JIT WireGuard (fly.io)

Article summary

Fly.io improved their WireGuard implementation by introducing a just-in-time (JIT) system, which installs WireGuard peers on demand, reducing the number of stale peers and improving performance. The new system uses a BPF filter to catch incoming connection attempts and a daemon to install peers in the kernel. This approach allows for faster connection establishment and reduces the load on gateways. The company has been running this system in production for a few weeks and reports positive results.

Main themes

• WireGuard optimization
• JIT peer installation
• Network performance
• VPN solutions
• Linux kernel integration

What commenters say

• WireGuard's opinionated network interface is a limitation, and a more generic filter-based approach would be preferable.
• The lack of support for dynamic route pushing and DNS configuration in WireGuard is a significant drawback.
• Using a routing protocol like BGP can solve some of the issues with WireGuard, but it may not be practical for all use cases.
• WireGuard's simplicity and low lines of code are a deliberate design choice, and adding more features would compromise its security and auditability.
• Other VPN solutions, such as OpenVPN, offer more features and flexibility than WireGuard, but may have their own drawbacks.
• The WireGuard tooling and configuration files can be improved, and users can build their own custom solutions using the netlink interface or cross-platform API.
• The JIT peer installation approach used by Fly.io can be an effective solution for improving WireGuard performance, but may require significant development and testing effort.