgmt tools, helpers like wg-meshconf, or even plain shell scripts, if you like. I'm aware this is a very HN-Dropboxy comment, but it's really not that complex[1], and is easily manageable for a s", "context": "", "use_case": "VPN", "switched_from": "tinc", "story": "I traced my traffic through a home Tailscale exit node"}]}, {"label": "NAT issues", "summary": "One DIY setup at work kept hitting NAT problems on poorly configured hotel networks.", "quotes": [{"id": 782700993, "item_id": 48918812, "url": "https://news.ycombinator.com/item?id=48918812", "by": "traceroute66", "date": "2026-07-15", "stance": "neutral", "quote": "too many random issues with NAT with our standard DIY Wireguard setup", "excerpt": "At $work we use Tailscale mostly because we were running into too many random issues with NAT with our standard DIY Wireguard setup, especially when people were working from hotels and other places with half-ass network setups. But we don't trust Tailscale. Just look at the thousands of unresolved Github issues, many of which are actually quite important/useful but have been ignored for months and years. We very much", "context": "", "use_case": "VPN", "switched_from": "", "story": "TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access"}]}, {"label": "High-end throughput", "summary": "One commenter says IPsec with hardware firewalls scales better at 10G and above.", "quotes": [{"id": 745752432, "item_id": 46609527, "url": "https://news.ycombinator.com/item?id=46609527", "by": "iscoelho", "date": "2026-01-13", "stance": "warn", "quote": "WireGuard is comparatively quite slow performance-wise.", "excerpt": "VXLAN over WireGuard is acceptable if you require a shared L2 boundary. IPSec over VXLAN is what I recommend if you are doing 10G or above. There is a much higher performance ceiling than WireGuard with IPSec via hardware firewalls. WireGuard is comparatively quite slow performance-wise. Noting Tailscale, since it has been mentioned, has comparatively extremely slow performance.", "context": "", "use_case": "10G+ site links", "switched_from": "", "story": "Ask HN: Vxlan over WireGuard or WireGuard over Vxlan?"}]}], "who": [{"by": "chr15m", "context": "home tinkerer", "url": "https://news.ycombinator.com/item?id=50015915", "date": "2026-10-09"}, {"by": "newsoftheday", "context": "runs all hardware and services at home", "url": "https://news.ycombinator.com/item?id=49954685", "date": "2026-10-04"}, {"by": "brokenmachine", "context": "Android user with home server", "url": "https://news.ycombinator.com/item?id=49826456", "date": "2026-09-24"}, {"by": "davidee", "context": "runs it on their router and a backup Pi server", "url": "https://news.ycombinator.com/item?id=49824178", "date": "2026-09-23"}, {"by": "fitblipper", "context": "runs WireGuard on home network with dynamic DNS", "url": "https://news.ycombinator.com/item?id=49824017", "date": "2026-09-23"}, {"by": "doawoo", "context": "self-hosts a server at home", "url": "https://news.ycombinator.com/item?id=48963659", "date": "2026-07-18"}, {"by": "raffraffraff", "context": "home network user", "url": "https://news.ycombinator.com/item?id=48848512", "date": "2026-07-09"}, {"by": "icedchai", "context": "runs own ASN", "url": "https://news.ycombinator.com/item?id=48794390", "date": "2026-07-05"}, {"by": "wookmaster", "context": "self-hosts a home server", "url": "https://news.ycombinator.com/item?id=48776985", "date": "2026-07-03"}, {"by": "Fnoord", "context": "self-hosts, wants less reliance on US cloud", "url": "https://news.ycombinator.com/item?id=48597079", "date": "2026-06-19"}, {"by": "acidburnNSA", "context": "homelab owner", "url": "https://news.ycombinator.com/item?id=47299376", "date": "2026-03-08"}, {"by": "tzs", "context": "Docker on Mac user", "url": "https://news.ycombinator.com/item?id=47291296", "date": "2026-03-07"}], "tags": ["self-hostable", "for homelabs", "runs on routers", "for site-to-site VPNs", "for small deployments"], "use_cases": ["vpn", "remote access to home server", "self-hosted vpn", "remote access", "connecting home server via vps", "vpn terminating on router"], "compared": [{"slug": "tailscale", "name": "Tailscale", "co": 25, "switched_from": 1, "switched_to": 4}, {"slug": "headscale", "name": "Headscale", "co": 6, "switched_from": 0, "switched_to": 1}, {"slug": "openwrt", "name": "OpenWrt", "co": 5, "switched_from": 0, "switched_to": 0}, {"slug": "tinc", "name": "Tinc", "co": 