3 ms·
These days I would expect to reach for wiregard for p2p vpn solutions. Are there any advantages to using IPsec instead? Is this for connecting to some existing
by MobiusHorizons 3y ago
These days I would expect to reach for wiregard for p2p vpn solutions. Are there any advantages to using IPsec instead? Is this for connecting to some existing IPsec infrastructure?
- asenchi 3y agoRead through the post, it is explained there: > The reason I started on this was to better interoperate with "site-to-site" vpns, in particular AWS Site-to-Site VPNs, and the Auto-Discovery VPN (ADVPN) stuff on fortinet fortigate appliances. Both of these negotiate IPsec tunnels that can carry any traffic at the IPsec level, but use BGP and routes to direct traffic into those tunnels.
- MobiusHorizons 3y agoAck, I read that part, but it still wasn’t clear that wireguard wouldn’t have been a good solution (likely due to ignorance of either use case)
- wahern 3y agoI'm not sure if it applies to these particular tunnels as there are multiple methods to build tunnels using IPSec, but point-to-point IPSec tunnels often have lower byte overhead as you don't necessarily need to encapsulate in another type of packet, whereas the minimum Wireguard overhead is already significant. The biggest source of headaches with VPNs is the small margin between maximum and minimum effective IPv4 packet size, and when you cross these margins packets tend to get silently dropped. Also, as this tunnel interface still integrates with OpenBSD isakmpd (IKEv1) and iked (IKEv2) daemons, you can use certificate-based authentication without installing some bespoke, proprietary agent for key management.
- MobiusHorizons 3y agoThanks
- user6723 3y agoLower byte overhead, right, damn this should be obvious already to those of us who work with BSD. Thank you.