| ▲ | ericdiao 3 days ago |
| Really want to know the rationale of choosing IPSec over Wireguard. IPSec is really tricky to get right (IMO). Maybe legacy issue? |
|
| ▲ | CursedSilicon 3 days ago | parent | next [-] |
| They probably use L2TP with IPsec to get Layer 2 transit. Doing that over Wireguard would require Gretep or something similar |
| |
| ▲ | smashed 3 days ago | parent | next [-] | | Not sure they are using l2 transit. They are using BGP and routing nodes (backbones), recreating a mini IP (layer 3) network I think. I've used raw wireguard in a p2p fashion to interconnect LANs. I run wireguard on each segment directly inside the network routers. Just make sure all LANs are using a different subnet. A /24 is standard. Then configure all the peers and you get a fully peer to peer network. No relays. You only need one side of every peer "pair" to be reachable from the internet. I do have a small management script to help peer discovery (dynamic IPs) and key exchange, but it's not strictly required. With a dozen nodes or so, it's maintainable manually. Wireguard supports roaming natively, as long as one peer can reach the other. Very little overhead. ICMP, TCP and UDP support. | | |
| ▲ | icedchai 3 days ago | parent | next [-] | | I have my own Wireguard mesh network between my home network and a couple of VPSes. I configured it all manually, too. I'm basically running a virtual public network and have it routing a /24 (BGP announced at the VPSes) back to my home. | | |
| ▲ | immibis 2 days ago | parent [-] | | How did you get a public /24?! | | |
| ▲ | icedchai 2 days ago | parent [-] | | I was an early Internet user (early 90's.) They gave them out to anyone who asked back then. | | |
| ▲ | bevr1337 2 days ago | parent [-] | | A little morbid, but have you considered setting up a beneficiary for the allocation or detailing this asset in a will? That's some special, virtual real estate you have there. | | |
| ▲ | icedchai a day ago | parent [-] | | I’m hoping IPv4 is obsolete by that time. That’s a good idea though. |
|
|
|
| |
| ▲ | mdickers47 2 days ago | parent | prev [-] | | That is correct. IPSec sucks but we have already paid the price of being forced to figure it out in big organizations, so, not much motivation to figure out another thing. |
| |
| ▲ | ericdiao 3 days ago | parent | prev [-] | | Oh this make sense. For LAN, one definitely want L2. Totally overlooked the objective. | | |
| ▲ | x2tyfi 3 days ago | parent [-] | | Why though? The only use case I can imagine is a legacy game which performs a server search by broadcasting/scanning the local network. And even then - most of the time these games had server browsers. | | |
| ▲ | lmm 2 days ago | parent [-] | | Some classic games use IPX for multiplayer, so you can't play them over an IP VPN. |
|
|
|
|
| ▲ | LorenDB 3 days ago | parent | prev | next [-] |
| My personal choice for something like this would be Tailscale/Headscale. Runs over Wireguard and handles a ton of niceties like DNS for connected nodes automatically. |
| |
| ▲ | redn0vae 3 days ago | parent | next [-] | | This kind of defeats the purpose of TPL. Part of TPL is setting up your own network segment. There's a dashboard that shows who has what working. Part of the fun of TPL isn't just that your computer can talk to another computer, it's that you have your own setup configured form the ground up so your /24 can talk to other /24s on TPL. I 100% understand some people will not enjoy that and won't find it fun, and that is ok. Some people do enjoy learning new things about setting up infrastructure, and this scratches some of that itch. | |
| ▲ | ericdiao 3 days ago | parent | prev [-] | | Yeah. I personally ran into the legacy setup issue for running vanilla Wireguard for my setup before Tailscale is a thing and have to manually manage keys, routing and DNS. But one thing Tailscale has that annoyed me is that they are using 100.64 CGNAT addresses (which is more RFC-compliant) but conflicts with one of my cloud service provider's pre-configured DNS, NTP and software mirrors setup. Using it became more or less messy for this reason. | | |
|
|
| ▲ | frollogaston 2 days ago | parent | prev | next [-] |
| I use IPSec only because Macs, iPhones, etc have built-in support, and so does my router by coincidence. I don't want to install extra stuff. |
|
| ▲ | bongodongobob 3 days ago | parent | prev [-] |
| I mean, this is pretty much the standard of setting up satellite offices for businesses and whatnot. Lots of people are extremely familiar with IPSec, it's not that hard. |
