Degree Project at Bachelor Level Evaluation of WireGuard and OpenVPN VPN solutions Author: Ahmad Anbarje Author: Mohammed Sabbagh Supervisor: Diego Perez Palacin Abstract This project evaluates two types of VPN solutions–WireGuard and OpenVPN. The evaluation is done by four different experiments to measure the maximum through- put of each of the VPN solutions, and a theoretical study on the encryption techniques that each VPN solution use. Experiments were conducted using a network perfor- mance measurement tool called IPerf. By applying static parameters that control the measurements, such as transferring regular and zip file types, measuring throughput when the compression is enabled on the VPN channel and when it is disabled, also, applying measurements with the conditions of the same parameters but with different operating systems when using both VPN solutions. one of the measurement results shows that the throughput is about 93 Mbps for WireGuard comparing it with 56 Mbps and 59Mbps for OpenVPN when sending regular and compressed files respectively. In conclusion, throughput can vary slightly depending on the measurement tool and the version of the software used. Also, the buffer of the measurement tool has an important role when measuring the throughput, it gives different throughput and packet loss results which depends on the size of that buffer. Moreover, According to a theoretical study, throughput can also vary depending on the speed of the encryption algorithm used. Both VPN solutions use many encryption algorithms, such as AES in OpenVPN, while WireGuard uses ChaCha20 with Poly1305. i Preface We would like to thank our supervisor Diego Perez Palacin and our reader Ola Flygt who guided us step by step to finish this thesis project. Without thier support and valuable knowledge in this field, we would not be able to complete this study. ii Contents 1 Introduction 1 1.1 Definition of a VPN . .1 1.1.1 Types of VPN connection . .2 1.1.2 Results from Using a VPN . .3 1.2 Problem . .4 1.3 Objective . .4 1.4 Motivation . .4 1.5 Limitations . .4 1.6 Outline . .5 2 Background 6 2.1 VPN Protocols . .6 2.1.1 OpenVPN . .6 2.1.2 WireGuard . .6 2.2 Network measurement tool IPerf . .6 2.3 Encryption . .6 3 Configuration 8 3.1 Setting Up an OpenVPN Server on Ubuntu 19.10 . .8 3.1.1 Before setting up . .8 3.1.2 Installing OpenVPN Server and EasyRSA . .8 3.2 Set Up WireGuard Server on Ubuntu 19.10 . .8 3.2.1 Installing WireGuard . .9 3.2.2 Generating Keys . .9 4 Methods 10 4.1 The project plan . 10 4.2 Ethical considerations . 10 4.3 The validity of the experiment . 11 4.4 Research method and literature study . 11 4.5 Throughput when transferring generated IPerf packets . 11 4.6 Enable the compression on the OpenVPN tunnel . 12 4.7 Handling the result of the measurement . 12 4.8 The environment of the experiment . 13 5 Results of the measurements 15 5.1 Result of throughput between Windows and Linux operating systems . 15 5.2 Result of throughput between two Linux operating systems . 16 5.3 Result of throughput when enabling the compression on the tunnels . 17 5.4 Result of packet loss when changing the buffer size . 18 6 Analysis and discssion 19 6.1 Throughput between Windows and Linux operating systems . 19 6.2 Throughput when enabling the compression on OpenVPN tunnel . 19 6.3 Throughput between two Linux operating systems . 19 6.4 The lost packets . 20 7 Conclusion 21 7.1 Reflection . 21 7.2 Recommendation . 21 Appendices 25 A OpenVPN configuration 25 A.1 Setting up the CA, EasyRSA variables, and Encryption configuration . 25 A.2 Creating a certificate for the server, generate an HMAC signature . 25 A.3 Creating a certificate for the client . 26 A.4 Adding configuration to the OpenVPN server . 26 A.5 Adding configurations to the client, running OpenVPN service . 27 A.6 Send the certificate to the client: . 28 B WireGuard configuration 28 B.1 Create WireGuard configuration file . 28 B.2 Adding Peer to the configuration file . 29 B.3 Run the WireGuard VPN service . 29 B.4 Install WireGuard VPN software on the client machine . 29 1 Introduction With the advancement of technology and a significant increase in working remotely, many organizations and commercial companies need to transfer data between locations. Still, they prefer not to share their information over the Internet. The exchange of information via the Internet can be a risk because sensitive information can be exposed. That is where the benefit of a VPN comes in. VPN is an abbreviation for “Virtual Private Network.” VPN secures communication, so professionals can work at any time and any place without having to be in the office. WireGuard and OpenVPN are software that implement (VPN) technologies to create a secure connection when exchanging data or while surfing the Internet. WireGuard is a very recent application, while OpenVPN is a traditional one. WireGuard has been designed to overcome some of the OpenVPN weaknesses, such as its complexity. OpenVPN has a massive code of 400,000-600,000 lines, which makes it hard to find errors, while WireGuard has only 4000 lines [7, 8]. This project analyzes and compares these two VPN technologies in terms of their performance. 