2, "switched_from": 1, "switched_to": 0}, {"slug": "jellyfin", "name": "Jellyfin", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "proxmox", "name": "Proxmox", "co": 3, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49819880", "title": "Making Tailscale Faster", "mentions": 4}, {"url": "https://news.ycombinator.com/item?id=50264857", "title": "Tailscale SSH: Investigation and remediation update", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=49985548", "title": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=50109715", "title": "What I self-host", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49127306", "title": "Tailscale didn't stop the Hugging Face intrusion", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=47592462", "title": "I traced my traffic through a home Tailscale exit node", "mentions": 2}], "sentiment_by_month": {"2025-11": {"neutral": 2, "recommend": 1}, "2025-12": {"neutral": 1, "recommend": 4}, "2026-01": {"neutral": 6, "compare": 1, "recommend": 3, "warn": 1}, "2026-02": {"neutral": 2, "recommend": 1}, "2026-03": {"neutral": 4, "recommend": 2}, "2026-04": {"neutral": 2}, "2026-05": {}, "2026-06": {"neutral": 2, "recommend": 2}, "2026-07": {"neutral": 5, "recommend": 4, "compare": 1}, "2026-08": {"recommend": 3, "neutral": 1}, "2026-09": {"neutral": 3, "recommend": 5}, "2026-10": {"recommend": 4, "neutral": 4, "compare": 2}}, "quotes": [{"id": 804338080, "item_id": 50271130, "url": "https://news.ycombinator.com/item?id=50271130", "by": "LeBit", "date": "2026-10-28", "stance": "recommend", "quote": "Using Wireguard, you connect from a always on server in your home to your VPS.", "excerpt": "Having a VPS gives you a static, non-shared, stable IP with a whois that doesn\u2019t resolve to a residential ISP. Lot\u2019s of ISP have moved to CGNAT where port forwarding has become a nightmare. That\u2019s one reason. You can look at it as if your router moved from your home behind a public CGNAT, dynamic, shared IP to a public non-shared, static, stable IP on the internet. In a workplace setting, connecting to your residenti", "context": "", "use_case": "connecting home server via VPS", "switched_from": "", "story": "Tailscale SSH: Investigation and remediation update"}, {"id": 804335728, "item_id": 50270983, "url": "https://news.ycombinator.com/item?id=50270983", "by": "hdgvhicv", "date": "2026-10-28", "stance": "neutral", "quote": "my WireGuard connection needs nat as it terminates on my router", "excerpt": "Functionally they are. Allow traffic aiming at this address and this port to arrive on this server. Not that my WireGuard connection needs nat as it terminates on my router. And I use private ip ranges as I want to be sure that if WireGuard drops out for some reason traffic doesn\u2019t route over the unencrypted path. Defence in depth.", "context": "", "use_case": "VPN terminating on router", "switched_from": "", "story": "Tailscale SSH: Investigation and remediation update"}, {"id": 804329824, "item_id": 50270614, "url": "https://news.ycombinator.com/item?id=50270614", "by": "wrxd", "date": "2026-10-28", "stance": "neutral", "quote": "I use plain WireGuard.", "excerpt": "I use plain WireGuard. My use case is very simple: I have a server and a few clients (phone, laptop) I want to connect to the server when I'm away. I don't care to have VPN connectivity between my phone and laptop", "context": "", "use_case": "connect phone and laptop to server", "switched_from": "", "story": "Tailscale SSH: Investigation and remediation update"}, {"id": 801864098, "item_id": 50116506, "url": "https://news.ycombinator.com/item?id=50116506", "by": "cromka", "date": "2026-10-16", "stance": "recommend", "quote": "Then I use Wireguard to seamlessly access my home setup.", "excerpt": "I use Brave and never had a kneed for AdGuard, specifically because of how it uses VPN. Then I use Wireguard to seamlessly access my home setup. Honestly, I choose security and very little admin anxiety over random ads in other, non-browser apps or sites.", "context": "", "use_case": "access home network", "switched_from": "", "story": "What I self-host"}, {"id": 801812802, "item_id": 50113300, "url": "https://news.ycombinator.com/item?id=50113300", "by": "theoreticalmal", "date": "2026-10-16", "stance": "neutral", "quote": "allow split horizon DNS that allows Wireguard tunnels to work seamlessly whether you\u2019re on or off your home network", "excerpt": "Pfsense and maybe openwrt allow split horizon DNS that allows Wireguard tunnels to work seamlessly whether you\u2019re on or off your home network. Took me years to figure out but it\u2019s what I use now", "context": "", "use_case": "home VPN", "switched_from": "", "story": "What I self-host"}, {"id": 801661489, "item_id": 50103843, "url": "https://news.ycombinator.com/item?id=50103843", "by": "tamimio", "date": "2026-10-15", "stance": "compare", "quote": "i found kernel wireguard performs better at bulk throughput", "excerpt": "Looks very interesting, I have been building few things on top of iroh past few weeks and I love it, from the ability to run it on some iot all the way to be rf agnostic (almost, can\u2019t use LoRa with iroh due to its datagram limit), and best part, MoQ runs natively on iroh where on wireguard you will need to encrypt twice so more cpu, but i found kernel wireguard performs better at bulk throughput, and layer 3 isn\u2019t b", "context": "", "use_case": "bulk throughput tunneling", "switched_from": "", "story": "Show HN: Flipflop \u2013 Iroh-powered persistent tunnels for filesharing"}, {"id": 800409492, "item_id": 50025593, "url": "https://news.ycombinator.com/item?id=50025593", "by": "MayeulC", "date": "2026-10-09", "stance": "recommend", "quote": "I like Wireguard, but Tailscale is much easier to manage for full mesh and just adding personal devices.", "excerpt": "Well, I have a VPS, plus multiple physical servers in different locations (parents, etc). The VPS is useful for: - sending e-mails (hard to improve your reputation on residential IPs and get a reverse DNS record) - Unifi controller, though I appreciate Unifi less and less. - Uptime monitoring / status page - I think I'll move my headscale node there, since it has the highest availability -- Internet was out for a wee", "context": "", "use_case": "VPN links between nodes", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 800335986, "item_id": 50020999, "url": "https://news.ycombinator.com/item?id=50020999", "by": "AlexAltea", "date": "2026-10-09", "stance": "compare", "quote": "I initially used WireGuard, but as my home lab scaled, it became unwieldy.", "excerpt": "Once you get to N = >10 devices, and expect some degree of decentralized communication between them you find yourself maintaining N^2 entries. Every change to the set of public keys, require you updating N entries. Things get worse once you want consistent rules on what-device-should-access-what. I initially used WireGuard, but as my home lab scaled, it became unwieldy. Some people could work around these limitations", "context": "home lab with 10+ devices", "use_case": "emergency access to key servers", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 800254640, "item_id": 50015915, "url": "https://news.ycombinator.com/item?id=50015915", "by": "chr15m", "date": "2026-10-09", "stance": "neutral", "quote": "can all see each other on the same Wireguard network via the VPS", "excerpt": "I have so much personal automation and small web apps running on my VPS, laptop, and on my phone it's hard to know where to start. - laptop, phone (termux), Linux VPS, and home inference machine can all see each other on the same Wireguard network via the VPS. - Todo list web app for our family shopping list. Used daily for many years now. - Personal daily updating dashboard with important numbers I care about, life ", "context": "home tinkerer", "use_case": "private network between devices", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 799274960, "item_id": 49954685, "url": "https://news.ycombinator.com/item?id=49954685", "by": "newsoftheday", "date": "2026-10-04", "stance": "recommend", "quote": "I use the cloud for one thing, to run Wireguard VPN to have a public point of presence", "excerpt": "Completely agree, I use the cloud for one thing, to run Wireguard VPN to have a public point of presence but all hardware and services run right here where I'm looking at them right now and can put my hands on them.", "context": "runs all hardware and services at home", "use_case": "public point of presence for home services", "switched_from": "", "story": "We want you to build the next Git platform on Cloudflare"}, {"id": 797281392, "item_id": 49830087, "url": "https://news.ycombinator.com/item?id=49830087", "by": "hackeryojo", "date": "2026-09-24", "stance": "recommend", "quote": "switched to Wireguard. I find its much better", "excerpt": "Not anymore, used to have it but switched to Wireguard. I find its much better", "context": "", "use_case": "VPN", "switched_from": "Firefox VPN", "story": "Ask HN: Firefox VPN Anyone?"}, {"id": 797224993, "item_id": 49826562, "url": "https://news.ycombinator.com/item?id=49826562", "by": "fitblipper", "date": "2026-09-24", "stance": "recommend", "quote": "I have an openwrt router running wireguard.", "excerpt": "I have an openwrt router running wireguard. I use it to provision the peer keys and routes. I also use openwrts cloudflare ddns which is super simple to setup. Any new client I want to add I jump into the wireguard interface in the GUI, go to the peer tab, and it does everything for me there.", "context": "", "use_case": "remote access VPN", "switched_from": "", "story": "Making Tailscale Faster"}, {"id": 797223298, "item_id": 49826456, "url": "https://news.ycombinator.com/item?id=49826456", "by": "brokenmachine", "date": "2026-09-24", "stance": "neutral", "quote": "all over a wireguard VPN", "excerpt": "I use termux to ssh and RealVNC to connect to a remote vnc session, all over a wireguard VPN. Also Syncthing to automatically sync files between the phone and my home server. I download podcasts and audiobooks into a folder on the server and they're automatically on my phone ready to play. Immich to connect to my self-hosted media. And ntfy to get notifications from my home stuff. Tasker to automatically activate my ", "context": "Android user with home server", "use_case": "VPN to home", "switched_from": "", "story": "Apple iPhone 18 Pro Camera test"}, {"id": 797208528, "item_id": 49825533, "url": "https://news.ycombinator.com/item?id=49825533", "by": "havaloc", "date": "2026-09-24", "stance": "recommend", "quote": "up to 954mbps or so of Wireguard to right inside my home network. It took 2 minutes to set up.", "excerpt": "I use an Island Router with Wireguard server built in, it handles DDNS and even the base Island router is beefy enough to give me up to 954mbps or so of Wireguard to right inside my home network. It took 2 minutes to set up. That being said, I do understand the appeal of Tailscale and have used it.", "context": "", "use_case": "home remote access VPN", "switched_from": "", "story": "Making Tailscale Faster"}, {"id": 797186848, "item_id": 49824178, "url": "https://news.ycombinator.com/item?id=49824178", "by": "davidee", "date": "2026-09-23", "stance": "recommend", "quote": "Wireguard is lightweight, simple, and easy to setup/configure.", "excerpt": "There are no certificates to share with Wireguard. Nothing to rotate if you don't want to. Once it works, it works. I've even got a backup wireguard server running on a Pi 1b. Works fine. We currently run wireguard on our router (and it seems more and more routers are supporting it). There are keys to configure for each client, but once you have the configuration for one client, the rest come very quickly and easily.", "context": "runs it on their router and a backup Pi server", "use_case": "tunneling traffic through home network", "switched_from": "", "story": "Making Tailscale Faster"}, {"id": 797184272, "item_id": 49824017, "url": "https://news.ycombinator.com/item?id=49824017", "by": "fitblipper", "date": "2026-09-23", "stance": "recommend", "quote": "raw wireguard more stable (I don't have to fight the DNS issues on my mobile phones) it feels faster and is amazingly simple to set up", "excerpt": "I used to LOVE tailscale. Then I put wireguard on my home network exposed to the internet with a dynamic DNS provider and it immediately became irrelevant. Not only is raw wireguard more stable (I don't have to fight the DNS issues on my mobile phones) it feels faster and is amazingly simple to set up.", "context": "runs WireGuard on home network with dynamic DNS", "use_case": "home network VPN", "switched_from": "Tailscale", "story": "Making Tailscale Faster"}, {"id": 796768672, "item_id": 49798042, "url": "https://news.ycombinator.com/item?id=49798042", "by": "alexfortin", "date": "2026-09-22", "stance": "recommend", "quote": "I just prefer WireGuard UX.", "excerpt": "Fair, I still have to find a place that restricts UDP but iirc WireGuard should offer TCP as well. By the way, if you check out the repository's README it already shows the SSH use case, but why not to have WireGuard available too? with it there's no need to manually