Identity management for WireGuard networks

Re:Identity management for WireGuard networks by jacob019 on Wednesday October 19, 2022 @12:32PM (#33264580)

Wireguard is L3 encryption. It's great because it's simple. Linus called it poetry. If you are bridging L2 over the Internet, then one way or another you're stuffing Ethernet frames into IP packets. Linux has built in L2 tunneling, sans encryption. I wouldn't call it a custom hack to open an L2 tunnel over wireguard. It's a one liner on each end. A configuration utility like wg-quick could be made to set it up for you. I wouldn't want wireguard to become OpenVPN.

[ Parent | on HN ]

Re:Identity management for WireGuard networks by generalizations on Wednesday October 19, 2022 @03:43PM (#33267012)

> I wouldn't call it a custom hack to open an L2 tunnel over wireguard

There's too many headers that are too big. If you do a simple L2 tunnel, you have three options: jumbo frames, packet fragmentation, or custom hacks. None are great.

> Linux has built in L2 tunneling, sans encryption

IIRC, because the extra header for the encryption layer pushes the MTU over 1500.

[ Parent | on HN ]

Re:Identity management for WireGuard networks by jacob019 on Wednesday October 19, 2022 @05:55PM (#33268361)

Regardless of the technology, there is no way to put an 1518 byte Ethernet frame in a 1500 byte IP packet. You're going to have to fragment or live with reduced MTU inside the tunnel.

[ Parent | on HN ]