WireGuard Gives Linux a Faster, More Secure VPN

Re:WireGuard Gives Linux a Faster, More Secure VPN by linsomniac on Monday March 02, 2020 @04:52PM (#22469446)

Pretty much every time I do a migration from one data center or office migration I set up an OpenVPN that bridges the network segments at the two locations. It makes the move so much easier.

Once set up, I can shut down a machine at one location, move it, bring it back up, and it's back in business. There are situations where we might want to migrate to new machines during the move, which this makes no harder. But for many things it makes them easier.

For example, the last move went something like this: Set up the VPN+bridge. Move half the application servers. Set up new firewall/load balancer since we were replacing the old ones. Test the new fw/lb. Physically move the primary database server during a maintenance window and switch over to the new fw/lb. If there were problems, just switch back to the old one via DNS record changes (TTL was lowered weeks earlier). Move the remaining app servers. During the bridging setup, the LBs preferred the local app servers.

[ Parent | on HN ]

Re:WireGuard Gives Linux a Faster, More Secure VPN by Rapzid on Tuesday March 03, 2020 @09:06PM (#22480614)

It's been a while since I've worked with linux networking. I would have thought it would give you a VIF in some form or fashion that you could attach to a bridge. Is that not the case?

EDIT: *and proxy arp requests through

[ Parent | on HN ]

Re:WireGuard Gives Linux a Faster, More Secure VPN by linsomniac on Tuesday March 03, 2020 @10:16PM (#22480916)

By "it" do you mean Wireguard? I haven't used it, but you need a special type of virtual interface for bridging, a tap device can do it, a tun cannot. From some searches, Wireguard doesn't support operating on a bridge. OpenVPN, which is what I've used in the past, supports both tun and tap interfaces.

[ Parent | on HN ]