Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

im.salty.fish

Post reply on HN
Print view View original

31–40 of 66 posts

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#31

Post by simonjgreen »

usui wrote: post #19
generalizations wrote: post #14

Earlier quoted context omitted.

If you have a write up of how you managed to get layer 2 working inside wireguard, I'd love to read it.

Since WireGuard is Layer 3, what would is everyone's use case of doing Layer 2 on it? Or, what can it improve over existing solutions? I have tried to do the same for a bit while still learning networking, but ran into Layer 3 limitations.

People who require layer 2 require either a protocol which is neither TCP nor UDP or they need devices in the same broadcast domain

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#32

Post by gerdesj »

slacka wrote: post #24
1970-01-01 wrote: post #18

>I always felt, and still feel, that applied Linux networking is difficult to get started with, mainly due to lack of good guidance. Most of the time I had to dig through small pieces of documentation scattered throughout the internet, trying to put them together to form a systematic overview of the network stack in Linux. ... >It is extremely frustrating when somebody interested in setting up their own network infra…

I experienced this back when I configured my home Linux boxes as a router, VPN server, firewall, media server, etc. Since I had the time, compiled all of the info I found on random blogs and sites and added them to the Ubuntu Community wiki. That was the 12.x days, when Ubuntu was in its prime and the distro to use. While these blogs were a great resource, I often found the commands outdated or applied to a different…

Ahhh, it sounds like you've only done this once. I started off with ipfw, then ipchains, then iptables and now whatever firewalld supports. OK that's roughly 25 years so not too much firewalling churn! I stopped hand rolling my own rule sets with ipchains and switched to generators and there are loads of them.

For me some of the problems nowadays are caused by search engine manipulation. Up until around five or so years ago Linux concept searches would get you pointed at the usual big hitters - Arch/Gentoo/Ubuntu/etc wikis and useful and quite well known blogs. My modern block list for ublacklist is huge and barely scratches the surface.

Now I come to think of it, we now have ChatGPT and I bet it can roll a decent ruleset without hallucinating madly. No doubt someone will soon be Showing HN: their smart new firewall prompt generator language for . It will make the LLM use Rust as an intermediary for extra safety.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#33

Post by gammajmp »

zokier wrote: post #29
gammajmp wrote: post #20

Earlier quoted context omitted.

Use a GRETAP interface; Red Hat's virtual interface documentation is phenomenal: https://developers.redhat.com/blog/2019/05/17/an-introductio...

The docs are indeed great, but to me it seems like they are recommending GENEVE (RFC 8926): > Generic Network Virtualization Encapsulation (GENEVE) supports all of the capabilities of VXLAN, NVGRE, and STT and was designed to overcome their perceived limitations. Many believe GENEVE could eventually replace these earlier formats entirely I'm bit surprised that they didn't have section on vxlan there considering it is…

Yes! I definitely agree. I've used GRETAP for L2 over Wireguard in the past, but it was quite a while ago. GENEVE looks like the way to go these days

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#34

Post by systems_glitch »

usui wrote: post #19
generalizations wrote: post #14

Earlier quoted context omitted.

If you have a write up of how you managed to get layer 2 working inside wireguard, I'd love to read it.

Since WireGuard is Layer 3, what would is everyone's use case of doing Layer 2 on it? Or, what can it improve over existing solutions? I have tried to do the same for a bit while still learning networking, but ran into Layer 3 limitations.

Probably the most common use case is letting Avahi/Bonjour/etc. or DHCP work across a tunnel.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#35

Post by systems_glitch »

generalizations wrote: post #14
systems_glitch wrote: post #12

We recently switched a bunch of stuff from OpenVPN to Wireguard. A number of the links were OpenVPN layer 2 tunnels to pass, of all things, Novell Netware running on IPX (the particular situation precludes switching to TCP/IP for those customers). Now, layer 2 tunneling is being performed using RFC 3378 EtherIP, and it's much more performant, not to mention easier to manage. Old and new systems are running OpenBSD.

If you have a write up of how you managed to get layer 2 working inside wireguard, I'd love to read it.

I basically just followed the OpenBSD documentation! One of the big advantages of OpenBSD is that pretty much everything you need to know is contained in the manpages.

As I'd said above, we ended up using RFC 3378 EtherIP to link the two layer 2 broadcast domains across the Wireguard tunnel. OpenBSD supports this with the etherip interface. You end up creating a bridge with the etherip interface and whatever physical Ethernet interfaces you want to bridge, on either side of the Wireguard tunnel.

I also tried VXLAN but did not have good results. I'm not entirely sure it wasn't a problem with my configuration. Traffic often went one-directional, where broadcast packets from Site A made it to Site B, but they did not come from Site B to Site A. EtherIP worked right off, so I didn't investigate further.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#36

Post by systems_glitch »

gerdesj wrote: post #27
systems_glitch wrote: post #12

We recently switched a bunch of stuff from OpenVPN to Wireguard. A number of the links were OpenVPN layer 2 tunnels to pass, of all things, Novell Netware running on IPX (the particular situation precludes switching to TCP/IP for those customers). Now, layer 2 tunneling is being performed using RFC 3378 EtherIP, and it's much more performant, not to mention easier to manage. Old and new systems are running OpenBSD.

