Live data from Hacker News

Vxlan over WireGuard (On OpenBSD)

rob-turner.net

71–73 of 73 posts

Re: Vxlan over WireGuard (On OpenBSD)

#71
post #70

Earlier quoted context omitted.

Well an L3 network is routed, so you just have routes. 32 bit route for the "server", whatever mask to reach others through the "server". The server has 32 bit routes to each client, so it works. This is essentially how you want to build your DC networks today too (why waste ips on netid and broadcast that you never use) (for public addresses). But you stick BGP on there to exchange route information rather than stat…

Right. My thinking is that with VxLAN you can get each tenant in the datacenter to have its own L3 network, isolated from other tenants L3 network. Each tenant can have multiple subnets; run BGP, etc. and the IP addresses can be re-used between different tenants. It doesn't seem wireguard can do that with just p2p network. This was one argument I had for adding VXLAN encapsulation over IP for the above comment. You a…

Ah, yes. Well you can set up multiple tunnels for lower overhead too, all you need is an interface so you can bind it to a VRF. You save 50 bytes on every packet though in reality either way works.

As long as you're lowering MTU and not bridging your VXLAN you're fine.

You can run VXLAN over any L3 so it's versatile like that, but the benefit of VXLAN over other encap protocols is that it's simple, accelerated in a lot of hardware, integrated with BGP-EVPN to make scaling easier, more predictable and traceable.

Re: Vxlan over WireGuard (On OpenBSD)

#72

Earlier quoted context omitted.

I end up having to run basically this very setup (on OpenBSD, too) because I have a customer who has a Novell NetWare 5 setup and runs IPX only. Bad times.

People still use Novell NetWare?? Wow

Unfortunately.

Re: Vxlan over WireGuard (On OpenBSD)

#73

This is fun, but applications requiring L2 adjacency do it to limit latency/distance. Creating a L2 domain between here and the moon, what are you gonna use it for? Certainly not anything other than fun.

Can you use this to get Apple bonjour / mDNS working over a remote network (connected via VPN)? Or similarly, could you use it for a cloud seedbox to cast to a chromecast on your local network (via the VPN obviously)?

For mDNS, you should run avahi to relay between subnets. For chromecast, that is SSDP/DLNA which is a multicast, so it is a matter of establishing mulitcast routing between sites.

Bridging L2 is not the optimal solution for either of your scenarios.

Post reply on HN