L2 VPN recommendation

Installing and Using OpenWrt
1

I currently have a setup with Ethersoft VPN which have been running for quite a few years for a bit of special usecase where I need a L2 tunnel. The PCs I run this on are getting quite old, and is also a bit unpractical in terms of space and heat.

There was a new release now of Softether VPN, but in terms of at least official releases, seems like the previous release was in 2023, so maybe also a bit worries about the development status of that project.

The security for traffic "in flight" is not that important - performance is. On the current setup I'm able to get 600-700 Mbps throughput over the VPN on my 750 Mbps line (the "server side" is 1Gbps. It would be "just internet traffic" that goes over this tunnel, but of course, the authentication security needs to be OK. Currently just running MD5 on the SoftEther VPN-setup to get the performance that I need for this (don't think there was an option to just completely run a tunnel).

Today the setup run with a old Core i7-2600 with two NICs on the "server side" and a i7-3770 on the "client side" here at home. The plan was to use two MTK MT7986 4-core A53 2GHz routers to replace this setup.

Illustration:

vpn.drawio
vpn.drawio235×645 5.86 KB

The goal here is that "The Device" will get a public IP-address (4&6) from "Source ONT", acting as the "The Device" was directly connected to this ONT. The "Open WRT site 2" device will be behind my ISPs FTTH-gateway.

So the VPN/tunnel setup needs to bridge an interface on the devices to the tunnel directly.

So: Recommended tunnel/VPN setup and thoughts about if the MT7986-devices will be powerfull enough to give equal performance as I have today?

2

Try WireGuard + GRETAP for L2 bridging. The MT7986 routers should likely handle 600-700 Mbps with WireGuard.

1 Like
3

Any configuration "tips and tricks" for Wireguard when it comes to maximizing performance in such case? As mentioned, encryption for "data in flight" is not that important here, as this would be something that otherwise would just be regular internet traffic.

4

I only used WireGuard vpn with adguardhome until now so can't guide you in detail but I can sure give you little insights. use kernal module kmod-wireguard instead of userspace. MT7986 cpu is quad-core so either enable Packet Steering or go with irqbalance to distribute interrupts across logical cpus. Also look into GRE + ESP-NULL it might perform better than WireGuard you've to test to ensure that. If you really don't care about encryption then enable flow offloading to further improve performance.

1 Like