OpenBSD SEC(4) for Route Based IPSec VPNs | Hacker News Reader

OpenBSD SEC(4) for Route Based IPSec VPNs

undeadly.org

20 pointszdw8 comments

This looks cool!

Bit surprised that even though there seems to be interest in IPSec in OpenBSD nobody ever finished sasyncd. Which is used to create an IPSec failover setup between OpenBSD hosts. However sasyncd was never fully finished. It can't sync existing SA states. Meaning the first failover works, but the second time you failover you are missing SA's.

I have been using OpenBSD's Wireguard implementation for a while now. I see this and think "why would anyone use IPsec when there is Wireguard"? Maybe I am missing something, am gonna dig into this.

These days I would expect to reach for wiregard for p2p vpn solutions. Are there any advantages to using IPsec instead? Is this for connecting to some existing IPsec infrastructure?

Read through the post, it is explained there:

> The reason I started on this was to better interoperate with "site-to-site" vpns, in particular AWS Site-to-Site VPNs, and the Auto-Discovery VPN (ADVPN) stuff on fortinet fortigate appliances. Both of these negotiate IPsec tunnels that can carry any traffic at the IPsec level, but use BGP and routes to direct traffic into those tunnels.

Ack, I read that part, but it still wasn’t clear that wireguard wouldn’t have been a good solution (likely due to ignorance of either use case)

I'm not sure if it applies to these particular tunnels as there are multiple methods to build tunnels using IPSec, but point-to-point IPSec tunnels often have lower byte overhead as you don't necessarily need to encapsulate in another type of packet, whereas the minimum Wireguard overhead is already significant. The biggest source of headaches with VPNs is the small margin between maximum and minimum effective IPv4 packet size, and when you cross these margins packets tend to get silently dropped.

Also, as this tunnel interface still integrates with OpenBSD isakmpd (IKEv1) and iked (IKEv2) daemons, you can use certificate-based authentication without installing some bespoke, proprietary agent for key management.

Thanks

Lower byte overhead, right, damn this should be obvious already to those of us who work with BSD. Thank you.

Reply on news.ycombinator.com