VPN all the everythings? (all hosts, VMs etc.)

cracauer@ · Tuesday at 12:00 PM

How do you deal with an increasing zoo of physical machines in random physical ethernets, VMs on many hosts and in many different network configs (NATed, bridged etc)? It's getting very annoying to remember which jumphost to use for what. And that only covers ssh, some things provide HTTP(S) services.

Once upon a time I thought I would properly IP route everything and use a routing demon to keep things current. Not just to get to the machines but also to up-clue myself about routing demons.

But with the ease of Wireguard now (screw OpenVPN and setting up a certification authority) I wonder. If I make a /etc/hosts or ~/.ssh/config entry for anything should I just hook that entity into the VPN, unconditionally?

The major catch I can think about is that "minor" devices such as routers, TV appliances, printers (shudder) are having between no and inconvenient VPN capability (does an Apple TV do wireguard?). And performance would be impacted, some of my CPUs do not fill 10 Gb/s with encryption.

Is anybody of you dealing with this below the level of having an actual networking group at work?

drhowarddrfine · Tuesday at 2:20 PM

Sometimes it seems like all the cool kids are doing it. Also Docker, Jails, VMs for everything whether you really need it or not.

Blue|Fusion · Tuesday at 2:23 PM

What does your many random physical networks look like?

I run Wireguard on OPNSense and have multiple devices connect to it, including a remote office network. All devices, including phones and laptops can connect and access the DNS on this VPN so no having to edit hosts files, just update DNS (and using DNSSEC for funsies).

I think it's silly to set up the VPN on each VM or jail. Setup proper routing.

cracauer@ · Tuesday at 2:27 PM

Blue|Fusion said:
What does your many random physical networks look like?

I have collection of computers in different locations.

Blue|Fusion · Tuesday at 7:39 PM

Run Wireguard on one host per physical location and route traffic through that host.

cracauer@ · Tuesday at 7:56 PM

Blue|Fusion said:
Run Wireguard on one host per physical location and route traffic through that host.

What about VMs splattered across other hosts in the same physical location that are not in bridge mode?

I get the principal argument. Get your address scheme and routing sorted. That's what IP is for.

mumu · 2025-05-28T01:09:34+0100

How about using Yggdrasil ? It gives you a static /64 for the PtP link and another static /64 for LAN/Bridge use. And you just peer with one another across different locations.

cracauer@ · 2025-05-28T01:28:00+0100

mumu said:
How about using Yggdrasil ? It gives you a static /64 for the PtP link and another static /64 for LAN/Bridge use. And you just peer with one another across different locations.

That looks interesting.

bakul · 2025-05-28T02:29:11+0100

May be what you want is a site to site vpn. Something like this? https://www.procustodibus.com/blog/2020/12/wireguard-site-to-site-config/

VladiBG · 2025-05-28T06:29:31+0100

Cisco IOS FlexVPN Data Sheet

Cisco IOS FlexVPN is standards-based encryption technology that helps large organizations to securely connect branch offices and remote users and provides significant cost savings compared to supporting multiple separate types of VPN solutions such as GRE, Crypto, and VTI-based solutions.

www.cisco.com