Good grief - NetWare with only IPX! Presumably you'll be installing their Y2K patches any day soon 8) I'm pretty sure NetWare can natively tunnel IPX/SPX over TCP/IP, assuming you are not stuck on 3.12. I don't think you have to fork out for the multi protocol router thing. They will crash regularly until you get the magic combination spot on and then run forever. A NW 6.5 box will run quite happily as a pretty tiny…

That particular client is stuck on NetWare 5.1 and due to how bad their maintenance has been I dare not touch the running instances. Virtualization didn't work out as there's some issue with the current patchlevel that dies on Intel CPUs greater than Pentium 4 (including hyperthreading P4s). It's...a stupid story.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#37

Post by gerdesj »

systems_glitch wrote: post #36
gerdesj wrote: post #27

Earlier quoted context omitted.

Good grief - NetWare with only IPX! Presumably you'll be installing their Y2K patches any day soon 8) I'm pretty sure NetWare can natively tunnel IPX/SPX over TCP/IP, assuming you are not stuck on 3.12. I don't think you have to fork out for the multi protocol router thing. They will crash regularly until you get the magic combination spot on and then run forever. A NW 6.5 box will run quite happily as a pretty tiny…

That particular client is stuck on NetWare 5.1 and due to how bad their maintenance has been I dare not touch the running instances. Virtualization didn't work out as there's some issue with the current patchlevel that dies on Intel CPUs greater than Pentium 4 (including hyperthreading P4s). It's...a stupid story.

On VMware you can hide CPU features - ie backrev the CPU and I'm sure HV can do the same, and no doubt KVM/QEMMU too.

I used to run a lot of NW back in the day. I remember deploying a NW 5 cluster of three Compaq boxes with six NICs each (for each VLAN) to do just DHCP/Dynamic DNS! I also ran up four HP boxes a year later with single ATM cards in them with a lot of VLANs to replace a load of 4.11 jobbies. The autoexec.ncf was a masterpiece! The cluster hosts had 6GB RAM each and despite being 32bit had quite a lot of cache which nss absolutely loved. I can't remember when NW 32 bit managed to devote >4Gb to cache but it was handy. As a file server it was absolutely unmatched. Apply an ACL and it simply worked - none of that marking subfolders and files thing that MS and Unix need. NDS/eDir was streets ahead of that weird LDAP n Kerberos thingie that MS "invented" and frankly still is.

I would suggest that you virty them as a matter of urgency. Presumably you have limited and dwindling hardware resources available and at some point something will go pop that can't be fixed. Once you have them as VMs then you can snapshot and all the other lovely things that virty brings to the game and you will never run out of hardware!

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#38

Post by systems_glitch »

gerdesj wrote: post #37
systems_glitch wrote: post #36

Earlier quoted context omitted.

That particular client is stuck on NetWare 5.1 and due to how bad their maintenance has been I dare not touch the running instances. Virtualization didn't work out as there's some issue with the current patchlevel that dies on Intel CPUs greater than Pentium 4 (including hyperthreading P4s). It's...a stupid story.

On VMware you can hide CPU features - ie backrev the CPU and I'm sure HV can do the same, and no doubt KVM/QEMMU too. I used to run a lot of NW back in the day. I remember deploying a NW 5 cluster of three Compaq boxes with six NICs each (for each VLAN) to do just DHCP/Dynamic DNS! I also ran up four HP boxes a year later with single ATM cards in them with a lot of VLANs to replace a load of 4.11 jobbies. The autoexe…

Pretty cool to hear about big NW installs! Thanks for sharing!

We're actively working on moving that customer off Netware entirely. The main reason they can't get away from it is they're running a custom god program that manages the entire business, and it's tied in pretty tightly with their old configuration. The whole thing is in Delphi 7.

W.R.T. old hardware, they are actually some of the newer old boxes we support! My main line of business is keeping old industrial control systems online and reliable. On the PC side, the oldest stuff we have in 24/7 operation is 286-based. Pre-PC, we have a few customers running CNC stuff on PDP-11s. I don't know if we still have any PDP-8 customers, I think most of them closed up shop during the pandemic.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#39

Post by bryancoxwell »

mulmen wrote: post #26

Meta: Huh. I don’t use “shallow dive” enough. “Deep dive” of course, everyone loves a good deep dive. But what about a shallow dive, or even just “getting your feet wet”? These are useful concepts too. This headline alone revealed a blind spot for me.

Had the same thought. Could do with more shallow dives to be honest.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#40

Post by harry8 »

sushidev wrote: post #6

i agree it's very hard to learn from the internet.. (the bottomline in the post)

It was incredibly so much easier when popular search engines did search instead of "recommendation." The hardest thing is actually finding the thing that exists, in multiple forms, that you set out to find.

We've gone backwards in the past 15 years.

Post reply on HN