Exploring SD-WAN with Netmaker, Tailscale, and Zerotier reddit / selfhosted ---------------------------------------------------------------------- High_Sleep3694 · 2023-11-07 18:17 I'm eager to delve into the world of SD-WAN and looking for cost- effective ways to get started. My understanding is that SD-WAN requires SD-WAN appliances and SD-WAN VPNs on the provider's side. Does anyone have any experience with this? Additionally, I'm curious about the potential of using solutions like [Netmaker](https://www.netmaker.io/), [Tailscale](https://github.com/Tailscale/), or [Zerotier ](https://github.com/Zerotier/)in this context. Any insights would be greatly appreciated. ---------------------------------------------------------------------- espero · 2023-11-07 19:36 Tailscale works really great ---------------------------------------------------------------------- nerdyviking88 · 2023-11-07 19:44 SD-Wan requires some kind of intermediary to run, be it a client on machiens, a hardware device at each location, or what. You can run it in multiple ways. What is your end goal? ---------------------------------------------------------------------- broken_cogwheel · 2023-11-07 19:45 Zerotier is extremely easy to start. It has a lot of capibilities under the hood but the basic functionality that comes out of the box is quite handy. I use zerotier to access my homelab. ---------------------------------------------------------------------- acdcfanbill · 2023-11-07 20:12 Yeah, I've been using tailscale with my own headscale node on an AWS vm for several months and it basically has had no issues for me. ---------------------------------------------------------------------- chaplin2 · 2023-11-07 20:36 How much work is it to self host headscale? ---------------------------------------------------------------------- acdcfanbill · 2023-11-07 20:43 It was a small pain in the but getting everything set up because it's all cli and there's isn't the fancy UI tailescale the company has. But once it was set up and i had all the devices enrolled and the exit node set up, it continues to work great and I never think about it, just switch it on sometimes if i need something from my home network. as far as the hosting, i just set up the smallest, cheapest aws vm i can get, gave it a static ip, registered a hostname/domain to use for it (it needs lets encrypt certs), got certs, and then started up the headscale service. I went thru the steps in their wiki (https://headscale.net/running-headscale-linux/#installation) combined with talescale's wiki and i think the first time i had an issue or something, and then i ran thru it a second time and got everything working correctly. Took a few hours total, but i'm already pretty familiar with the command line, systemd services, etc. ---------------------------------------------------------------------- Reverent · 2023-11-07 20:50 All of those are zero trust SDN solutions, not SD-WAN. SDN (software defined network) is a full solution including network overlay, site to site connectivity via encrypted tunnels, and network routing based on identity and policy. SD-WAN just refers to the site to site connectivity component (and for mesh solutions like tailscale doesn't actually have to exist). That said, tailscale is the bees knees. ---------------------------------------------------------------------- madroots2 · 2023-11-07 21:08 Vouching for Tailscale. Amazing service and generous free tier with a headscale its just no brainer. Zerotier works too but I just dont like the company and their overengineering and their Java crap. ---------------------------------------------------------------------- madroots2 · 2023-11-07 21:09 Vouching for Tailscale. Amazing service and generous free tier with a headscale its just no brainer. Zerotier works too but I just dont like the company and their overengineering and their Java crap. ---------------------------------------------------------------------- mpopgun · 2023-11-07 21:26 Some companies host their own sdwan "concentrators". They're usually called gateways in the sdwan world...basically a fancy vpn concentrator. So you don't need the isp to provide that. Fortinet has all the sdwan features built into their Fortigate firewalls, no additional licensing needed. Look into ADVPN, auto discover vpn. This would be a self hosted solution. Velocloud/vmware/broadcom has public gateways you can use, just need to buy their sdwan appliance and subscribe to their service. Velo has a hubvpn feature that allows an on site appliance act as a gateway to do a self hosted design. The magic of sdwan happens between the gateway and the appliance on site. All of the telemetry about circuit performance is measured between those two points. Then features like forward error correction and dynamic multipath optimization are used to ensure each type of traffic is placed in the circuit best suited to it. Velo does per packet routing. I'm told forti can do per packet but I have not seen this. By default they do per session. Nat happens at the gateway/hub vpn site, that's how they can switch between wan circuits and not drop sessions. If your doing this for a business, velo hub vpn is a good balance between easy and flexibility. Forti is very flexible but also a steep learning curve. But if you need firewalls, forti is a firewall with sdwan features at no extra cost. Meraki is also supposed to be very easy to setup, but I'm 99% sure you must use their cloud controller and dashboard. Much of the sdwan advantage comes from having two circuits too, having only one circuit prevents any traffic steering or forward error correction, so your quality is service is just the same as using a vpn. ---------------------------------------------------------------------- trisanachandler · 2023-11-07 23:17 Don't forget about cloudflare ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-07 23:33 Thats everything but not a sd-wan. Something like catonetworks.com is a sd-wan ---------------------------------------------------------------------- opensrcdev · 2023-11-08 01:18 With ZeroTier, you just install it on your nodes, and have instant connectivity. I've been using it for years, and I literally forget it's even there. It "just works." ---------------------------------------------------------------------- Yazzy_Boo · 2023-11-08 02:22 Netmaker or Wireguard is prob the place to start. For routers you will prob be best served to use OPNSense, OpenWRT or DD-WRT as they have varying levels of support. Netclients can also be configured to bridge their Netmaker/local networks. ---------------------------------------------------------------------- ziggie216 · 2023-11-08 02:29 How much did this cost you to host this on AWS? Is bandwidth pay per mb usage? ---------------------------------------------------------------------- Vlinux · 2023-11-08 03:28 I've been using Zerotier for about 8 years now. I install it on all my servers and it easily bridges remote networks, local and cloud servers, and desktops/laptops. Simple and fast. ---------------------------------------------------------------------- acdcfanbill · 2023-11-08 04:02 I never hit whatever the minimum rate is because my exit node is at my house. it's about 8 bucks a month but i think that's more than just my headscale setup. It's 2 vms, a domain, and maybe something else i forgot and i'd have to check on my bill to remember. I assume with sparing usage you could probably have an exit node on your headscale vm and still not have to worry about bandwidth charges. ---------------------------------------------------------------------- HoustonBOFH · 2023-11-08 04:40 SD-WAN is a marketing term and it can mean a lot of different things. So lets drop that for a moment. What problem are you trying to solve? What places do you want to connect? That will determine the technology you want to use. ---------------------------------------------------------------------- ProffesionalAds · 2023-11-08 14:45 Netmaker is a bit easier to get started for a newbie to SD-WAN ---------------------------------------------------------------------- ProffesionalAds · 2023-11-10 15:51 Netmaker is faster though, I think Tailscale's use of userspace makes it abit slow ---------------------------------------------------------------------- SpambotSwatter · 2023-11-11 23:54 /u/High_Sleep3694 is a click-farming spam bot. Please downvote its post and click the `report` button, selecting `Spam` then `Link farming`. With enough reports, the reddit algorithm will suspend this spammer.