setup any application to use/not use SOCKS, it's as simple as click \"Connect\" in the WireGuard client and all the traffic including ICMP and what not is", "context": "", "use_case": "tunneling all traffic through a server", "switched_from": "", "story": "Show HN: Cheap and easy throwaway VPN server"}, {"id": 796182930, "item_id": 49761433, "url": "https://news.ycombinator.com/item?id=49761433", "by": "eMpHaSe", "date": "2026-09-18", "stance": "neutral", "quote": "Wireguard VPN", "excerpt": "+1 for Pi-Hole FTP Server Webserver SyncTrayZor (between different devices) Wireguard VPN", "context": "", "use_case": "VPN", "switched_from": "", "story": "Ask HN: What self-hosted apps do you use daily?"}, {"id": 793186640, "item_id": 49574165, "url": "https://news.ycombinator.com/item?id=49574165", "by": "papyrus9244", "date": "2026-09-05", "stance": "neutral", "quote": "my own DNS server at home + wg to access it when I'm away", "excerpt": "This obviously isn't for everyone, but the solution I use is: my own DNS server at home + wg to access it when I'm away.", "context": "", "use_case": "remote access to home DNS", "switched_from": "", "story": "Shutting down our public encrypted DNS"}, {"id": 792154928, "item_id": 49509683, "url": "https://news.ycombinator.com/item?id=49509683", "by": "mcsniff", "date": "2026-08-31", "stance": "recommend", "quote": "use something like WireGuard (or Tailscale) and bind only to that interface.", "excerpt": "Do you really need SSH exposed? If not, use something like WireGuard (or Tailscale) and bind only to that interface. You can also change the default port, your logs will quiet down dramatically. Lastly, if you have a long enough passphrase with enough entropy/randomness, password authentication being enabled is probably fine, you can also set only a specific user allowed to SSH for additional hardening.", "context": "", "use_case": "securing SSH access", "switched_from": "", "story": "Ask HN: Alternatives to Fail2ban?"}, {"id": 791936723, "item_id": 49496045, "url": "https://news.ycombinator.com/item?id=49496045", "by": "nunez", "date": "2026-08-30", "stance": "recommend", "quote": "since it's just WG, it works perfectly with my GL.iNet travel hotspots", "excerpt": "I have a Firewalla. They run a WireGuard proxy (sort of like a DERP in Tailscale), so I use that. It actually works more often than Tailscale somehow, and since it's just WG, it works perfectly with my GL.iNet travel hotspots. Firewalla also has ad blocking baked in with less restrictive blacklists, so that's what I use. Before I got the FW, I used Tailscale and AdGuard Home.", "context": "", "use_case": "VPN", "switched_from": "", "story": "\u201cIt works better in the app\u201d"}, {"id": 791291538, "item_id": 49455721, "url": "https://news.ycombinator.com/item?id=49455721", "by": "matheusmoreira", "date": "2026-08-26", "stance": "neutral", "quote": "Set up wireguard in my router and now I've got remote access into my LAN.", "excerpt": "Android phone with termux and all the usual Linux tools. I use vim to write code, and I type with the touch screen. Not exactly peak ergonomics, but it works. For me, ability to code while lying down comfortably beats having a physical keyboard and bigger screen. Set up wireguard in my router and now I've got remote access into my LAN. My laptop has essentially become a Linux server. I just ssh in from the phone and ", "context": "", "use_case": "remote LAN access", "switched_from": "", "story": "New Mac Studio with M5 Max and M5 Ultra"}, {"id": 788533088, "item_id": 49283318, "url": "https://news.ycombinator.com/item?id=49283318", "by": "gmac", "date": "2026-08-13", "stance": "recommend", "quote": "I have now mostly switched to Wireguard for this, which is much more sane", "excerpt": "Yes \u2014 configuring strongSwan as a bog-standard VPN server was so hard to fathom I made GitHub repo for it [1]. To be fair, some of the complexity comes from OS support that seems specifically designed to make secure setups difficult, presumably at the behest of various Three Letter Agencies. I have now mostly switched to Wireguard for this, which is much more sane [2]. [1] https://github.com/jawj/IKEv2-setup [2] http", "context": "", "use_case": "VPN server", "switched_from": "strongSwan", "story": "Tailscale Traces Database Corruption to 16y/o SQLite WAL-Reset Bug"}, {"id": 786069392, "item_id": 