Vxlan over WireGuard (On OpenBSD)

#1

Post by hucste » Tue, Feb 14, 2023, 1:33 PM UTC

Vxlan over WireGuard (On OpenBSD)
rob-turner.net

Re: Vxlan over WireGuard (On OpenBSD)

#2

Post by floatinglotus » Tue, Feb 14, 2023, 4:50 PM UTC

The difficulty isn’t setting it up, it’s in determining how much traffic you can put through it before it breaks.

How does it handle segmenting jumbo frames? Etc.

Re: Vxlan over WireGuard (On OpenBSD)

#3

Post by blakesterz » Tue, Feb 14, 2023, 4:56 PM UTC

I love how this starts off "What is a VXLAN..." that was going to be my first question! So often posts like this seem to assume everyone knows what the topics are at the start. I know what WireGuard is, and I've at least heard of VXLAN before, but I couldn't remember what it was.

Re: Vxlan over WireGuard (On OpenBSD)

#4

Post by candiddevmike » Tue, Feb 14, 2023, 5:27 PM UTC

Just do static routes or BGP over Wireguard. Simpler, scalable, less error prone.

Re: Vxlan over WireGuard (On OpenBSD)

#5

Post by yokem55 » Tue, Feb 14, 2023, 5:28 PM UTC

The feature I would be interested in is if this can do link state toggling on the on the vxlan interface if the wg handshake timer goes stale. If that works, then it becomes practical to do things like run ospf routing over the vxlan interface.

Re: Vxlan over WireGuard (On OpenBSD)

#6

Post by vxxzy » Tue, Feb 14, 2023, 5:32 PM UTC

candiddevmike wrote: post #4

Just do static routes or BGP over Wireguard. Simpler, scalable, less error prone.

Does this get you Layer 2 connectivity?

Re: Vxlan over WireGuard (On OpenBSD)

#7

Post by candiddevmike » Tue, Feb 14, 2023, 5:34 PM UTC

vxxzy wrote: post #6

candiddevmike wrote: post #4

Just do static routes or BGP over Wireguard. Simpler, scalable, less error prone.

Does this get you Layer 2 connectivity?

No, because most applications don't need layer 2 adjacency.

Re: Vxlan over WireGuard (On OpenBSD)

#8

Post by vxxzy » Tue, Feb 14, 2023, 5:42 PM UTC

candiddevmike wrote: post #7

vxxzy wrote: post #6

Earlier quoted context omitted.

Does this get you Layer 2 connectivity?

No, because most applications don't need layer 2 adjacency.

You may consider VoIP phones. When a phone boots up on a network segment the DHCP process comes into play. This process is a Layer 2 process. The DHCP packet could contain a boot server field (this is typical) so the VoIP phone can grab configuration. One may want the boot server info "isolated" from other network segments. Utilizing VLANs is one way to do this. Additionally, it is typical that QoS is applied at Layer 2 (something necessary for real-time protocols like VoIP).

Re: Vxlan over WireGuard (On OpenBSD)

#9

Post by candiddevmike » Tue, Feb 14, 2023, 5:47 PM UTC

vxxzy wrote: post #8

candiddevmike wrote: post #7

Earlier quoted context omitted.

No, because most applications don't need layer 2 adjacency.

You may consider VoIP phones. When a phone boots up on a network segment the DHCP process comes into play. This process is a Layer 2 process. The DHCP packet could contain a boot server field (this is typical) so the VoIP phone can grab configuration. One may want the boot server info "isolated" from other network segments. Utilizing VLANs is one way to do this. Additionally, it is typical that QoS is applied at Laye…

I hope you're not trying to run VoIP phones via vxlan over wireguard because you don't want to setup a local DHCP server

Re: Vxlan over WireGuard (On OpenBSD)

#10

Post by [deleted] » Tue, Feb 14, 2023, 5:49 PM UTC

yokem55 wrote: post #5

The feature I would be interested in is if this can do link state toggling on the on the vxlan interface if the wg handshake timer goes stale. If that works, then it becomes practical to do things like run ospf routing over the vxlan interface.

[deleted]