ALL ABOUT VPNs in OPNsense! Wireguard, OpenVPN, and IPSec Setup and Configuration 

It's on the list, I'll give it a vote for you

If its too short, include something that assigns local DNS hostnames dynamicly

Just like there are kangaroos in Austria

For your use case you might be able to save money doing vxlan with Mikrotik gear, if you can get away with 100M only (instead of Gigabit) they have an older model for $39 that can do VPNs and vxlan. Vxlan is pretty interoperable between vendors (at least unicast vxlan), so using those for remote sites and OPNsense for your core site could definitely be a thing.

Yeah, if only we used IPv6 where all addresses were public and we just needed to deal with security over the internet and not routing. This is what IPSec was originally designed for (Transport Mode).

For IPv6, we need a publicly routable address from the VPN server's allocation. The global internet will route all of those packets back to the VPN server, so if the client tries to send a packet from another location using the address in the VPN server's prefix, it will end up coming back to the VPN server and not wherever the phone is now. Many networks will also drop packets that don't come from their address ranges (spoofed source address).

I thought that both of the tunnel endpoints of a VPN connection have to be in the non-public routable address space like, for example, 192.168.10.10/24 (tunnel endpoint A) 192.168.10.11/24 (tunnel endpoint B) like in the IPv4 world scenario; I never imagined that the tunnel itself could be a public routable network. I suppose I have to learn IPv6 better :)@@apalrdsadventures

You can do it in IPv4 as well if you can afford the cost of the public IPs, it's just rarely done for that reason

I never encountered a WG or OpenVPN setup with the tunnel set to a public routable IP address(s); all the documentations say that it should be a private (like RFC 1918) address. @@apalrdsadventures

I assume their documentation is just indicating you shouldn't use an IP block you don't own (like a lot of ISPs use 6/8 for CGNAT for various reasons).

yes, you can add a policy route on LAN with a destination of 'not LAN net' and all clients on that net will route over the VPN. For Unbound you'd need to set the outgoing interface as the WG IF.

well Charon is mad about one of your address configs somewhere. Honestly debugging this issue is a nightmare.

@@apalrdsadventures alright, thanks will take a look at it. 👍👍👍

Same as with v4, our own address off by 1. Gateway field is normally used to resolve the MAC address of the next hop, but since Wireguard is a purely layer 3 protocol, there is no MAC. So we really just need *something*.

Are they gonna want to install anything else? In general, one side of the tunnel needs to be publicly accessible, and the closed side needs to be the one to initiate the connection. If neither side is open, then you need a relay. Tailscale runs relays for their network. Nebula is the option I use (it's significantly faster than Tailscale and doesn't have the same points of failure as Tailscale / Headscale). But in any case the user is installing something. If they really don't want to install anything, then a cloudflare tunnel might be the answer. Or you could run a relay VPS to tunnel traffic.

@@apalrdsadventures I struggle to setup a relay VPS to tunnel trafic. Will see if your great explanations give me enough info to setup such a relay! Keep em up, I really enjoy your videos!

@@apalrdsadventuresi don't think they'll install anything. I tried cloudflare tunnel but i wasn't able to playback a high res movie through it. It had a bitrate of about 50mbps. Then i tried relay using vps and it's working great so far. I can play that movie on it with just slight buffering sometimes. Tailscale was insane for me in this regard though. I could play that movie on three devices simultaneously and then some without any buffering whatsoever. Maybe the bottleneck is my cloud vps server. I opted for a free tier oracle cloud compute with gives 1gb ram and 1micro cpu with .49gbps network bandwidth

Tailscale will *try* to go direct using their NAT traversal protocol (which is part of why they can't use the Wireguard kernel module), so if it's able to do that it should be pretty fast (at the cost of the CPU usage of doing Wireguard in Go in userspace). VPS could also be limited by the CPU to encrypt/decrypt. I did find that my small VPS I used for testing could not handle a lot. You could also do a layer 4 proxy VPS + IPv6 home if you have v6 at home, then at least most cellular clients will get v6 and go direct.

@@apalrdsadventures Cool. I'll look into it. Thankyou for your valuable insights as always.

I think that describes IPSec very well