Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vxlan over WireGuard (On OpenBSD)

rob-turner.net

Post reply on HN
Print view View original

61–70 of 73 posts

Re: Vxlan over WireGuard (On OpenBSD)

#61

Post by lillecarl »

skullone wrote: post #59
lillecarl wrote: post #55

Earlier quoted context omitted.

You just explained how to increase technical debt in as few steps as possible. The solution is getting a wavelength or dark fiber to the off-site, or throwing out the piece of junk SAN that only works on L2, it's too old by now.

I didn't say "this solution is easier", simply said someone might find a use case for it. Ya'll are dismissive of something neat with a number of use-cases (I only tossed out just one use case that popped into my head, based on actual experience on a million dollar SAN, that is still supported (and sold!) to this day).

If you have a million dollar SAN you have capital to get a real connection where you need it.

The reason I'm very against even discussing this is because people who don't understand the downsides would be open to doing this, shooting themselves in the foot along the way. People who understand the pitfalls just won't and are telling you DON'T, YOUR FOOT WILL HURT.

You could use VXLAN over WireGuard with a lower MTU, attach the VXLAN interfaces to different VRFs and route traffic, it's a somewhat valid usecase.

Switching over the internet is pain, I've got experience. Used to work at an MSP that did this as common procedure, worked fine until it didn't, and noone could explain why. And we're not even talking loops yet, you'll have to build a pretty sick RSTP.

The use-case is at best an SMB migration strategy.

Re: Vxlan over WireGuard (On OpenBSD)

#62

Post by skullone »

lillecarl wrote: post #61
skullone wrote: post #59

Earlier quoted context omitted.

I didn't say "this solution is easier", simply said someone might find a use case for it. Ya'll are dismissive of something neat with a number of use-cases (I only tossed out just one use case that popped into my head, based on actual experience on a million dollar SAN, that is still supported (and sold!) to this day).

If you have a million dollar SAN you have capital to get a real connection where you need it. The reason I'm very against even discussing this is because people who don't understand the downsides would be open to doing this, shooting themselves in the foot along the way. People who understand the pitfalls just won't and are telling you DON'T, YOUR FOOT WILL HURT. You could use VXLAN over WireGuard with a lower MTU, a…

You don't have to explain the perils of extending L2 over any type of WAN to me. There used to be a hard requirement from some SANs to have dark fiber for their replication - not just L2 adjacency (needed actual FC zones extended to another site if I recall). But all is not happy times with L3 links and BGP between things (and even then, BGP configs to achieve anything decent in terms of failover needs BFD or more). But sure, poop all over this fun thought experiment if you want, I doubt anyone's going to deploy this and put a billion dollar company at risk.

Re: Vxlan over WireGuard (On OpenBSD)

#63

Post by lillecarl »

skullone wrote: post #62
lillecarl wrote: post #61

Earlier quoted context omitted.

If you have a million dollar SAN you have capital to get a real connection where you need it. The reason I'm very against even discussing this is because people who don't understand the downsides would be open to doing this, shooting themselves in the foot along the way. People who understand the pitfalls just won't and are telling you DON'T, YOUR FOOT WILL HURT. You could use VXLAN over WireGuard with a lower MTU, a…

You don't have to explain the perils of extending L2 over any type of WAN to me. There used to be a hard requirement from some SANs to have dark fiber for their replication - not just L2 adjacency (needed actual FC zones extended to another site if I recall). But all is not happy times with L3 links and BGP between things (and even then, BGP configs to achieve anything decent in terms of failover needs BFD or more).…

Yes you need the protocol designed to ensure bidirectional forwarding to keep failover times low. And the routing protocol for exchanging routes.

If the post mentioned the pitfalls it would be a fun experiment. But people don't have to ruin a billion dollar company to do damage, hopefully billion dollar companies can afford staff that knows this is wrong, not every SMB can.

