Getting IPv6 route advertisements to work over WG

[Riccardo Paolo Bestetti]

I laughed in my head. :)

For what my two cents are worth, L2 WireGuard would have its (limited) use cases, but nothing beats having a simple and effective mono-purpose protocol like we do now. Everything else can be solved with OpenVPN or appropriate SDN techniques running on top of WG.

<ot>
And about that, I think that out-of-band comms support would be a very nice addition to the protocol. The tunnel could be initially established with no tunnel addresses, but it could provide the ability for setup scripts on each side to talk to each other to set up routing, addresses, firewalls, etc. This would allow more complex setups, but would avoid adding all the complexity/edge cases/etc. to WireGuard.
</ot>

Regards,
Riccardo

-----Original Message-----
From: WireGuard <wireguard-bounces at lists.zx2c4.com> On Behalf Of Roman Mamedov
Sent: lunedì 27 agosto 2018 15:53
To: netravnen at gmail.com
Cc: wireguard at lists.zx2c4.com
Subject: Re: Getting IPv6 route advertisements to work over WG

On Mon, 27 Aug 2018 15:32:49 +0200
netravnen at gmail.com wrote:

> When using multicast over WireGuard, would it not be more viable to 
> use an extra encapsulation layer to run multicast inside of?
> 
> I am specifically thinking of running either GRE or L2TPv3 over wgX.

I know people run VXLAN or other L2 tunneling protocols over WG. I suppose you can call that "viable" as in "it can work", but it's a horrible workaround for the lack of better solution, nothing more. For instance the overhead reaches comical levels:

  TCP
    over IP
      over Ethernet
        over VXLAN
          over UDP
            over IP
              over Wireguard
                over UDP
                  over IP 
                    over Ethernet

Add more fun if you use something else such as PPPoE for Internet connection, or a 6in4 tunnel for IPv6. At some point the whole thing will break down because you can no longer fit 1280-byte packets into innermost MTU, and IPv6 won't work.

Not to mention the additional management overhead of an inner L2 tunneling layer.

Now, if WG would support L2 mode natively (say, with AllowedMACs instead of
AllowedIPs) it would be awesome and that would solve a great number of other issues as well. But since that appears to be unlikely, and since RAs already mostly work, with just one piece missing, I hope at least that piece gets dropped in at some point, and that we aren't stuck at least for this use case with "more viable" tunneling workarounds forever.

--
With respect,
Roman
_______________________________________________
WireGuard mailing list
WireGuard at lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard