Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vxlan over WireGuard (On OpenBSD)

rob-turner.net

Post reply on HN
Print view View original

51–60 of 73 posts

Re: Vxlan over WireGuard (On OpenBSD)

#51

Post by gorkish »

SoftTalker wrote: post #17
gorkish wrote: post #15

Earlier quoted context omitted.

I appreciate that you are trying to give examples of "L2 things" but none of this is really good advice. For QoS, what do you think double-encapsulating all of the QoS bits inside of two tunnels is going to do for you? If you pay your carrier to respect QoS, you have to actually give them the bits! QoS goes on the OUTSIDE of the onion. DHCP for VLANs should be handled by snooping for it on the switch and forwarding o…

> VXLAN+Wireguard is an alternative to L2TP+IPSec that is (IMO) both easier to configure and more reliable I'm sorry to ask but which alternative do you find easier and more reliable? I seem to be able to parse that either way, maybe it's just me.

Sorry for the dangling preposition. "That" refers to VXLAN+Wireguard being easier and more reliable. It has the drawback though of having very high overhead at 130 bytes/packet, and it can be very tricky to use over the public Internet without paying lots of special attention to tuning the MTU of all devices on the bridged segment. I'm glad to know that there are geeks who have not been exposed to the horrors of IPSec, though. And yeah, you should pretty much never do L2VPN. It is perilous in the extreme.

Re: Vxlan over WireGuard (On OpenBSD)

#52

Post by TechBro8615 »

noobface wrote: post #37

This is fun, but applications requiring L2 adjacency do it to limit latency/distance. Creating a L2 domain between here and the moon, what are you gonna use it for? Certainly not anything other than fun.

Can you use this to get Apple bonjour / mDNS working over a remote network (connected via VPN)? Or similarly, could you use it for a cloud seedbox to cast to a chromecast on your local network (via the VPN obviously)?

Re: Vxlan over WireGuard (On OpenBSD)

#53

Post by aroulin »

jacob019 wrote: post #45
aroulin wrote: post #30

Earlier quoted context omitted.

Using vxlan you can also connect L3 networks, not just L2 networks. i.e., virtualize an L3 network

Wireguard virtualizes L3 out of the box.

With Wireguard being a point-to-point protocol (as I understand), it will be challenging to get good performance for L3VPN BUM traffic?

Re: Vxlan over WireGuard (On OpenBSD)

#54

Post by systems_glitch »

gerdesj wrote: post #48
systems_glitch wrote: post #34

Earlier quoted context omitted.

I end up having to run basically this very setup (on OpenBSD, too) because I have a customer who has a Novell NetWare 5 setup and runs IPX only. Bad times.

NetWare 5 can do IP fine. I used to run a cluster of DNS/DHCP servers that were the first on site to run 5. The rest were 4.11 until we binned them for 6. Three cream coloured Compaq 3U lumps.

Right, but they weren't running IP and refused to do it. I did set up a /30 so the poor old thing could synchronize its clock via NTP, but that was the only IP it talked.

This one's running (present tense) on a 1 GHz Socket 370 Pentium 3. It's got some weirdness about Pentium 4 and newer CPUs. I think it can be patched up but the client doesn't want to pay for the work because "it's fine like it is." Not worth the headache to virtualize as the first attempt didn't work.

Re: Vxlan over WireGuard (On OpenBSD)

#55

Post by lillecarl »

skullone wrote: post #38
noobface wrote: post #37

This is fun, but applications requiring L2 adjacency do it to limit latency/distance. Creating a L2 domain between here and the moon, what are you gonna use it for? Certainly not anything other than fun.

There's a number of specific scenarios this could be useful, like, some SANs can only replicate to L2 adjacent units. Say you wanted a replica off-site, and your gear is older/proprietary, you used to have to buy enterprise network gear to encap L2 and ship VLANs to remote sites. I wouldn't be dismissive of using VXLAN over wireguard to accomplish that.

You just explained how to increase technical debt in as few steps as possible.

The solution is getting a wavelength or dark fiber to the off-site, or throwing out the piece of junk SAN that only works on L2, it's too old by now.

Re: Vxlan over WireGuard (On OpenBSD)

#56

Post by lillecarl »

supertrope wrote: post #46
crest wrote: post #25

IP over Ethernet over VXLAN over UDP over IP over WireGuard over UDP over IP over Ethernet… sigh OpenBSD does support both routing domains and multiple routing tables and includes multiple routing daemons in the base system. I would recommend to the author to stop hacking at the keyboard, grab whatever not to structured visualisation tool works for them (e.g. a whiteboard, a block of paper, a random drawing app, Visi…

vMotion needs L2 adjacency to make live migrating VMs easy. Some software rely heavily on broadcast discovery messages and are thus designed for LAN usage not Internet connectivity but businesses try to stuff a square peg into a round hold.

vMotion doesn't need L2 at all, this is a flat out lie.

Re: Vxlan over WireGuard (On OpenBSD)

#57

Post by lillecarl »

aroulin wrote: post #53
jacob019 wrote: post #45

Earlier quoted context omitted.

Wireguard virtualizes L3 out of the box.

With Wireguard being a point-to-point protocol (as I understand), it will be challenging to get good performance for L3VPN BUM traffic?

You wanna do PIM? There's no BUM on a p2p link.

Re: Vxlan over WireGuard (On OpenBSD)

#58

Post by lillecarl »

wyager wrote: post #33
crest wrote: post #25

IP over Ethernet over VXLAN over UDP over IP over WireGuard over UDP over IP over Ethernet… sigh OpenBSD does support both routing domains and multiple routing tables and includes multiple routing daemons in the base system. I would recommend to the author to stop hacking at the keyboard, grab whatever not to structured visualisation tool works for them (e.g. a whiteboard, a block of paper, a random drawing app, Visi…

There are a ton of protocols that don't work using cross-subnet IP routing, e.g. anything that uses multicast.

Multicast works across subnets with PIM

Re: Vxlan over WireGuard (On OpenBSD)

#59

Post by skullone »

lillecarl wrote: post #55
skullone wrote: post #38

Earlier quoted context omitted.

There's a number of specific scenarios this could be useful, like, some SANs can only replicate to L2 adjacent units. Say you wanted a replica off-site, and your gear is older/proprietary, you used to have to buy enterprise network gear to encap L2 and ship VLANs to remote sites. I wouldn't be dismissive of using VXLAN over wireguard to accomplish that.

You just explained how to increase technical debt in as few steps as possible. The solution is getting a wavelength or dark fiber to the off-site, or throwing out the piece of junk SAN that only works on L2, it's too old by now.

I didn't say "this solution is easier", simply said someone might find a use case for it. Ya'll are dismissive of something neat with a number of use-cases (I only tossed out just one use case that popped into my head, based on actual experience on a million dollar SAN, that is still supported (and sold!) to this day).

Re: Vxlan over WireGuard (On OpenBSD)

#60

Post by lillecarl »

anton5mith2 wrote: post #42

I took this to extremes last year: I used it to run MAAS from Australia to sweden (which requires layer 2). Granted I used tailscale to make the WireGuard part even easier, but it was a lot of fun. https://medium.com/@antongslismith/bare-metal-cloud-provisio...

MAAS doesn't require L2, it requires DHCP and DNS to be configured correctly.
Post reply on HN