Intro
This Q focuses on hardware recommendations, though about 10-20% of it involves the actual software implementation required. Given the intertwined nature of hardware and software in this scenario, it’s challenging to separate them. I appreciate your insights.
Scenario
Here’s a slightly abstract scenario: I have a 3 Gig fiber connection at home. I also have a highly-mobile client who needs access to some private resources via VPN, but is only able to do so when connected through home’s IP address. The goal is to link the client to home seamlessly, with absolutely minimal possible overhead, enabling the client to connect to the VPN from their laptop as if they were physically at home.
My initial thought: use two OpenWRT-compatible routers. One powerful router at home and a portable, USB-stick-sized router for the client. The client router should be able to connect to any nearby Wi-Fi network and establish a minimal overhead tunnel, so the client’s machine uses home’s public IP.
Potential Solutions
Given the above requirements, typical solutions like OpenVPN, Wireguard, or IPsec are not suitable due to the overheads, however minimal. Since the client’s device will already be using a VPN, reducing overhead is crucial. My proposed approach:
-
Use two routers that support GRE or IP-in-IP tunnels, with a preference for IP-in-IP since GRE is more frequently blocked by firewalls. This would be the optimal scenario, but NAT can be problematic, even with IP-in-IP, making it unreliable on some public networks.
-
If the above doesn’t work, fall back to a simple, NAT-friendly protocol, such as a UDP (or, as a last resort, TCP) tunnel using tools like
vtun
,udp2raw
, orudptunnel
. -
Another option is to use plain L2TP (without IPsec) via something like
xl2tpd
.
Questions
Which routers would you recommend that meet these criteria? The budget is $1,000 for both the home and portable client routers, with a maximum of $2,000 if it’s truly justified. I need support for IP-in-IP and generic UDP/L2TP (without IPsec), ideally in kernel mode. Hardware offloading/acceleration for any of these protocols would be a big bonus, though I’m unsure if that’s available.
I should note that the hardware should be able to max out the 3G fiber and handle and ideally handle home clients over WiFi as well (if this is not possible, I can find a separate router). Thank you.