Hacker News Reader

Comment by generalizations | Hacker News Reader

If you have a write up of how you managed to get layer 2 working inside wireguard, I'd love to read it.

I basically just followed the OpenBSD documentation! One of the big advantages of OpenBSD is that pretty much everything you need to know is contained in the manpages.

As I'd said above, we ended up using RFC 3378 EtherIP to link the two layer 2 broadcast domains across the Wireguard tunnel. OpenBSD supports this with the etherip interface. You end up creating a bridge with the etherip interface and whatever physical Ethernet interfaces you want to bridge, on either side of the Wireguard tunnel.

I also tried VXLAN but did not have good results. I'm not entirely sure it wasn't a problem with my configuration. Traffic often went one-directional, where broadcast packets from Site A made it to Site B, but they did not come from Site B to Site A. EtherIP worked right off, so I didn't investigate further.

Use a GRETAP interface; Red Hat's virtual interface documentation is phenomenal:

https://developers.redhat.com/blog/2019/05/17/an-introductio...

The docs are indeed great, but to me it seems like they are recommending GENEVE (RFC 8926):

> Generic Network Virtualization Encapsulation (GENEVE) supports all of the capabilities of VXLAN, NVGRE, and STT and was designed to overcome their perceived limitations. Many believe GENEVE could eventually replace these earlier formats entirely

I'm bit surprised that they didn't have section on vxlan there considering it is pretty popular afaik?

Anyways, I think tunneling GENEVE (or any other Ethernet-over-IP protocol) should work fine over WireGuard, same as using regular network interfaces.

Yes! I definitely agree. I've used GRETAP for L2 over Wireguard in the past, but it was quite a while ago. GENEVE looks like the way to go these days

https://developers.redhat.com/blog/2018/10/22/introduction-t... vxlan and many others are here

Since WireGuard is Layer 3, what would is everyone's use case of doing Layer 2 on it? Or, what can it improve over existing solutions? I have tried to do the same for a bit while still learning networking, but ran into Layer 3 limitations.

One example usecase would be to try to tunnel something like BOOTP/DHCP/PXE/TFTP stack, which iirc is bit tricky with only L3 tunneling.

Yes, this is common among those who don't understand how DHCP Relay works

Many don't, and I suspect searching for "how to do on VPN" yields "turn on Layer 2 tunneling."

People who require layer 2 require either a protocol which is neither TCP nor UDP or they need devices in the same broadcast domain

Can one do multicast over wireguard?

Frustratingly enough, apparently not as I could never get it to work. It is pretty easy to set up a vxlan tunnel over wireguard if you absolutely need stuff like that though.

Oh hadn't thought about that, thanks. 'need' is a big word here but sometimes you can't change the client and server apps so, having support for the basic (although niche) features in the lower layers helps migrating smoothly.

Probably the most common use case is letting Avahi/Bonjour/etc. or DHCP work across a tunnel.

Bonjour is built on top of DNS. You don't need a layer 2 tunnel to make it work.

However, it normally does rely on multicast. Rather than trying to bridge broadcast domains (which is going to cause performance issues), a more efficient option is to setup an Avahi mDNS reflector on either end of the tunnel to rebroadcast mDNS packets.

See, for example: https://www.reddit.com/r/WireGuard/comments/g80bxf/comment/h...

Alternatively, there's also a Wide-Area Bonjour service that works over unicast and doesn't need any special packet forwarding, provided you run a Bonjour-aware DNS server:

http://www.dns-sd.org/serversetup.html

https://help.dyn.com/bonjour-and-dns-discovery/

(More generally, Layer 2 tunnels are best avoided unless you really need them for something arcane, like IPX or NetBIOS.)

You are technically correct (best kind of correct) however, in reality, I see folks using L2 tunnels to solve for bonjour etc all the time. Usually those without networking knowledge to solve the forwarding.

Yeah, you can do it the right way...or you can just tunnel layer 2 and forget about it. I see it done a fair bit for both Bonjour/Avahi and DHCP (why?).

The best way to perform something like this on Layer 2 is to use Shortest Path Bridging (SPB) based on IEEE 802.1Q-2018. However the Linux kernel does not yet fully supporting this feature natively although the standard has been out for quite sometime and already being supported by commercial network solutions and the popular Open vSwitch (OVS) [1].

[1] Ask HN: Project ideas for a Linux kernel module:

https://news.ycombinator.com/item?id=35785158

SPB uses MAC-in-MAC encapsulation which won't help you run over Wireguard. You need some flavor of Ethernet over IP like GRE, VXLAN, or GENEVE.

gretap.

But why run Wireguard+gretap when you could just run tap-mode OpenVPN?

Me too.

Reply on news.ycombinator.com