3 ms·
OpenBSD SEC(4) for Route Based IPSec VPNs
- MobiusHorizons 3y agoThese days I would expect to reach for wiregard for p2p vpn solutions. Are there any advantages to using IPsec instead? Is this for connecting to some existing IPsec infrastructure?
- asenchi 3y agoRead through the post, it is explained there: > The reason I started on this was to better interoperate with "site-to-site" vpns, in particular AWS Site-to-Site VPNs, and the Auto-Discovery VPN (ADVPN) stuff on fortinet fortigate appliances. Both of these negotiate IPsec tunnels that can carry any traffic at the IPsec level, but use BGP and routes to direct traffic into those tunnels.
- MobiusHorizons 3y agoAck, I read that part, but it still wasn’t clear that wireguard wouldn’t have been a good solution (likely due to ignorance of either use case)
- wahern 3y agoI'm not sure if it applies to these particular tunnels as there are multiple methods to build tunnels using IPSec, but point-to-point IPSec tunnels often have lower byte overhead as you don't necessarily need to encapsulate in another type of packet, whereas the minimum Wireguard overhead is already significant. The biggest source of headaches with VPNs is the small margin between maximum and minimum effective IPv4 packet size, and when you cross these margins packets tend to get silently dropped. Also, as this tunnel interface still integrates with OpenBSD isakmpd (IKEv1) and iked (IKEv2) daemons, you can use certificate-based authentication without installing some bespoke, proprietary agent for key management.
- MobiusHorizons 3y agoThanks
- user6723 3y agoLower byte overhead, right, damn this should be obvious already to those of us who work with BSD. Thank you.
- jsiepkes 3y agoThis looks cool! Bit surprised that even though there seems to be interest in IPSec in OpenBSD nobody ever finished sasyncd. Which is used to create an IPSec failover setup between OpenBSD hosts. However sasyncd was never fully finished. It can't sync existing SA states. Meaning the first failover works, but the second time you failover you are missing SA's.
- user6723 3y agoI have been using OpenBSD's Wireguard implementation for a while now. I see this and think "why would anyone use IPsec when there is Wireguard"? Maybe I am missing something, am gonna dig into this.