5 ms·
Out of curiosity, what is the use case for doing VPN at layer 2?
by cpach 7y ago
Out of curiosity, what is the use case for doing VPN at layer 2?
- kortilla 7y agoBroadcast/multicast propagation.
- rattray 7y agoCan you say more to explain the utility of this to those unfamiliar with networking?
- nightfly 7y agoYou can send data to N hosts by only sending it once, rather than N times.
- pathseeker 7y agoMany device discovery protocols work by sending out broadcast or multicast packets (either to announce themselves to devices who might be listening or to request devices to send them data). These packets are expected to go out to either everyone on the same layer-2 network (the broadcast case) or everyone who has subscribed to a particular multicast address (the multicast case). In addition to device discovery, these are frequently used for heartbeat messages to indicate that you are still alive (for high-availability protocols like VRRP).
- rattray 7y agoThanks! That's helpful/interesting and makes sense
- thayne 7y agoOne common use case is multicast DNS (https://en.wikipedia.org/wiki/Multicast_DNS https://en.wikipedia.org/wiki/Multicast_DNS) which uses multicast for individual hosts to publish services available on them to other hosts on the network without needing a dedicated DNS server.
- api 7y agoSomeone else said broadcast/multicast, so I'll also add communication with legacy systems that don't speak IP or have other wacky requirements. These do exist in industrial and embedded settings. It's a niche use case but it's very useful there.
- beached_whale 7y agoI suspect Novel/IPX is still out there
- api 7y agoYes, and more. Check out what runs on factory floors sometime. There's stuff that speaks naked Ethernet, as in you type the MAC of the machine into the application. There's also stuff that speaks CANbus over Ethernet without IP in the middle.
- cpach 7y agoWow. Had no idea. Fascinating!
- blattimwind 7y agoRaw ethernet is nice because you can't send ethernet frames from a web browser.
- waste_monk 7y agoI went through training on it back in 2012 - apparently it (at least at the time, not sure about now) was dominant in the australian mining industry, so the larger tertiary education providers were requested to at least familiarise students with it. It was a strange beast but there were a few odd spots it was better than active directory - e.g. an "Organizational Role" could be created and have a user assigned to it, so you could more easily seperate the user (john smith) from their position and the permissions that go with it (finance director). So when john smith retires it is trivial to replace the occupant of the finance director organisational role.
- lapinot 7y agoAlso icmp, ipv6 brings a lot of new things to the table in that realm. I already said it above, but the neighbor discovery protocol is quite useful to do dynamic in-band configuration. icmp is over ip, but it's not useful if the ip link is already managed by the tunnel protocol.
- linsomniac 7y agoPretty much every time I do a migration from one data center or office migration I set up an OpenVPN that bridges the network segments at the two locations. It makes the move so much easier. Once set up, I can shut down a machine at one location, move it, bring it back up, and it's back in business. There are situations where we might want to migrate to new machines during the move, which this makes no harder. But for many things it makes them easier. For example, the last move went something like this: Set up the VPN+bridge. Move half the application servers. Set up new firewall/load balancer since we were replacing the old ones. Test the new fw/lb. Physically move the primary database server during a maintenance window and switch over to the new fw/lb. If there were problems, just switch back to the old one via DNS record changes (TTL was lowered weeks earlier). Move the remaining app servers. During the bridging setup, the LBs preferred the local app servers.
- Rapzid 7y agoIt's been a while since I've worked with linux networking. I would have thought it would give you a VIF in some form or fashion that you could attach to a bridge. Is that not the case? EDIT: *and proxy arp requests through
- linsomniac 7y agoBy "it" do you mean Wireguard? I haven't used it, but you need a special type of virtual interface for bridging, a tap device can do it, a tun cannot. From some searches, Wireguard doesn't support operating on a bridge. OpenVPN, which is what I've used in the past, supports both tun and tap interfaces.