Re:Identity management for WireGuard networks
by generalizations on Wednesday October 19, 2022 @03:43PM
(#33267012)
> I wouldn't call it a custom hack to open an L2 tunnel over wireguard
There's too many headers that are too big. If you do a simple L2 tunnel, you have three options: jumbo frames, packet fragmentation, or custom hacks. None are great.
> Linux has built in L2 tunneling, sans encryption
IIRC, because the extra header for the encryption layer pushes the MTU over 1500.
Re:Identity management for WireGuard networks
by jacob019 on Wednesday October 19, 2022 @05:55PM
(#33268361)
Regardless of the technology, there is no way to put an 1518 byte Ethernet frame in a 1500 byte IP packet. You're going to have to fragment or live with reduced MTU inside the tunnel.
There's too many headers that are too big. If you do a simple L2 tunnel, you have three options: jumbo frames, packet fragmentation, or custom hacks. None are great.
> Linux has built in L2 tunneling, sans encryption
IIRC, because the extra header for the encryption layer pushes the MTU over 1500.