[HN Gopher] Ask HN: Vxlan over WireGuard or WireGuard over Vxlan?
___________________________________________________________________
Ask HN: Vxlan over WireGuard or WireGuard over Vxlan?
When traversing a public network. Let's agree going recursive
(WireGuard inside VXLAN inside WireGuard) is a bad idea.
Author : mlhpdx
Score : 29 points
Date : 2026-01-13 19:53 UTC (3 hours ago)
| pjd7 wrote:
| Tell us why you think so at least.
| ronsor wrote:
| Reduced MTU chopping off your maximum packet size from all the
| extra headers and other overhead you're adding?
| DiabloD3 wrote:
| I mean, ultimately, thats how Google routes internally.
|
| IPSec-equivalent, VXLAN-equivalent, IPSec-equivalent.
|
| Prevents any compromised layer from knowing too much about the
| traffic.
| pixl97 wrote:
| Internal is fine because you control things like MTU so you
| don't have to worry about packet fragmentation/partial loss.
| als0 wrote:
| That seems like an awful amount of overhead for questionable
| gain.
| _bernd wrote:
| Links between, and in between data centers use so called
| jumbo frames with an mtu of over 9000. Not joking.
| tucnak wrote:
| What gave you that idea? Internally, Google uses GRE/GENEVE-
| like stuff but for reasons that have nothing to do with
| "preventing compromise" or whatever, but because they're
| carrying metadata (traces, latency budgets, billing ids.) That
| is to say, encapsulation is just transport. It's pretty much L3
| semantics all the way down... In fact, this is more or less the
| point: L2 is intractable at scale, as broadcast/multicast
| doesn't work. However, it's hard to find comparisons to
| anything you're familiar with at Google scale. They have a
| myriad of proprietary solutions and custom protocols for
| routing, even though it's all L3 semantics. To learn more:
|
| Andromeda https://research.google/pubs/andromeda-performance-
| isolation...
|
| Orion https://research.google/pubs/orion-googles-software-
| defined-...
| volkadav wrote:
| https://man.openbsd.org/vxlan.4#SECURITY seems unambiguous that
| it's intended for use in trusted environments (and all else being
| equal, I'd expect the openbsd man page authors to have reasonable
| opinions about network security), so it sounds like vxlan over
| ipsec/wg is probably the better route?
| wmf wrote:
| What problem is being solved here?
| mbreese wrote:
| What are you trying to do? Why are you trying to link networks
| across the public internet?
| justsomehnguy wrote:
| WG is L3 transport
|
| VXLAN is L2-like tranport over L3
|
| You can have EoIP over WG with any VLANs you like.
|
| You can have a VXLAN over plain IP, over EoIP, over WG, over
| IPSec. Only WG and IPSec (with not NULL sec) do providecany
| semblance ofvencryption in transit
|
| And mandatory X\Y problem.
| inetknght wrote:
| > _Let's agree going recursive (WireGuard inside VXLAN inside
| WireGuard) is a bad idea._
|
| But it's not necessarily a bad idea. It depends on the
| circumstances, even when traversing a public network.
| tucnak wrote:
| For traversing public networks, simply consider BGP over
| Wireguard. VXLAN is not worth it.
| ghxst wrote:
| I've used wireguard for a while, not sure why I never
| considered doing BGP over it, might make for a fun weekend
| project.
| tucnak wrote:
| BGP is vastly superior to any L2 make-believe trash you can
| imagine, and amazingly, it often has better hardware
| offloading support for forwarding and firewalls. For example,
| 100G switches (L3+) like MikroTik's CRS504 do not support
| IPv6 in hardware for VXLAN-encapsulated flows, but everything
| just works if you choose to go the BGP route.
|
| L2 is a total waste of time.
| uberduper wrote:
| What are your discovery mechanisms? I don't know what exists for
| automatic peer management with wg. If you're doing bgp evpn for
| vxlan endpoint discovery then I'd think WG over vxlan would be
| the easier to manage option.
| uberduper wrote:
| If you actually want to use vxlan ids to isolate l2 domains,
| like if you want multiple hypervisors separated by public
| networks to run groups of VMs on distinct l2 domains, then
| vxlan over WG seems like the way to go.
| kjuulh wrote:
| I use vxlan on top of wireguard in my hobby set up. Probably
| wouldn't recommend it for an actual production use-case. But that
| is more or less because of how my homelab is setup (Hetzner ->
| Home about 20ms latency roundtrip).
|
| I considered dropping my root wireguard and setting up just vxlan
| and flannel, but as I need NAT hole punching I kind of need the
| wireguard root so that is why i ended up with it.
|
| Going Wireguard inside the vxlan (flannel) in my case, would
| likely be overkill, unless I wanted my traffic between nodes
| between regions to be separated from other peers on the network,
| not sure where that would be useful. It is an easy way of
| blocking out a peer however, but that could just as well be
| solved on the "root" wireguard node.
