4 ms·

Anyone know if they've implemented DMVPN yet? edit: sounds like nope; only progress is a high-level description of how WireGuard might provide equivalent funct

• tptacek 10y ago
  Candidly: it seems weird to me that anyone would prioritize something like DMVPN over escaping the IPSEC ecosystem as soon as possible. IPSEC --- including Cisco's IPSEC products --- is terrifying.
  • drvdevd 10y ago
    So I've caught flack for choosing an OpenSSH "native" VPN (where it sets up TUN/TAP for you on both ends, etc..) over IPSec before. While I'm sure it's probably lower performance, if you've ever done more than just plug and play some Cisco IPSec stuff (e.g. manually implement IPsec on Linux), it is terrifying in its complexity, IMO, for something you depend upon so critcially.
    • crest 10y ago
      It's not just a performance problem. OpenSSH's VPN works by encapsulating either IP packets (tun) or Ethernet frames (tap) in TCP. Now you suffer from head of line blocking and nested congestion control. If you want an easy to use userspace VPN use OpenVPN. It may be bloated, but it works a lot better than IP over TCP can ever work.
      • j_s 10y ago
        Hasn anyone implemented IP over QUIC in any VPN product yet?
  • j_s 10y ago
    FYI, from the OP's linked discussion: DMVPN capability would be outstanding and would make WireGuard much more useful in a AWS VPN situation
• wmf 10y ago
  I was thinking that IETF IRONbis over WireGuard could be a good solution to the DMVPN use case. But someone would have to care enough to start coding.