Re: WG interface to ipv4

[ѽ҉ᶬḳ℠ <vtol@gmx.net>]

[-- Attachment #1: Type: text/plain, Size: 988 bytes --]


> Please tell us how adding such an option could possibly enhance security, given that you can get the same effect with a simple iptables rule.
Security enhanced by /tailoring mitigating surfaces, which is not for 
netfilter rules, different concepts. netfilter rules, particular 
iptables, can get easily convoluted in complex scenarios.
If it were for everything network security related to be resolved by 
netfilter rules than certainly the likes of ssh, dnsmasq, ntp, bind, 
unbound etc would not need to implement features like socket contains 
and binding to iface/subnet. Or do reckon such as obsolete nonsense?

Look, except for Kalin's response 
(https://lists.zx2c4.com/pipermail/wireguard/2018-May/002759.html) the 
reluctance to consider this is rather apparent. Which is fine as 
statement and of course anyone is at liberty to deploy WG. I think I 
made my point and if it is considered invalid than it is fair enough and 
no need to be argued further.



[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4174 bytes --]