Skip to content
Register

Poll: What's your preferred tunnel protocol for production

Networking by netop_mares 5 replies 165 views
netop_mares

Member OP

#1

GRE. IPIP. The young people with their cloud nonsense. They do not understand the beauty of simplicity.

Back in the days before WireGuard existed. Before the cloud nonsense took over. We ran production GRE tunnels between three continents without a single kernel module beyond the basics. No crypto overhead. No handshake dances. Just packets in packets. The routing table was the documentation.

The young people will defend their WireGuard. Their OpenVPN. Their IPSec nightmares with redundant feeds and certificate management. But when you need to tunnel a multicast stream across two ASNs without touching userland. GRE is still there. Waiting. Patient.

IPIP for IPv6 inside IPv4. That is all I will say...

uma

Member

99.99% or bust

#2

Wireguard for everything else though right

436 days. reboot is surrender.
center807

Member

#3

Enterprise-grade tunnel selection depends on your redundant feeds and N+1 path diversity requirements

For our core infrastructure we deploy IPSec with hardware offload on enterprise-grade edge nodes, though sales can discuss specific tunnel economics for your deployment

GRE lacks the enterprise-grade state management required for our redundant feeds, though I acknowledge niche multicast requirements

LichunLars

Member

1 #4 
Gre via Contabo.fra:  0.8ms overhead, 0.3ms jitter
wg via Contabo.fra:  1.4ms overhead, 0.2ms jitter
ipsec via Contabo.fra: 2.1ms overhead, 0.5ms jitter

route via Vultr.ams adds 12ms vs direct
route via OVHcloud.lon adds 8ms vs direct

GRE wins on raw latency. WireGuard wins on jitter. IPSec loses both.

Production means measuring, not guessing.

1ms or I don't want it
keremthel

Member

#5
netop_mares said:
When you need to tunnel a multicast stream across two ASNs without touching userland... GRE is still there... waiting... patient

WireGuard very stable but GRE still king for broadcast traffic

I use GRE for VXLAN underlay than switch to WireGuard for management plane

Server down in Izmir last week because I forget than tunnel order matter

Random Words for Emphasis: DO NOT MIX PROTOCOLS WITHOUT PLANNING

GuruDeutschlag

Member

#6

Yes the Poll Results show clearly that WireGuard https://www.wireguard.com dominates the Mindshare no but the old Guard knows the Truth about Encapsulation efficiency

For Production tunnels I recommend a Hybrid approach:

  • The DataPlane runs GRE for Performance reasons
  • The ControlPlane runs WireGuard for Security reasons

Yes this is the German engineering solution

Compoundwordsfusedtogether for maximum Precision

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft