Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vxlan over WireGuard (On OpenBSD)

rob-turner.net

Post reply on HN
Print view View original

11–20 of 73 posts

Re: Vxlan over WireGuard (On OpenBSD)

#11

Post by chungy »

candiddevmike wrote: post #9
vxxzy wrote: post #8

Earlier quoted context omitted.

You may consider VoIP phones. When a phone boots up on a network segment the DHCP process comes into play. This process is a Layer 2 process. The DHCP packet could contain a boot server field (this is typical) so the VoIP phone can grab configuration. One may want the boot server info "isolated" from other network segments. Utilizing VLANs is one way to do this. Additionally, it is typical that QoS is applied at Laye…

I hope you're not trying to run VoIP phones via vxlan over wireguard because you don't want to setup a local DHCP server

Maybe he'll write a blog post about it :)

Re: Vxlan over WireGuard (On OpenBSD)

#12

Post by vxxzy »

candiddevmike wrote: post #9
vxxzy wrote: post #8

Earlier quoted context omitted.

You may consider VoIP phones. When a phone boots up on a network segment the DHCP process comes into play. This process is a Layer 2 process. The DHCP packet could contain a boot server field (this is typical) so the VoIP phone can grab configuration. One may want the boot server info "isolated" from other network segments. Utilizing VLANs is one way to do this. Additionally, it is typical that QoS is applied at Laye…

I hope you're not trying to run VoIP phones via vxlan over wireguard because you don't want to setup a local DHCP server

Over VXLAN yeah... You won't believe how many small-medium companies are moving from on-prem to small managed private clouds. VXLAN allows them to maintain their existing network configuration. "You hope" ha! I suppose by this you mean that the wireguard + vxlan may not be a "mature" combination for something as mission-critical as voice traffic? VXLAN implementations by mature companies (Netgate, Fortinet, etc...) those work. Maybe this wireguard+vxlan would work too.. who knows!?

Edit: I see you changed your comment to consider remote DHCP which causes my comment above to be irrelevant. Oh well. The fact still holds that VXLAN is meant to handle Layer 2 so saying BGP is an alternative is like putting a square peg in a round hole.

Re: Vxlan over WireGuard (On OpenBSD)

#13

Post by gorkish »

yokem55 wrote: post #5

The feature I would be interested in is if this can do link state toggling on the on the vxlan interface if the wg handshake timer goes stale. If that works, then it becomes practical to do things like run ospf routing over the vxlan interface.

What exactly would you be intending to accomplish? OSPF already has state timers, and furthermore runs just fine on a wireguard interface without having to introduce a vxlan tunnel.

Re: Vxlan over WireGuard (On OpenBSD)

#14

Post by [deleted] »

vxxzy wrote: post #12
candiddevmike wrote: post #9

Earlier quoted context omitted.

I hope you're not trying to run VoIP phones via vxlan over wireguard because you don't want to setup a local DHCP server

Over VXLAN yeah... You won't believe how many small-medium companies are moving from on-prem to small managed private clouds. VXLAN allows them to maintain their existing network configuration. "You hope" ha! I suppose by this you mean that the wireguard + vxlan may not be a "mature" combination for something as mission-critical as voice traffic? VXLAN implementations by mature companies (Netgate, Fortinet, etc...) t…

[deleted]

Re: Vxlan over WireGuard (On OpenBSD)

#15

Post by gorkish »

vxxzy wrote: post #12
candiddevmike wrote: post #9

Earlier quoted context omitted.

I hope you're not trying to run VoIP phones via vxlan over wireguard because you don't want to setup a local DHCP server

Over VXLAN yeah... You won't believe how many small-medium companies are moving from on-prem to small managed private clouds. VXLAN allows them to maintain their existing network configuration. "You hope" ha! I suppose by this you mean that the wireguard + vxlan may not be a "mature" combination for something as mission-critical as voice traffic? VXLAN implementations by mature companies (Netgate, Fortinet, etc...) t…

I appreciate that you are trying to give examples of "L2 things" but none of this is really good advice.

For QoS, what do you think double-encapsulating all of the QoS bits inside of two tunnels is going to do for you? If you pay your carrier to respect QoS, you have to actually give them the bits! QoS goes on the OUTSIDE of the onion.

DHCP for VLANs should be handled by snooping for it on the switch and forwarding over L3 (ip helper-address), not by running vxlan over a VPN tunnel. And really it shouldn't ever be done over a potentially unreliable WAN link either; you should have a local agent for DDI at each site.

The only story here is that L2-over-L3 VPN have their very specific niches, and VXLAN+Wireguard is an alternative to L2TP+IPSec that is (IMO) both easier to configure and more reliable when such a thing is needed.

Re: Vxlan over WireGuard (On OpenBSD)

#16

Post by zymhan »

candiddevmike wrote: post #7
vxxzy wrote: post #6

Earlier quoted context omitted.

Does this get you Layer 2 connectivity?

No, because most applications don't need layer 2 adjacency.

Then it's not actually an equivalent solution.

L2 connectivity is still quite useful, even if you don't have a need for it.

Re: Vxlan over WireGuard (On OpenBSD)

#17

Post by SoftTalker »

gorkish wrote: post #15
vxxzy wrote: post #12

Earlier quoted context omitted.

Over VXLAN yeah... You won't believe how many small-medium companies are moving from on-prem to small managed private clouds. VXLAN allows them to maintain their existing network configuration. "You hope" ha! I suppose by this you mean that the wireguard + vxlan may not be a "mature" combination for something as mission-critical as voice traffic? VXLAN implementations by mature companies (Netgate, Fortinet, etc...) t…

I appreciate that you are trying to give examples of "L2 things" but none of this is really good advice. For QoS, what do you think double-encapsulating all of the QoS bits inside of two tunnels is going to do for you? If you pay your carrier to respect QoS, you have to actually give them the bits! QoS goes on the OUTSIDE of the onion. DHCP for VLANs should be handled by snooping for it on the switch and forwarding o…

> VXLAN+Wireguard is an alternative to L2TP+IPSec that is (IMO) both easier to configure and more reliable

I'm sorry to ask but which alternative do you find easier and more reliable? I seem to be able to parse that either way, maybe it's just me.

Re: Vxlan over WireGuard (On OpenBSD)

#19

Post by tristor »

There's a weird font-rendering bug on this site that causes the text in the code blocks to be unreadable unless you highlight it with your mouse. If you enable Javascript, it seems to fix it.

Not sure if the author is reading this thread, but it's something you may find worth investigating fixing.

Re: Vxlan over WireGuard (On OpenBSD)

#20

Post by Arnavion »

tristor wrote: post #19

There's a weird font-rendering bug on this site that causes the text in the code blocks to be unreadable unless you highlight it with your mouse. If you enable Javascript, it seems to fix it. Not sure if the author is reading this thread, but it's something you may find worth investigating fixing.

Works for me with JS disabled, unless the author fixed it in the two minutes since you posted your comment. Code blocks have:

    style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"
... in the HTML itself.
Post reply on HN