3 ms·
The feature parity I'm waiting for is L2 VPNs. Wireguard is strictly L3-only, and so far all I've seen are some custom hacks to tunnel L2 ethernet frames over w
by generalizations 4y ago
The feature parity I'm waiting for is L2 VPNs. Wireguard is strictly L3-only, and so far all I've seen are some custom hacks to tunnel L2 ethernet frames over wg.
- jacob019 4y agoWireguard is L3 encryption. It's great because it's simple. Linus called it poetry. If you are bridging L2 over the Internet, then one way or another you're stuffing Ethernet frames into IP packets. Linux has built in L2 tunneling, sans encryption. I wouldn't call it a custom hack to open an L2 tunnel over wireguard. It's a one liner on each end. A configuration utility like wg-quick could be made to set it up for you. I wouldn't want wireguard to become OpenVPN.
- generalizations 4y ago> I wouldn't call it a custom hack to open an L2 tunnel over wireguard There's too many headers that are too big. If you do a simple L2 tunnel, you have three options: jumbo frames, packet fragmentation, or custom hacks. None are great. > Linux has built in L2 tunneling, sans encryption IIRC, because the extra header for the encryption layer pushes the MTU over 1500.
- jacob019 4y agoRegardless of the technology, there is no way to put an 1518 byte Ethernet frame in a 1500 byte IP packet. You're going to have to fragment or live with reduced MTU inside the tunnel.
- candiddevmike 4y agoWhat do you need L2 for these days?
- jasonjayr 4y agohttps://github.com/m13253/VxWireguard-Generator https://github.com/m13253/VxWireguard-Generator I'm using that in production with Babel (managing dynamic routes) with great success. Tinc had been solid for us for years, but once I actually payed attention to the performance hit, it was worth a bit of hassle to make it work over wireguard.