Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vxlan over WireGuard (On OpenBSD)

rob-turner.net

Post reply on HN
Print view View original

31–40 of 73 posts

Re: Vxlan over WireGuard (On OpenBSD)

#31

Post by crest »

lstodd wrote: post #29
crest wrote: post #25

IP over Ethernet over VXLAN over UDP over IP over WireGuard over UDP over IP over Ethernet… sigh OpenBSD does support both routing domains and multiple routing tables and includes multiple routing daemons in the base system. I would recommend to the author to stop hacking at the keyboard, grab whatever not to structured visualisation tool works for them (e.g. a whiteboard, a block of paper, a random drawing app, Visi…

Because stuff that requires this circus of encapsulation is usually so brain-dead that it can't be gotten to work in any other less horrible way. (also I think you lost one 'over UDP')

You're right. I forgot that WireGuard sits on top of UDP.

Re: Vxlan over WireGuard (On OpenBSD)

#33

Post by wyager »

crest wrote: post #25

IP over Ethernet over VXLAN over UDP over IP over WireGuard over UDP over IP over Ethernet… sigh OpenBSD does support both routing domains and multiple routing tables and includes multiple routing daemons in the base system. I would recommend to the author to stop hacking at the keyboard, grab whatever not to structured visualisation tool works for them (e.g. a whiteboard, a block of paper, a random drawing app, Visi…

There are a ton of protocols that don't work using cross-subnet IP routing, e.g. anything that uses multicast.

Re: Vxlan over WireGuard (On OpenBSD)

#34

Post by systems_glitch »

crest wrote: post #25

IP over Ethernet over VXLAN over UDP over IP over WireGuard over UDP over IP over Ethernet… sigh OpenBSD does support both routing domains and multiple routing tables and includes multiple routing daemons in the base system. I would recommend to the author to stop hacking at the keyboard, grab whatever not to structured visualisation tool works for them (e.g. a whiteboard, a block of paper, a random drawing app, Visi…

I end up having to run basically this very setup (on OpenBSD, too) because I have a customer who has a Novell NetWare 5 setup and runs IPX only. Bad times.

Re: Vxlan over WireGuard (On OpenBSD)

#36

Post by lormayna »

vxxzy wrote: post #8
candiddevmike wrote: post #7

Earlier quoted context omitted.

No, because most applications don't need layer 2 adjacency.

You may consider VoIP phones. When a phone boots up on a network segment the DHCP process comes into play. This process is a Layer 2 process. The DHCP packet could contain a boot server field (this is typical) so the VoIP phone can grab configuration. One may want the boot server info "isolated" from other network segments. Utilizing VLANs is one way to do this. Additionally, it is typical that QoS is applied at Laye…

As someone that has fight for years with L2 in the WAN, I will not advice that at all. Just installa a DHCP server and transport the traffic over L3. You have lot more control both on routing both on QoS

Re: Vxlan over WireGuard (On OpenBSD)

#38

Post by skullone »

noobface wrote: post #37

This is fun, but applications requiring L2 adjacency do it to limit latency/distance. Creating a L2 domain between here and the moon, what are you gonna use it for? Certainly not anything other than fun.

There's a number of specific scenarios this could be useful, like, some SANs can only replicate to L2 adjacent units. Say you wanted a replica off-site, and your gear is older/proprietary, you used to have to buy enterprise network gear to encap L2 and ship VLANs to remote sites. I wouldn't be dismissive of using VXLAN over wireguard to accomplish that.

Re: Vxlan over WireGuard (On OpenBSD)

#39

Post by [deleted] »

justsomehnguy wrote: post #22
SoftTalker wrote: post #17

Earlier quoted context omitted.

> VXLAN+Wireguard is an alternative to L2TP+IPSec that is (IMO) both easier to configure and more reliable I'm sorry to ask but which alternative do you find easier and more reliable? I seem to be able to parse that either way, maybe it's just me.

>maybe it's just me. Nope, here with the same problem and I don't treat L2TP/IPSec as an easier to configure and reliable.

[deleted]
Post reply on HN