|
| There might be some MTU things that would be messed up going
| nested wireguard networks.
| q3k wrote:
| Drop the VXLAN. There's almost never a good reason to stretch L2
| over a WAN. Just route stuff across.
| cjaackie wrote:
| This is the correct answer, routing between subnets is how it's
| suppose to work. I think there are some edge cases like DR
| where it seems like stretching L2 might sound like a good idea,
| but it practice it gets messy fast.
| formerly_proven wrote:
| VXLAN makes sense in the original application, which is to
| create _routable_ virtual LANs within data centers.
| dgl wrote:
| This.
|
| Instead you can create multiple Wireguard interfaces and use
| policy routing / ECMP / BGP / all the layer 3 tricks, that way
| you can achieve similar things to what vxlan could give you but
| at layer 3.
|
| There's a performance benefit to doing it this way too, in some
| testing I found the wireguard interface can be a bottleneck
| (there's various offload and multiple core support in Linux,
| but it still has some overhead).
| stevefan1999 wrote:
| Is there a WireGuard equivalent that does L2 instead of L3? Need
| this for a virtual mesh network for homelabbing. I have this
| exact setup, running VXLAN or GENEVE over WireGuard tunnel using
| KubeSpan from Talos Linux but I simply think having L2 access
| would make load balancer much easier
| kjuulh wrote:
| You can see my reply below:
| https://news.ycombinator.com/item?id=46609044 I believe our
| setups are pretty equivalent.
|
| I achieve load balancing by running native wireguard on a vps
| at hetzner, I've got a native wireguard mesh, I believe Talos
| can do the same, where the peers are manually set up, or via.
| tailscale etc. I then tell k3s that it should use the wireguard
| interface for vxlan, and boom my kubernetes mesh is now
| connected.
|
| flannel-iface: "wg0" # Talos might have something similar.
|
| I do use some node-labels and affinities to make sure the right
| pods end up in the right spot. For example the metallb annoucer
| always has to come from the hetzner node. As mentioned in my
| reply below, it takes about 20ms roundtrip back to my homelab,
| so my sites can take a bit of time to load, but it works pretty
| well otherwise, sort of similar to how cloudflare tunnels would
| work, except not as polished.
|
| My setup is here if it is of help
|
| https://git.kjuulh.io/kjuulh/clank-homelab-flux/src/branch/m...
| dietr1ch wrote:
| Is this your use case?
|
| https://docs.zerotier.com/bridging/
| viraptor wrote:
| ZeroTier does L2.
| H8crilA wrote:
| Not sure I understand, but why not Tailscale?
| sy26 wrote:
| In my case, Tailscale does not implement K8S CNI.
| notepad0x90 wrote:
| For site-so-site ovelay networks, use wireguard, vxlan should be
| inside of it, if at all. Your "network" is connected by
| wireguard, and it contains details like vxlan. Even within your
| network, when crossing security boundaries across untrusted
| channels, you can use wireguard.
|
| Others mentioned tailscale, it's cool and all but you don't
| always need it.
|
| As far as security, that's not even the consideration I had in
| mind, sure wireguard is secure, but that's not why you should
| have vxlan inside it, you should do so because that's the purpose
| of wireguard, to connect networks securely across security/trust
| boundaries. it doesn't even matter if the other protocol is also
| wireguard, or ssh or whatever, if it is an option, wireguard is
| always the outermost protocol, if not then ipsec,
| openvpn,softether,etc..whatever is your choice of secure overlay
| network protocol gets to be the tunnel protocol.
| iscoelho wrote:
| VXLAN over WireGuard is acceptable if you require a shared L2
| boundary.
|
| IPSec over VXLAN is what I recommend if you are doing 10G or
| above. There is a _much_ higher performance ceiling than
| WireGuard with IPSec via hardware firewalls. WireGuard is
| comparatively quite slow performance-wise. Noting Tailscale,
| since it has been mentioned, has comparatively _extremely_ slow
| performance.
| jrm4 wrote:
| Whenever I see threads like this, I think its related but I'll be
| honest, my networking understanding might be limited.
|
| I use Tinc as a daily driver (for personal things) and have yet
| to come up with a new equivalent, given that I probably should.
| Does Vxlan help here?
| iscoelho wrote:
| VXLAN is for L2 between campuses. It is commonly used in
| enterprise networks.
| denkmoon wrote:
| Not super related to the OP but since we're discussing network
| topologies; I've recently had an insane idea that nfs security
| sucks, nfs traversing firewalls sucks, kerberos really sucks, and
| that just wrapping it all in a wireguard pipe is way better.
|
| How deranged would it be to have every nfs client establish a
| wireguard tunnel and only have nfs traffic go through the tunnel?
| sciencesama wrote:
| vxlan inception is fun ! said no one ever !
___________________________________________________________________
(page generated 2026-01-13 23:00 UTC)