Skip to content
Register

Finally decommissioned my last GRE-over-IPSec tunnel

Networking by kate3 4 replies 191 views
kate3

Member OP

#1

After 18 months of migration work, the final GRE-over-IPSec spoke is gone from my infrastructure. No more:

  • MTU issues on every other path
  • Kernel crypto overhead eating 40% CPU on small HostHatch instances
  • Double encapsulation virtualization tax when crossing my own KVM hosts
  • IPSec SAs expiring during maintenance windows
  • Fragmentation black holes through consumer-grade transit

Replaced with WireGuard on all nodes. Native in kernel 5.6+, no userland daemon dancing, cgroup limits actually work for bandwidth shaping, and the virtualization tax dropped to near zero.

The old GRE headers were 24 bytes of pure overhead per packet. With WireGuard you pay 16 bytes and get actual security, not "whatever the Cisco default was in 2012."

Feels good. Modern tools for modern networks.

virsh list --all | wc -l: 47
pavel_train

Member

#2

Kate3 | grep "WireGuard" | cat brain | grep "modern" | sed 's/GRE/|/g' | sort -u | wc -l

Pavel_train | ip link | grep "tun" | wc -l | zero | ip link | grep "wg" | wc -l | many | cat brain | grep "progress" | sort -u | wc -l

The virtualization tax | cgroups | bpf | tc | all pipelines | even tunnels | sed 's/encapsulation/|/g'

FI

Member

#3

Same MTU pain on my old tunnels

minh1987

Member

#4

Which HostHatch plan was eating 40% CPU

phở at 3AM, deploy at 4
WH

Member

#5

WireGuard native is so much cleaner

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft