Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

im.salty.fish

Post reply on HN
Print view View original

41–50 of 66 posts

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#41

Post by tjohns »

systems_glitch wrote: post #34
usui wrote: post #19

Earlier quoted context omitted.

Since WireGuard is Layer 3, what would is everyone's use case of doing Layer 2 on it? Or, what can it improve over existing solutions? I have tried to do the same for a bit while still learning networking, but ran into Layer 3 limitations.

Probably the most common use case is letting Avahi/Bonjour/etc. or DHCP work across a tunnel.

Bonjour is built on top of DNS. You don't need a layer 2 tunnel to make it work.

However, it normally does rely on multicast. Rather than trying to bridge broadcast domains (which is going to cause performance issues), a more efficient option is to setup an Avahi mDNS reflector on either end of the tunnel to rebroadcast mDNS packets.

See, for example: https://www.reddit.com/r/WireGuard/comments/g80bxf/comment/h...

Alternatively, there's also a Wide-Area Bonjour service that works over unicast and doesn't need any special packet forwarding, provided you run a Bonjour-aware DNS server:

http://www.dns-sd.org/serversetup.html

https://help.dyn.com/bonjour-and-dns-discovery/

(More generally, Layer 2 tunnels are best avoided unless you really need them for something arcane, like IPX or NetBIOS.)

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#42

Post by bombcar »

slacka wrote: post #24
1970-01-01 wrote: post #18

>I always felt, and still feel, that applied Linux networking is difficult to get started with, mainly due to lack of good guidance. Most of the time I had to dig through small pieces of documentation scattered throughout the internet, trying to put them together to form a systematic overview of the network stack in Linux. ... >It is extremely frustrating when somebody interested in setting up their own network infra…

I experienced this back when I configured my home Linux boxes as a router, VPN server, firewall, media server, etc. Since I had the time, compiled all of the info I found on random blogs and sites and added them to the Ubuntu Community wiki. That was the 12.x days, when Ubuntu was in its prime and the distro to use. While these blogs were a great resource, I often found the commands outdated or applied to a different…

The Gentoo Wiki was a great resource for many networking questions, even when I wasn't using Gentoo.

A major hurdle is simply learning how to describe what you want to do "in the industry terms" - "I can't access my server from my computer but it works from the Internet" is a lot easier to resolve when you learn what "hairpin NAT" is.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#43

Post by gerdesj »

systems_glitch wrote: post #38
gerdesj wrote: post #37

Earlier quoted context omitted.

On VMware you can hide CPU features - ie backrev the CPU and I'm sure HV can do the same, and no doubt KVM/QEMMU too. I used to run a lot of NW back in the day. I remember deploying a NW 5 cluster of three Compaq boxes with six NICs each (for each VLAN) to do just DHCP/Dynamic DNS! I also ran up four HP boxes a year later with single ATM cards in them with a lot of VLANs to replace a load of 4.11 jobbies. The autoexe…

Pretty cool to hear about big NW installs! Thanks for sharing! We're actively working on moving that customer off Netware entirely. The main reason they can't get away from it is they're running a custom god program that manages the entire business, and it's tied in pretty tightly with their old configuration. The whole thing is in Delphi 7. W.R.T. old hardware, they are actually some of the newer old boxes we suppor…

Good skills.

You beat our DOS 5 booting control system into a cocked hat, that a customer is running. You've got to love cough technical debt. Why on earth is "Enterprise gone awry" considered the right way to go for your IT strategy over that boring old open source bollocks that has a nasty habit of still being supported or at least working decades later? To be fair, open source wasn't a thing in the 80s for most people (nor the 90s ... ).

PDP-11s are my uncle's era and I'm 53! My first real PC was a 80286 (don't forget the 80) I bought a '287 maths co pro for about £115 so I could run a dodgy copy of AutoCAD on it. I do still have my old Commodore 64 which now has a USB interface. I assembled a ZX80 or two ...

Delphi is "just" Pascal - port it!

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#44

Post by systems_glitch »

gerdesj wrote: post #43
systems_glitch wrote: post #38

Earlier quoted context omitted.

Pretty cool to hear about big NW installs! Thanks for sharing! We're actively working on moving that customer off Netware entirely. The main reason they can't get away from it is they're running a custom god program that manages the entire business, and it's tied in pretty tightly with their old configuration. The whole thing is in Delphi 7. W.R.T. old hardware, they are actually some of the newer old boxes we suppor…

Good skills. You beat our DOS 5 booting control system into a cocked hat, that a customer is running. You've got to love cough technical debt. Why on earth is "Enterprise gone awry" considered the right way to go for your IT strategy over that boring old open source bollocks that has a nasty habit of still being supported or at least working decades later? To be fair, open source wasn't a thing in the 80s for most pe…

The bad part is mostly the DB and the Netware integration, but mostly the DB. It's Borland Paradox.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#45

Post by pm2222 »

zokier wrote: post #29
gammajmp wrote: post #20

Earlier quoted context omitted.

Use a GRETAP interface; Red Hat's virtual interface documentation is phenomenal: https://developers.redhat.com/blog/2019/05/17/an-introductio...

The docs are indeed great, but to me it seems like they are recommending GENEVE (RFC 8926): > Generic Network Virtualization Encapsulation (GENEVE) supports all of the capabilities of VXLAN, NVGRE, and STT and was designed to overcome their perceived limitations. Many believe GENEVE could eventually replace these earlier formats entirely I'm bit surprised that they didn't have section on vxlan there considering it is…

https://developers.redhat.com/blog/2018/10/22/introduction-t... vxlan and many others are here

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#46

Post by wmf »

bombcar wrote: post #42
slacka wrote: post #24

Earlier quoted context omitted.

I experienced this back when I configured my home Linux boxes as a router, VPN server, firewall, media server, etc. Since I had the time, compiled all of the info I found on random blogs and sites and added them to the Ubuntu Community wiki. That was the 12.x days, when Ubuntu was in its prime and the distro to use. While these blogs were a great resource, I often found the commands outdated or applied to a different…

The Gentoo Wiki was a great resource for many networking questions, even when I wasn't using Gentoo. A major hurdle is simply learning how to describe what you want to do "in the industry terms" - "I can't access my server from my computer but it works from the Internet" is a lot easier to resolve when you learn what "hairpin NAT" is.

Searching for things when you don't know the terminology seems like an ideal use for AIs.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#47

Post by teleforce »

usui wrote: post #19
generalizations wrote: post #14

Earlier quoted context omitted.

If you have a write up of how you managed to get layer 2 working inside wireguard, I'd love to read it.

Since WireGuard is Layer 3, what would is everyone's use case of doing Layer 2 on it? Or, what can it improve over existing solutions? I have tried to do the same for a bit while still learning networking, but ran into Layer 3 limitations.

The best way to perform something like this on Layer 2 is to use Shortest Path Bridging (SPB) based on IEEE 802.1Q-2018. However the Linux kernel does not yet fully supporting this feature natively although the standard has been out for quite sometime and already being supported by commercial network solutions and the popular Open vSwitch (OVS) [1].

[1] Ask HN: Project ideas for a Linux kernel module:

https://news.ycombinator.com/item?id=35785158

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#48

Post by cyberax »

slacka wrote: post #24
1970-01-01 wrote: post #18

>I always felt, and still feel, that applied Linux networking is difficult to get started with, mainly due to lack of good guidance. Most of the time I had to dig through small pieces of documentation scattered throughout the internet, trying to put them together to form a systematic overview of the network stack in Linux. ... >It is extremely frustrating when somebody interested in setting up their own network infra…

I experienced this back when I configured my home Linux boxes as a router, VPN server, firewall, media server, etc. Since I had the time, compiled all of the info I found on random blogs and sites and added them to the Ubuntu Community wiki. That was the 12.x days, when Ubuntu was in its prime and the distro to use. While these blogs were a great resource, I often found the commands outdated or applied to a different…

This is one reason Mikrotik products are so nice. At least, they have a pretty decent Web UI that you can use to configure stuff.

Re: Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT

#50

Post by wmf »

teleforce wrote: post #47
usui wrote: post #19

Earlier quoted context omitted.

Since WireGuard is Layer 3, what would is everyone's use case of doing Layer 2 on it? Or, what can it improve over existing solutions? I have tried to do the same for a bit while still learning networking, but ran into Layer 3 limitations.

The best way to perform something like this on Layer 2 is to use Shortest Path Bridging (SPB) based on IEEE 802.1Q-2018. However the Linux kernel does not yet fully supporting this feature natively although the standard has been out for quite sometime and already being supported by commercial network solutions and the popular Open vSwitch (OVS) [1]. [1] Ask HN: Project ideas for a Linux kernel module: https://news.yc…

SPB uses MAC-in-MAC encapsulation which won't help you run over Wireguard. You need some flavor of Ethernet over IP like GRE, VXLAN, or GENEVE.
Post reply on HN