49129337, "url": "https://news.ycombinator.com/item?id=49129337", "by": "icedchai", "date": "2026-07-31", "stance": "recommend", "quote": "I use Wireguard for several site-to-site VPNs. It just works.", "excerpt": "I use Wireguard for several site-to-site VPNs. It just works. I never have to worry about it, and there are very few configuration settings to mess up (unlike, say, IPsec, which is a nightmare.)", "context": "", "use_case": "site-to-site VPNs", "switched_from": "", "story": "Tailscale didn't stop the Hugging Face intrusion"}, {"id": 786052977, "item_id": 49128311, "url": "https://news.ycombinator.com/item?id=49128311", "by": "k8sToGo", "date": "2026-07-31", "stance": "compare", "quote": "How would it be different with plain wireguard?", "excerpt": "> I use it but feel uncomfortable, that it has large attack surface and LLMs will find exploits in it Doesn't this apply to any application you use? How would it be different with plain wireguard?", "context": "", "use_case": "VPN", "switched_from": "", "story": "Tailscale didn't stop the Hugging Face intrusion"}, {"id": 785041732, "item_id": 49065108, "url": "https://news.ycombinator.com/item?id=49065108", "by": "fastandfearless", "date": "2026-07-26", "stance": "neutral", "quote": "treat things like WireGuard or ZeroTier as virtual uplinks", "excerpt": "Nice work! I ran into that exact same MikroTik limitation when trying to set up segment-based DNS resolvers and forwarders for per-region routing. After a lot of procrastination, I ended up taking a different path to solve it: https://github.com/mabels/unified-dns-dhcp-chart It runs Technitium per segment inside Kubernetes via Multus CNI (though K8s isn't strictly required and could be stripped out). I'm currently pl", "context": "", "use_case": "virtual uplinks", "switched_from": "", "story": "Authoritative Dnsmasq in a MikroTik Container"}, {"id": 784267984, "item_id": 49016749, "url": "https://news.ycombinator.com/item?id=49016749", "by": "matheusmoreira", "date": "2026-07-22", "stance": "recommend", "quote": "Setting up wireguard into my LAN permanently changed the way I used computers.", "excerpt": "Yeah. Buying my own domain and migrating my email to it is one of the best things I've ever done. Setting up wireguard into my LAN permanently changed the way I used computers. Looks like it's time to get myself a VPS and just start hosting even more stuff. Sovereign personal infrastructure is amazing. Highly recommended. Dealing with the government's rules and their politics is obnoxious enough. I'm starting to real", "context": "", "use_case": "remote access to home LAN", "switched_from": "", "story": "Codeberg Bans Cryptocurrency Projects"}, {"id": 784123968, "item_id": 49007748, "url": "https://news.ycombinator.com/item?id=49007748", "by": "bflesch", "date": "2026-07-22", "stance": "recommend", "quote": "While I love wireguard", "excerpt": "My tinfoil hat take is that there's significant interest to keep everything digital, always-online and connected to the major providers, so it can easily be snooped by five eyes using their omnipresent backdoors. Passkey biometrics also allow you to confirm certain person is holding the device right in this very moment, and not receiving a TOTP via walkie-talkie. Especially important for kinetic sanctions. If you che", "context": "", "use_case": "", "switched_from": "", "story": "Passkeys were invented by engineers with zero understanding of consumer brain"}, {"id": 783495281, "item_id": 48968455, "url": "https://news.ycombinator.com/item?id=48968455", "by": "madduci", "date": "2026-07-19", "stance": "recommend", "quote": "Friends get Wireguard QR codes, periodically we rotate them.", "excerpt": "I run the itzg Docker Image behind a Wireguard VPN, all hosted on an embedded board (a armbian powered Radxa 12L with 16 GB Ram). So far so good, we have an offline server, so even if the Microsoft Server is down, we can play (we use PolyMC on PC with offline accounts as well, for the same reason). By default, new users are in \"spectator\" mode, so they can't do anything without an activation from admin. Friends get W", "context": "", "use_case": "VPN access to Minecraft server", "switched_from": "", "story": "Minecraft: Java Edition now uses SDL3"}, {"id": 783418544, "item_id": 48963659, "url": "https://news.ycombinator.com/item?id=48963659", "by": "doawoo", "date": "2026-07-18", "stance": "recommend", "quote": "I use a Wireguard VPN to tunnel traffic to a