1.1 Definition of a VPN Before investigating VPN technology, network concepts will be presented. Each network adapter in the computer has a physical address (its value stored on a chip inside it), known as a MAC address, used to identify the equipment on the local network. It has another logical IP address, used to determine the network where the computer located. The user needs an IP address to connect to any computer. In the case of a local network, there is a device called Switch that will handle the connection between multiple devices. The Switch has multiple ports, and each port is connected to a device on its network adapter using a network cable. The Switch, in this case, will handle the request because it knows the MAC address of this IP; otherwise, it will send it to the router to direct the packets to the correct path to reach the other network that this address refers. Some IP addresses are public addresses that any computer connected to the Internet can access, while others are private addresses that can be contacted through the same physical network [1]. VPN is a fictitious network that the user creates to send and receive data between his device and the Internet or another device that guarantees its safe and encrypted passage and is not viewed by anyone else. For example, if someone enters a website on the network and downloads specific files or even verifies an email, the VPN encrypts the connections and sends them to a server that is powered by the VPN provider itself, which in turn, sends it to the destination server [6]. 1 1.1.1 Types of VPN connection • Site to site: This is about connecting two networks in two locations, which are a two-way or (multi-to-multi) connections. It allows any device from the first branch to communicate with the other, and vice versa. It is set up at the level of network devices to achieve flexibility as it allows any number of devices in the network to communicate directly with the other network without additional steps on the systems Personal. The example in figure 1.1 demonstrates that. Figure 1.1: Site-to-Site VPN • Remote access: It connects individual clients to VPN networks. This should be set up on each standalone clients’ device. Furthermore, this one is the most appropriate to the conditions of continuous mobility, so there is no need to set up a site con- nection for network devices everywhere to use this type of VPN. An example of a remote access VPN shown in Figure 1.2 below. Figure 1.2: Remote Access VPN 2 1.1.2 Results from Using a VPN VPN uses are related to several things; most notably the nature of the activity on the Internet, people’s work, and employees’ place of residence. Some people are interested in the protection of their privacy. However, in some countries, it is to access blocked sites and applications. In general, however, VPN uses can be summarized as follows: • Secure privacy: VPN technology allows us to connect computers to different net- works securely. VPN Clients use the public IP address of the VPN server to browse the Internet. Therefore, VPN services are used to disguise users on the Internet (even though its primary goal was to connect VPN clients’ computers to the private network to access its resources securely). Moreover, this will protect VPN Clients’ privacy. However, despite changing the Internet address, the VPN server will still be aware of the real IP address. In the event of legal violations committed on the Internet, the courts will require the VPN service provider to disclose its records. No service provider does not keep this data. This act may expose him to interrogation. Figure 1.3 presents how the VPN Client access the Internet throws a VPN server. Figure 1.3: Presents how the VPN connection is encrypted and secures communication. • Secure Data:The use of encryption in VPN communication leads to the mainte- nance of the privacy of the network. It is also applied in public networks, when using services over the non encrypted protocol, such as HTTP, FTP, and telnet in- stead of https, SFTP, and SSH. However, the data remains encrypted until it reaches the VPN server on the remote private network [2].