Re: Vxlan over WireGuard (On OpenBSD)

#64

Post by wkat4242 »

systems_glitch wrote: post #34
crest wrote: post #25

IP over Ethernet over VXLAN over UDP over IP over WireGuard over UDP over IP over Ethernet… sigh OpenBSD does support both routing domains and multiple routing tables and includes multiple routing daemons in the base system. I would recommend to the author to stop hacking at the keyboard, grab whatever not to structured visualisation tool works for them (e.g. a whiteboard, a block of paper, a random drawing app, Visi…

I end up having to run basically this very setup (on OpenBSD, too) because I have a customer who has a Novell NetWare 5 setup and runs IPX only. Bad times.

People still use Novell NetWare?? Wow

Re: Vxlan over WireGuard (On OpenBSD)

#65

Post by justsomehnguy »

supertrope wrote: post #46
crest wrote: post #25

IP over Ethernet over VXLAN over UDP over IP over WireGuard over UDP over IP over Ethernet… sigh OpenBSD does support both routing domains and multiple routing tables and includes multiple routing daemons in the base system. I would recommend to the author to stop hacking at the keyboard, grab whatever not to structured visualisation tool works for them (e.g. a whiteboard, a block of paper, a random drawing app, Visi…

vMotion needs L2 adjacency to make live migrating VMs easy. Some software rely heavily on broadcast discovery messages and are thus designed for LAN usage not Internet connectivity but businesses try to stuff a square peg into a round hold.

I have a vHost which is sitting on a public IP in another country, while the rest of vSphere is here in RFC1918.

vMotion, Provisioning and backups work just fine.

Re: Vxlan over WireGuard (On OpenBSD)

#67

Post by tssva »

aroulin wrote: post #53
jacob019 wrote: post #45

Earlier quoted context omitted.

Wireguard virtualizes L3 out of the box.

With Wireguard being a point-to-point protocol (as I understand), it will be challenging to get good performance for L3VPN BUM traffic?

A Wireguard interface is point-to-multipoint non broadcast which if a single peer is configured on it can in general be treated as point-to-point.

Re: Vxlan over WireGuard (On OpenBSD)

#68

Post by aroulin »

lillecarl wrote: post #57
aroulin wrote: post #53

Earlier quoted context omitted.

With Wireguard being a point-to-point protocol (as I understand), it will be challenging to get good performance for L3VPN BUM traffic?

You wanna do PIM? There's no BUM on a p2p link.

Right, that's what I was trying to understand.

"wireshark can virtualize an L3 network out-of-the-box" How can this be true then?

Re: Vxlan over WireGuard (On OpenBSD)

#69

Post by lillecarl »

aroulin wrote: post #68
lillecarl wrote: post #57

Earlier quoted context omitted.

You wanna do PIM? There's no BUM on a p2p link.

Right, that's what I was trying to understand. "wireshark can virtualize an L3 network out-of-the-box" How can this be true then?

Well an L3 network is routed, so you just have routes. 32 bit route for the "server", whatever mask to reach others through the "server". The server has 32 bit routes to each client, so it works.

This is essentially how you want to build your DC networks today too (why waste ips on netid and broadcast that you never use) (for public addresses).

But you stick BGP on there to exchange route information rather than static routing.

Re: Vxlan over WireGuard (On OpenBSD)

#70

Post by aroulin »

lillecarl wrote: post #69
aroulin wrote: post #68

Earlier quoted context omitted.

Right, that's what I was trying to understand. "wireshark can virtualize an L3 network out-of-the-box" How can this be true then?

Well an L3 network is routed, so you just have routes. 32 bit route for the "server", whatever mask to reach others through the "server". The server has 32 bit routes to each client, so it works. This is essentially how you want to build your DC networks today too (why waste ips on netid and broadcast that you never use) (for public addresses). But you stick BGP on there to exchange route information rather than stat…

Right. My thinking is that with VxLAN you can get each tenant in the datacenter to have its own L3 network, isolated from other tenants L3 network.

Each tenant can have multiple subnets; run BGP, etc. and the IP addresses can be re-used between different tenants.

It doesn't seem wireguard can do that with just p2p network. This was one argument I had for adding VXLAN encapsulation over IP for the above comment. You also get L2 connectivity if you want it.

Post reply on HN