Hacker News Reader

Comment by MobiusHorizons | Hacker News Reader

These days I would expect to reach for wiregard for p2p vpn solutions. Are there any advantages to using IPsec instead? Is this for connecting to some existing IPsec infrastructure?

View on HN

I'm not sure if it applies to these particular tunnels as there are multiple methods to build tunnels using IPSec, but point-to-point IPSec tunnels often have lower byte overhead as you don't necessarily need to encapsulate in another type of packet, whereas the minimum Wireguard overhead is already significant. The biggest source of headaches with VPNs is the small margin between maximum and minimum effective IPv4 packet size, and when you cross these margins packets tend to get silently dropped.

Also, as this tunnel interface still integrates with OpenBSD isakmpd (IKEv1) and iked (IKEv2) daemons, you can use certificate-based authentication without installing some bespoke, proprietary agent for key management.

Thanks

Lower byte overhead, right, damn this should be obvious already to those of us who work with BSD. Thank you.

Read through the post, it is explained there:

> The reason I started on this was to better interoperate with "site-to-site" vpns, in particular AWS Site-to-Site VPNs, and the Auto-Discovery VPN (ADVPN) stuff on fortinet fortigate appliances. Both of these negotiate IPsec tunnels that can carry any traffic at the IPsec level, but use BGP and routes to direct traffic into those tunnels.

Ack, I read that part, but it still wasn’t clear that wireguard wouldn’t have been a good solution (likely due to ignorance of either use case)

Reply on news.ycombinator.com