<story><title>Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT</title><url>https://im.salty.fish/index.php/archives/linux-networking-shallow-dive.html</url></story><parent_chain><item><author>generalizations</author><text>If you have a write up of how you managed to get layer 2 working inside wireguard, I&amp;#x27;d love to read it.</text></item><item><author>systems_glitch</author><text>We recently switched a bunch of stuff from OpenVPN to Wireguard. A number of the links were OpenVPN layer 2 tunnels to pass, of all things, Novell Netware running on IPX (the particular situation precludes switching to TCP&amp;#x2F;IP for those customers). Now, layer 2 tunneling is being performed using RFC 3378 EtherIP, and it&amp;#x27;s much more performant, not to mention easier to manage.&lt;p&gt;Old and new systems are running OpenBSD.</text></item></parent_chain><comment><author>systems_glitch</author><text>I basically just followed the OpenBSD documentation! One of the big advantages of OpenBSD is that pretty much everything you need to know is contained in the manpages.&lt;p&gt;As I&amp;#x27;d said above, we ended up using RFC 3378 EtherIP to link the two layer 2 broadcast domains across the Wireguard tunnel. OpenBSD supports this with the etherip interface. You end up creating a bridge with the etherip interface and whatever physical Ethernet interfaces you want to bridge, on either side of the Wireguard tunnel.&lt;p&gt;I also tried VXLAN but did not have good results. I&amp;#x27;m not entirely sure it wasn&amp;#x27;t a problem with my configuration. Traffic often went one-directional, where broadcast packets from Site A made it to Site B, but they did not come from Site B to Site A. EtherIP worked right off, so I didn&amp;#x27;t investigate further.</text></comment>
<story><title>Linux Networking Shallow Dive: WireGuard, Routing, TCP/IP and NAT</title><url>https://im.salty.fish/index.php/archives/linux-networking-shallow-dive.html</url></story><parent_chain><item><author>generalizations</author><text>If you have a write up of how you managed to get layer 2 working inside wireguard, I&amp;#x27;d love to read it.</text></item><item><author>systems_glitch</author><text>We recently switched a bunch of stuff from OpenVPN to Wireguard. A number of the links were OpenVPN layer 2 tunnels to pass, of all things, Novell Netware running on IPX (the particular situation precludes switching to TCP&amp;#x2F;IP for those customers). Now, layer 2 tunneling is being performed using RFC 3378 EtherIP, and it&amp;#x27;s much more performant, not to mention easier to manage.&lt;p&gt;Old and new systems are running OpenBSD.</text></item></parent_chain><comment><author>usui</author><text>Since WireGuard is Layer 3, what would is everyone&amp;#x27;s use case of doing Layer 2 on it? Or, what can it improve over existing solutions? I have tried to do the same for a bit while still learning networking, but ran into Layer 3 limitations.</text></comment>