# Setup fastest Pseudowire-Protocol **URL:** \ **Category:** Installing and Using OpenWrt\ **Created:** [May 1, 2019, 4:30pm UTC](https://forum.openwrt.org/t/setup-fastest-pseudowire-protocol/36219 "2019-05-01T16:30:45Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![riodoro](https://forum.openwrt.org/letter_avatar/riodoro/32/5_5575768a8748004e209b776fc1b2916d.png) [@riodoro](https://forum.openwrt.org/u/riodoro)\ **Post date:** [May 1, 2019, 4:30pm UTC](https://forum.openwrt.org/t/setup-fastest-pseudowire-protocol/36219/1 "2019-05-01T16:30:46Z")
I want to connect some devices via L2 tunneling in our company IP network. The setup with OpenVPN TAP interface works so far. Tests with two OpenWRT instances in an ESXi 6.7 (Intel NUC I3) get roughly 300 MBit IPerf TCP performance. Not bad, but can that be improved? Encryption doesn't matter. Authentication would be fine. At least the VPN client hat a dynamic IP-adress. So the tunnel config should work with DNS-names. Please push me in the right direction. ---
**Author:** ![jeff](https://forum.openwrt.org/letter_avatar/jeff/32/5_5575768a8748004e209b776fc1b2916d.png) [@jeff](https://forum.openwrt.org/u/jeff)\ **Post date:** [May 1, 2019, 4:38pm UTC](https://forum.openwrt.org/t/setup-fastest-pseudowire-protocol/36219/2 "2019-05-01T16:38:56Z")
> [@riodoro](#): > > L2 tunneling [...] Encryption doesn't matter. GRE tunnel, layer 2 ("gretap") is perhaps the lightest weight from both CPU and bits -- but be careful with MTU as with any L2 tunnel that isn't actively fragmented by the endpoints. This is sort of a problem in general, as it is the encapsulated packets that get fragmented, so that the fragmentation-required messages go to the tunnel endpoint, not the sender of the encapsulated packet, as I remember the conundrum. One article on various flavors of tunnels under OpenWrt that I found helpful was [https://justus.berlin/2016/02/performance-of-tunneling-methods-in-openwrt/](https://justus.berlin/2016/02/performance-of-tunneling-methods-in-openwrt/) _Edit: Here's some earlier notes of mine on the MTU problem_ > [@\[SOLVED\] Gretap Tunnel and MTU-Size Problem](https://forum.openwrt.org/t/solved-gretap-tunnel-and-mtu-size-problem/14182/8): > > If you're routing the packets through the OpenWRT devices, then the ingress interface, running at Level 3, should be able to send back the ICMP message. Given that you've got the problem you describe, it sounds like they are bridging the networks at Level 2. This is a "common" problem with encapsulated Layer 2 bridging that I haven't seen a good solution for. I stopped looking once I was able to get the MTU on my 802.11 link up. Some interesting references include [http://blog.systemathic.ch/2…](http://blog.systemathic.ch/2015/03/05/openstack-mtu-pitfalls-with-tunnels/) ---
**Author:** ![riodoro](https://forum.openwrt.org/letter_avatar/riodoro/32/5_5575768a8748004e209b776fc1b2916d.png) [@riodoro](https://forum.openwrt.org/u/riodoro)\ **Post date:** [May 1, 2019, 5:36pm UTC](https://forum.openwrt.org/t/setup-fastest-pseudowire-protocol/36219/3 "2019-05-01T17:36:22Z")
Thanks so far. Does GRETAP works with DNS names for the remote peer? Then I will give it a try. ---
**Author:** ![jeff](https://forum.openwrt.org/letter_avatar/jeff/32/5_5575768a8748004e209b776fc1b2916d.png) [@jeff](https://forum.openwrt.org/u/jeff)\ **Post date:** [May 1, 2019, 5:38pm UTC](https://forum.openwrt.org/t/setup-fastest-pseudowire-protocol/36219/4 "2019-05-01T17:38:33Z")
I haven't tried DNS names in the UCI configuration, only hard-coded IP addresses. If not, one approach you could use `uci` commands to set the IP addresses after resolution of your choice. ---
**Author:** ![riodoro](https://forum.openwrt.org/letter_avatar/riodoro/32/5_5575768a8748004e209b776fc1b2916d.png) [@riodoro](https://forum.openwrt.org/u/riodoro)\ **Post date:** [May 1, 2019, 5:52pm UTC](https://forum.openwrt.org/t/setup-fastest-pseudowire-protocol/36219/5 "2019-05-01T17:52:49Z")
As a start I copied a config from here: [https://forum.archive.openwrt.org/viewtopic.php?id=68885](https://forum.archive.openwrt.org/viewtopic.php?id=68885) ``` config interface 'gretap_if' option ipaddr '10.3.3.11' option peeraddr '10.3.3.12' option network 'br0' option mtu '1500' option df '1' #Note: Commenting this out or using 'true' have the same effect. option proto 'gretap' ``` This gives me _Unsupported protocol type._ [Install protocol extensions...](https://10.3.3.11/cgi-bin/luci/admin/system/packages?query=luci-proto&display=available) in the gui (network/interfaces) But no luci-proto-gre available 🙄 Any hints for installing and configuring gretap? ---
**Author:** ![mikma](https://forum.openwrt.org/letter_avatar/mikma/32/5_5575768a8748004e209b776fc1b2916d.png) [@mikma](https://forum.openwrt.org/u/mikma)\ **Post date:** [May 1, 2019, 5:53pm UTC](https://forum.openwrt.org/t/setup-fastest-pseudowire-protocol/36219/6 "2019-05-01T17:53:51Z")
You should be able to use DNS names when configuring GRETAP in UCI/luci, but I don't think it will do anything if the DNS record is changed. You could use IPsec in transport mode with AH if you want to authenticate the GRETAP packets but don't want to use encryption. I think it's supported by strongswan. ---
**Author:** ![jeff](https://forum.openwrt.org/letter_avatar/jeff/32/5_5575768a8748004e209b776fc1b2916d.png) [@jeff](https://forum.openwrt.org/u/jeff)\ **Post date:** [May 1, 2019, 5:54pm UTC](https://forum.openwrt.org/t/setup-fastest-pseudowire-protocol/36219/7 "2019-05-01T17:54:45Z")
You probably need the `gre` package installed if the tunnel isn't up through "manual" testing. Yes, LuCI doesn't understand how to render a GRE tunnel, at least last I checked. _Edit: From my config from late last year over a wireless link (so more than 1500 MTU available):_ ``` config interface 'gt99' option proto 'gretap' option mtu 1558 option ipaddr 'x.x.x.95' option peeraddr 'x.x.x.99' option delegate '0' ``` Be careful with interface-name lengths. There is a 15-character limit in the kernel and OpenWrt prepends `gre4t-` as I recall. `gre4t-gt99.1234` is 15 characters (I was tunneling multiple VLANs over a single GRE tunnel) I recall it not working properly if I didn't specify "my" address. ---
**Author:** ![riodoro](https://forum.openwrt.org/letter_avatar/riodoro/32/5_5575768a8748004e209b776fc1b2916d.png) [@riodoro](https://forum.openwrt.org/u/riodoro)\ **Post date:** [May 1, 2019, 6:10pm UTC](https://forum.openwrt.org/t/setup-fastest-pseudowire-protocol/36219/8 "2019-05-01T18:10:15Z")
Sorry, I forgot to mention that gre kmod-gre kmod-gre6 is installed. > [@jeff](#): > > Yes, LuCI doesn't understand how to render a GRE tunnel, at least last I checked. Ok, then I'll try it on cli. > [@mikma](#): > > I think it's supported by strongswan. Does strongswan supports l2-tunnels? ---
**Author:** ![mikma](https://forum.openwrt.org/letter_avatar/mikma/32/5_5575768a8748004e209b776fc1b2916d.png) [@mikma](https://forum.openwrt.org/u/mikma)\ **Post date:** [May 1, 2019, 8:29pm UTC](https://forum.openwrt.org/t/setup-fastest-pseudowire-protocol/36219/9 "2019-05-01T20:29:34Z")
> [@riodoro](#): > > Does strongswan supports l2-tunnels? Not unless you use it together with for example VXLAN or GRETAP (or L2TP?). ---
**Author:** ![riodoro](https://forum.openwrt.org/letter_avatar/riodoro/32/5_5575768a8748004e209b776fc1b2916d.png) [@riodoro](https://forum.openwrt.org/u/riodoro)\ **Post date:** [May 2, 2019, 11:57am UTC](https://forum.openwrt.org/t/setup-fastest-pseudowire-protocol/36219/10 "2019-05-02T11:57:33Z")
I've got GRETAP up and running with credits to > **[OpenWRT Transparent Network Bridging Using GRE](https://blog.davelindon.me/openwrt-transparent-network-bridging-using-gre/)** > > Summary > This will create a completley insecure transparent network bridge between two > OpenWRT devices using GRE. > > Please note that this will completely bridge the two networks (be careful if > you have DHCP running in both sites) > > For the purpose of... My config is ``` Router1 ip link add gretap1 type gretap local 10.0.1.11 remote 10.0.1.12 ip link set gretap1 up brctl addif br-lan2 gretap1 Router2 ip link add gretap1 type gretap local 10.0.1.12 remote 10.0.1.11 ip link set gretap1 up brctl addif br-lan2 gretap1 ``` I tried a similar configuration in /etc/config/network without success. Is there a way to make this config persistent? ---
**Author:** ![jeff](https://forum.openwrt.org/letter_avatar/jeff/32/5_5575768a8748004e209b776fc1b2916d.png) [@jeff](https://forum.openwrt.org/u/jeff)\ **Post date:** [May 2, 2019, 12:28pm UTC](https://forum.openwrt.org/t/setup-fastest-pseudowire-protocol/36219/11 "2019-05-02T12:28:51Z")
> [@riodoro](#): > > Is there a way to make this config persistent? See my notes on config above -- worked quite well on `master` of last year with multiple tunnels between multiple routers carrying VLANs on the sub-interfaces of the GRE interfaces. For Ethernet or similar links, you probably need to remove the `mtu` line. Interface names that are too long after the prefix was added will fail silently. ---
**Author:** ![riodoro](https://forum.openwrt.org/letter_avatar/riodoro/32/5_5575768a8748004e209b776fc1b2916d.png) [@riodoro](https://forum.openwrt.org/u/riodoro)\ **Post date:** [May 2, 2019, 1:53pm UTC](https://forum.openwrt.org/t/setup-fastest-pseudowire-protocol/36219/12 "2019-05-02T13:53:19Z")
Thanks @jeff, just fixed my problems when trying to bridge eth2 to gretap: ``` config interface 'lan2' option type 'bridge' ; only for testing option proto 'dhcp' option ifname 'eth2 gre4t-gt' config interface 'gt' option type 'bridge' option proto 'gretap' option ipaddr '10.0.1.11' option peeraddr '10.0.1.12' option delegate '0' ``` IPerf speed is about 4 GBit/s (inside the ESXi host). ---
**Author:** ![system](https://forum.openwrt.org/uploads/default/original/3X/7/4/740520c71f00039bbf001045c682f0ecb25e905a.png) [@system](https://forum.openwrt.org/u/system)\ **Post date:** [May 12, 2019, 1:53pm UTC](https://forum.openwrt.org/t/setup-fastest-pseudowire-protocol/36219/13 "2019-05-12T13:53:23Z")
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.