tiny public facing Caddy server", "excerpt": "Yup, I have a similar setup where I use a Wireguard VPN to tunnel traffic to a tiny public facing Caddy server, which proxies the traffic to the server under my own roof. No Cloudflare!", "context": "self-hosts a server at home", "use_case": "tunnel to self-hosted server", "switched_from": "", "story": "Hardcore IndieWeb: Run your own website 100% independently for only $0.01/day"}, {"id": 782700993, "item_id": 48918812, "url": "https://news.ycombinator.com/item?id=48918812", "by": "traceroute66", "date": "2026-07-15", "stance": "neutral", "quote": "too many random issues with NAT with our standard DIY Wireguard setup", "excerpt": "At $work we use Tailscale mostly because we were running into too many random issues with NAT with our standard DIY Wireguard setup, especially when people were working from hotels and other places with half-ass network setups. But we don't trust Tailscale. Just look at the thousands of unresolved Github issues, many of which are actually quite important/useful but have been ignored for months and years. We very much", "context": "", "use_case": "VPN", "switched_from": "", "story": "TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access"}, {"id": 781576194, "item_id": 48848512, "url": "https://news.ycombinator.com/item?id=48848512", "by": "raffraffraff", "date": "2026-07-09", "stance": "neutral", "quote": "you'd need to be on the wireguard vpn to hit them", "excerpt": "Hmm. I don't really care enough about leaking home network host names because they are all super generic names like 'router', 'laptop', 'tv', 'nas'. So I use my public zone on cloudflare. I just use internal ip addresses (eg: nas.example.com = 10.1.2.3) on the public zone and DNS01 challenge for let's encrypt. Anyone can resolve the ip for any of my hosts, but obviously you'd need to be on the wireguard vpn to hit th", "context": "home network user", "use_case": "access to home network", "switched_from": "", "story": "TLS certificates for internal services done right"}, {"id": 780710241, "item_id": 48794390, "url": "https://news.ycombinator.com/item?id=48794390", "by": "icedchai", "date": "2026-07-05", "stance": "neutral", "quote": "I route both IPv6 and v4 back to my home network over wireguard", "excerpt": "I've been running my own ASN for a while. I route both IPv6 and v4 back to my home network over wireguard. I use Vultr for one of my providers. They have no additional charge for BYOIP and you can use their private ASN if you don't have your own: https://docs.vultr.com/support/products/network/can-i-use-my-own-ip-space-for-vultr-instances If I used AWS the bandwidth charges would probably be a bit high.", "context": "runs own ASN", "use_case": "routing traffic to home network", "switched_from": "", "story": "My ASN Journey series (2024)"}, {"id": 780431760, "item_id": 48776985, "url": "https://news.ycombinator.com/item?id=48776985", "by": "wookmaster", "date": "2026-07-03", "stance": "neutral", "quote": "I use wireguard to access it.", "excerpt": "I have no idea, I use wireguard to access it. I have disk encryption setup. They'd need to hack my linux server SSH which I have protection turned on to shut it down after failed attempts. It would be a challenge to get access to my photos on disk. They could steal my phone and access through the app if they could get them all before I disabled access since Im using encrypted icloud account. In the end who would want", "context": "self-hosts a home server", "use_case": "remote access to home server", "switched_from": "", "story": "Immich v3.0.0 Released"}, {"id": 779771648, "item_id": 48735728, "url": "https://news.ycombinator.com/item?id=48735728", "by": "khurs", "date": "2026-06-30", "stance": "recommend", "quote": "There are lots of guide online of getting a cheap VPS and installing Wireguard on it.", "excerpt": "What's the best alternative for the more privacy/safety paranoid? Run your own? There are lots of guide online of getting a cheap VPS and installing Wireguard on it.", "context": "", "use_case": "self-hosted VPN", "switched_from": "", "story": "Ask HN: Mullvad Alternatives?"