Live data from Hacker News

Vxlan over WireGuard (On OpenBSD)

rob-turner.net

21–30 of 73 posts

Re: Vxlan over WireGuard (On OpenBSD)

#21

Just do static routes or BGP over Wireguard. Simpler, scalable, less error prone.

But doesn't provide layer 2 between networks. Think of devices that are hardcoded to communicate with broadcast or multicast with TTL of 1, you either need some active reflector, and cope with any perculiarities of the device, or you simply extend a single vlan between two routers (using vxlan or another solution)

I sometimes need to extend a system like this from one site to another. One is a calrec system (an audio mixer, I think it's the control traffic that needs to be sent), and I don't have enough access or time to see if I could build some kind of transparent proxy -- it won't work with multicast routing.

I do however have enough time to create a layer2 network between two nics. I tend to use mikrotiks for that, create an eoip tunnel (GRE with proprietary addons to cope with fragmentation) between the two endpoints and pop the interface in a bridge with a physical port, and move on.

Re: Vxlan over WireGuard (On OpenBSD)

#22
post #15

Earlier quoted context omitted.

I appreciate that you are trying to give examples of "L2 things" but none of this is really good advice. For QoS, what do you think double-encapsulating all of the QoS bits inside of two tunnels is going to do for you? If you pay your carrier to respect QoS, you have to actually give them the bits! QoS goes on the OUTSIDE of the onion. DHCP for VLANs should be handled by snooping for it on the switch and forwarding o…

> VXLAN+Wireguard is an alternative to L2TP+IPSec that is (IMO) both easier to configure and more reliable I'm sorry to ask but which alternative do you find easier and more reliable? I seem to be able to parse that either way, maybe it's just me.

>maybe it's just me.

Nope, here with the same problem and I don't treat L2TP/IPSec as an easier to configure and reliable.

Re: Vxlan over WireGuard (On OpenBSD)

#23
post #8

Earlier quoted context omitted.

You may consider VoIP phones. When a phone boots up on a network segment the DHCP process comes into play. This process is a Layer 2 process. The DHCP packet could contain a boot server field (this is typical) so the VoIP phone can grab configuration. One may want the boot server info "isolated" from other network segments. Utilizing VLANs is one way to do this. Additionally, it is typical that QoS is applied at Laye…

I hope you're not trying to run VoIP phones via vxlan over wireguard because you don't want to setup a local DHCP server

Or dhcp relay to a central dhcp server

Re: Vxlan over WireGuard (On OpenBSD)

#24
post #19

There's a weird font-rendering bug on this site that causes the text in the code blocks to be unreadable unless you highlight it with your mouse. If you enable Javascript, it seems to fix it. Not sure if the author is reading this thread, but it's something you may find worth investigating fixing.

Works for me with JS disabled, unless the author fixed it in the two minutes since you posted your comment. Code blocks have: style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4" ... in the HTML itself.

The bug still appears present for me:

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/109.0

Code blocks without JS: https://i.imgur.com/Tcq34IK.png

Code blocks without JS under highlight: https://i.imgur.com/Lbvk2LS.png

Code blocks with JS enabled: https://i.imgur.com/kDCW4Q0.png

Re: Vxlan over WireGuard (On OpenBSD)

#25
IP over Ethernet over VXLAN over UDP over IP over WireGuard over UDP over IP over Ethernet… sigh

OpenBSD does support both routing domains and multiple routing tables and includes multiple routing daemons in the base system. I would recommend to the author to stop hacking at the keyboard, grab whatever not to structured visualisation tool works for them (e.g. a whiteboard, a block of paper, a random drawing app, Visio) and (re-)phrase the problem. Are you solving a problem or showing of how many acronyms you can expand without looking them up? This n layer encapsulation can work and can even be required to reproduce some (problematic) organisational structure, but it's far from elegant. Given the chance I would vastly prefer to just use multiple routing domains for the WireGuard tunnel interfaces and the underlay. It would result in far less complexity to manage as well as less overhead.

Why do so many people insist on tunneling Ethernet over IP? What's keeping operators from using IP routing (and just one layer of encapsulation) instead? Is IP routing so scary or everyone that indispensable applications that only work over Ethernet?

Re: Vxlan over WireGuard (On OpenBSD)

#26
post #25

IP over Ethernet over VXLAN over UDP over IP over WireGuard over UDP over IP over Ethernet… sigh OpenBSD does support both routing domains and multiple routing tables and includes multiple routing daemons in the base system. I would recommend to the author to stop hacking at the keyboard, grab whatever not to structured visualisation tool works for them (e.g. a whiteboard, a block of paper, a random drawing app, Visi…

[deleted]

Re: Vxlan over WireGuard (On OpenBSD)

#27
post #19

There's a weird font-rendering bug on this site that causes the text in the code blocks to be unreadable unless you highlight it with your mouse. If you enable Javascript, it seems to fix it. Not sure if the author is reading this thread, but it's something you may find worth investigating fixing.

[deleted]

Re: Vxlan over WireGuard (On OpenBSD)

#28
post #8

Earlier quoted context omitted.

No, because most applications don't need layer 2 adjacency.

You may consider VoIP phones. When a phone boots up on a network segment the DHCP process comes into play. This process is a Layer 2 process. The DHCP packet could contain a boot server field (this is typical) so the VoIP phone can grab configuration. One may want the boot server info "isolated" from other network segments. Utilizing VLANs is one way to do this. Additionally, it is typical that QoS is applied at Laye…

I've found that they work just fine. In my case all that was required was setting a DHCP option pointing them at their controller. The QoS to make it work well under load would've been the same for a L2 tunnel.

Re: Vxlan over WireGuard (On OpenBSD)

#29
post #25

IP over Ethernet over VXLAN over UDP over IP over WireGuard over UDP over IP over Ethernet… sigh OpenBSD does support both routing domains and multiple routing tables and includes multiple routing daemons in the base system. I would recommend to the author to stop hacking at the keyboard, grab whatever not to structured visualisation tool works for them (e.g. a whiteboard, a block of paper, a random drawing app, Visi…

Because stuff that requires this circus of encapsulation is usually so brain-dead that it can't be gotten to work in any other less horrible way.

(also I think you lost one 'over UDP')

Re: Vxlan over WireGuard (On OpenBSD)

#30
post #25

IP over Ethernet over VXLAN over UDP over IP over WireGuard over UDP over IP over Ethernet… sigh OpenBSD does support both routing domains and multiple routing tables and includes multiple routing daemons in the base system. I would recommend to the author to stop hacking at the keyboard, grab whatever not to structured visualisation tool works for them (e.g. a whiteboard, a block of paper, a random drawing app, Visi…

Using vxlan you can also connect L3 networks, not just L2 networks. i.e., virtualize an L3 network
Post reply on HN