4 ms·
Just do static routes or BGP over Wireguard. Simpler, scalable, less error prone.
by candiddevmike 4y ago
Just do static routes or BGP over Wireguard. Simpler, scalable, less error prone.
- vxxzy 4y agoDoes this get you Layer 2 connectivity?
- candiddevmike 4y agoNo, because most applications don't need layer 2 adjacency.
- vxxzy 4y agoYou may consider VoIP phones. When a phone boots up on a network segment the DHCP process comes into play. This process is a Layer 2 process. The DHCP packet could contain a boot server field (this is typical) so the VoIP phone can grab configuration. One may want the boot server info "isolated" from other network segments. Utilizing VLANs is one way to do this. Additionally, it is typical that QoS is applied at Layer 2 (something necessary for real-time protocols like VoIP).
- candiddevmike 4y agoI hope you're not trying to run VoIP phones via vxlan over wireguard because you don't want to setup a local DHCP server
- chungy 4y agoMaybe he'll write a blog post about it :)
- vxxzy 4y agoOver VXLAN yeah... You won't believe how many small-medium companies are moving from on-prem to small managed private clouds. VXLAN allows them to maintain their existing network configuration. "You hope" ha! I suppose by this you mean that the wireguard + vxlan may not be a "mature" combination for something as mission-critical as voice traffic? VXLAN implementations by mature companies (Netgate, Fortinet, etc...) those work. Maybe this wireguard+vxlan would work too.. who knows!? Edit: I see you changed your comment to consider remote DHCP which causes my comment above to be irrelevant. Oh well. The fact still holds that VXLAN is meant to handle Layer 2 so saying BGP is an alternative is like putting a square peg in a round hole.
- deleted 4y ago[deleted]
- gorkish 4y agoI appreciate that you are trying to give examples of "L2 things" but none of this is really good advice. For QoS, what do you think double-encapsulating all of the QoS bits inside of two tunnels is going to do for you? If you pay your carrier to respect QoS, you have to actually give them the bits! QoS goes on the OUTSIDE of the onion. DHCP for VLANs should be handled by snooping for it on the switch and forwarding over L3 (ip helper-address), not by running vxlan over a VPN tunnel. And really it shouldn't ever be done over a potentially unreliable WAN link either; you should have a local agent for DDI at each site. The only story here is that L2-over-L3 VPN have their very specific niches, and VXLAN+Wireguard is an alternative to L2TP+IPSec that is (IMO) both easier to configure and more reliable when such a thing is needed.
- SoftTalker 4y ago> VXLAN+Wireguard is an alternative to L2TP+IPSec that is (IMO) both easier to configure and more reliable I'm sorry to ask but which alternative do you find easier and more reliable? I seem to be able to parse that either way, maybe it's just me.
- justsomehnguy 4y ago>maybe it's just me. Nope, here with the same problem and I don't treat L2TP/IPSec as an easier to configure and reliable.
- deleted 4y ago[deleted]
- gorkish 4y agoSorry for the dangling preposition. "That" refers to VXLAN+Wireguard being easier and more reliable. It has the drawback though of having very high overhead at 130 bytes/packet, and it can be very tricky to use over the public Internet without paying lots of special attention to tuning the MTU of all devices on the bridged segment. I'm glad to know that there are geeks who have not been exposed to the horrors of IPSec, though. And yeah, you should pretty much never do L2VPN. It is perilous in the extreme.
- iso1631 4y agoOr dhcp relay to a central dhcp server
- crest 4y agoI've found that they work just fine. In my case all that was required was setting a DHCP option pointing them at their controller. The QoS to make it work well under load would've been the same for a L2 tunnel.
- lormayna 4y agoAs someone that has fight for years with L2 in the WAN, I will not advice that at all. Just installa a DHCP server and transport the traffic over L3. You have lot more control both on routing both on QoS
- zymhan 4y agoThen it's not actually an equivalent solution. L2 connectivity is still quite useful, even if you don't have a need for it.
- icedchai 4y agoI'm doing OSPF over Wireguard (running BIRD on Debian, not OpenBSD though.) It works pretty well.
- iso1631 4y agoBut doesn't provide layer 2 between networks. Think of devices that are hardcoded to communicate with broadcast or multicast with TTL of 1, you either need some active reflector, and cope with any perculiarities of the device, or you simply extend a single vlan between two routers (using vxlan or another solution) I sometimes need to extend a system like this from one site to another. One is a calrec system (an audio mixer, I think it's the control traffic that needs to be sent), and I don't have enough access or time to see if I could build some kind of transparent proxy -- it won't work with multicast routing. I do however have enough time to create a layer2 network between two nics. I tend to use mikrotiks for that, create an eoip tunnel (GRE with proprietary addons to cope with fragmentation) between the two endpoints and pop the interface in a bridge with a physical port, and move on.
- johnklos 4y ago"Here's how I did this thing." "You don't need to do that thing." How do you know?
- sophacles 4y agoI've been in or very close to networking for a long time. Here's a certainty: there's lots of ways to do anything. Here's a corollary to that: someone will be sure to tell you how bad any choice you make is.