}, {"id": 779377777, "item_id": 48711111, "url": "https://news.ycombinator.com/item?id=48711111", "by": "Bender", "date": "2026-06-28", "stance": "neutral", "quote": "some here use Wireguard", "excerpt": "I use my own VPN mesh running Tinc [1] and some here use Wireguard. I've used corporate VPN's for work in the past. Never tried one of the commercial anonymizing VPN's. Article mentions proxies. Over my Tinc VPN I like to use a Squid SSL Bump MitM proxy so I can create ACL's and cache content in RAM on the proxy for friends to share. Some day I should make an article for setting up Tinc and Squid. And yeah, VPN's can", "context": "", "use_case": "VPN", "switched_from": "", "story": "Don't Use VPN Servces"}, {"id": 778740672, "item_id": 48671292, "url": "https://news.ycombinator.com/item?id=48671292", "by": "pSYoniK", "date": "2026-06-25", "stance": "recommend", "quote": "setting up a VPS to act as an exit node for Wireguard, my article covers most things", "excerpt": "I have submitted this before, but for those maybe a bit uncomfortable with setting up a VPS to act as an exit node for Wireguard, my article covers most things: https://psyonik.tech/posts/a-guide-for-wireguard-vpn-setup-with-pi-hole-adblock-and-unbound-dns/ For this particular use case, I would probably suggest something like OVH/Scaleway as they have nodes in France so physical distance between UK and \"somewhere els", "context": "", "use_case": "VPN exit node", "switched_from": "", "story": "Pondering routing more of my traffic via nodes outside the UK"}, {"id": 777553265, "item_id": 48597079, "url": "https://news.ycombinator.com/item?id=48597079", "by": "Fnoord", "date": "2026-06-19", "stance": "neutral", "quote": "I also use Wireguard to have it available from outside", "excerpt": "You already got a good reply, but I can maybe add n+1 and some details: It works similar, but requires some effort to get working (if you already self-host its peanuts think Frigate plus reverse proxy and I also use Wireguard to have it available from outside). My home connection is fiber 1 gbit, but with DSL (only 30 mbit upload) it worked fine, too. Since I want to decrease my reliance on US cloud, I like to self-h", "context": "self-hosts, wants less reliance on US cloud", "use_case": "remote access to home server", "switched_from": "", "story": "Ubiquiti: Enterprise NAS, Built on ZFS"}, {"id": 765079217, "item_id": 47817451, "url": "https://news.ycombinator.com/item?id=47817451", "by": "nightski", "date": "2026-04-18", "stance": "neutral", "quote": "can access them anywhere via a WireGuard VPN", "excerpt": "I have a smattering of books on Kindle, mostly fiction/novels. But the vast majority of my book conllection consists of non-fiction/textbooks and I recently switched to Booklore on my NAS. I have over 900 textbooks and can access them anywhere via a WireGuard VPN. It's so slick! Booklore seems great, but I'll admit there may be even better options. However this is the future of books for me. I'd like to start replaci", "context": "", "use_case": "remote access to NAS", "switched_from": "", "story": "Amazon is discontinuing Kindle for PC on June 30th"}, {"id": 763533090, "item_id": 47720818, "url": "https://news.ycombinator.com/item?id=47720818", "by": "InfraScaler", "date": "2026-04-10", "stance": "neutral", "quote": "(WireGuard may already do it, dunno)", "excerpt": "You are rebuilding tailscale but requiring a centralised hub. I did the same in 2016 (pre-tailscale?) https://web.archive.org/web/20160304013451/https://wormhole.network/ I am not sure WireGuard existed at the time, and I used SoftEther and based it all on doing outbound tunnels to TCP/443* to avoid firewall blocks in corporate networks. You could explore full P2P by leveraging UDP hole punching: https://cloudnetwork", "context": "", "use_case": "UDP hole punching", "switched_from": "", "story": "Ask HN: What are you building that's not AI related?"}, {"id": 761514161, "item_id": 47594635, "url": "https://news.ycombinator.com/item?id=47594635", "by": "imiric", "date": "2026-03-31", "stance": "neutral", "quote": "you can also manage this configuration yourself", "excerpt": "Tailscale is not different. It simply makes managing WG configuration easier, and adds some useful value-added features on top. But, as you know, you can also manage this configuration yourself, either via traditional config mgmt tools, helpers like wg-meshconf, or even plain shell scripts, if you like. I'm aware this is a very HN-Dropboxy comment, but it's really not that complex[1], and is easily manageable for a s", "context": "", "use_case": "VPN", "switched_from": "tinc", "story": "I traced my traffic through a home Tailscale exit node"}]}