Support AmneziaWG

[Lucid1010]

https://docs.amnezia.org/documentation/amnezia-wg/


This is even better than regular Wireguard. I'm really looking forward to its support!

[Monviech (Cedrik)]

Well, it was added and then quickly removed from freebsd:

https://www.freshports.org/net/amneziawg-tools/

https://reviews.freebsd.org/D51265

Not a good start.

[Arien]

Well, they removed it just to rename the whole thing without "wg" in the name.
Port is available:

https://www.freshports.org/net/amnezia-tools/
https://www.freshports.org/net/amnezia-kmod/

Can it be supported in OPNsense?

[Monviech (Cedrik)]

What should be the scope of "supported in OPNsense"?

As soon as a port exists, you are free to pull the port (e.g. from github) and build the binary via "make build".

Do you mean like offering a prebuilt binary via the package manager? Or even a plugin?

The last two things need somebody who makes an effort.

[haemm0r]

What about: https://github.com/antspopov/opnsense_amnezia_plugin (I am not afflifiated with this repo) ? Does it look complete?

[Monviech (Cedrik)]

Whats the benefit of such a wireguard implementation, wouldnt it be better to use something protocol agnostic that can tunnel any protocol through a websocket like:

https://github.com/erebe/wstunnel

https://github.com/erebe/wstunnel?tab=readme-ov-file#wireguard-and-wstunnel-

[RamSense]

Did you manage to get AmneziaWG plug-in installed and working? Curious to know of it is working well.

[xkpx]

What about: https://github.com/antspopov/opnsense_amnezia_plugin (I am not afflifiated with this repo) ? Does it look complete?

Let's hope they implement it.
Wstunnel is fine but no UI is made for it.

[Monviech (Cedrik)]

We need PRs for this we will not implement this ourselves.

[ftani]

This possibility is very exciting indeed. A WireGuard VPN protocol with features to protect it against DPI is something I can see myself having running around the clock on my Firewall.

[Patrick M. Hausen]

And why don't you just use Wireguard, if you control the firewall?

As far as I understand AmneziaWG is intentionally circumventing/bypassing corporate firewall and compliance policies. As such I would strongly recommend against including it in OPNsense.

If you control OPNsense just run WG.

[OPNenthu]

And why don't you just use Wireguard, if you control the firewall?

Because upstream firewalls?

Think: Empire v. Alliance. :)

https://mullvad.net/en/blog/introducing-quic-obfuscation-for-wireguard

(unless I completely misread the purpose of this tool...)

Side note: really unfortunate choice for a project logo, IMO.

[Patrick M. Hausen]

What upstream firewalls? If they exist there is a reason. If you live in an authoritarian country you should probably use tor. Amnezia will probably allow you to connect but it's not making you anonymous.

I will never promote circumventing a company or school or uni ... firewall.