2

At my work, we build mobile networks from scratch for customers regularly. (Mobile Networks: think battery powered LTE router with wifi.) Since we build from scratch we can be vendor agnostic and research ways to keep costs down.

There's the saying that to a hammer every problem is a nail. (To a cisco guy, every product can be solved with a Cisco Solution.) I'm a strong believer in using the right tool for the job. Thus I decided to work on a mental model of the strengths/best usage scenarios of different secure/trustworthy VPN technologies. Then develop a working proficiency of each to add to my toolkit.

Here are noteworthy VPN types/protocols I'm reading up on. Note I've omitted VPN technologies I believe to be insecure or untrustworthy (NSA backdoors).

  • IKEv2/IPSec: (I read it's a better version of L2TP, that it can reestablish VPN connection, when the internet flaps, or switches between multiple networks, home, work, cellular.)
  • openVPN: Best for security. It's been audited. I'd like to know if it supports multicast. (I've read somewhere that it doesn't, but I also heard someone mentioned it can with a bridged mode.)
  • SoftEtherVPN: Creates a virtual hub that emulates a hardware switch, so can do multicast. It also has NAT Transversal features, which make it so you can have a VPN server behind a firewall that people can connect to without having to edit any firewall settings. (I think it's through a cloud relay).
  • GRE/IPSec VPN Tunnel: 2 Routers (cisco, pfsense, etc) can form a site to site link using this, which will allow multicast traffic. (Is this a site to site router only VPN protocol?)

Question: Of the aforementioned VPN tunnel protocols/types, which support multicast traffic inherently, transparently, or with minimal configuration.

Improve this question
1
  • Removed the off-topic request for recommendations.
    – Ron Maupin ♦
    Commented Oct 6, 2017 at 13:18

1 Answer 1

Reset to default
4
  • IKE is (in massively simplified terms/practically explained) just a way of establishing an IPSec VPN tunnel, and IPSec VPN tunnels don't inherently support multicast.
  • You can put a GRE tunnel inside of an IPSec VPN tunnel which will support multicast, and other non-IP Layer 3 protocols, like apple talk, IPX, and NHRP, which explains why DMVPN which uses NHRP(a non-IP layer 3 protocol) for its magic depends on GRE.
  • There's a relatively new thing called VTI(Virtual Tunnel Interfaces)'s, which are IPSec VPN tunnels that support multicast. It only supports IP traffic though, doesn't support NHRP so couldn't be used for DMVPN. Note about relatively new: at this point, most commercial vendors support VTI's (cisco, juniper, etc). I've heard that VTIs make live easier in multi-vendor environments. Note StrongSwan is a Linux IKEv2 VPN Server that has recently added support for VTIs (VyOS is a Linux Router Distro with StrongSwan build in, so opensource router can form Site-to-Site VPN Bridge with commercial routers). I read that as of June 2017 pfsense doesn't support VTIs, but the VTI code will be available in a future version of FreeBSD which pfsense is based on, so maybe 2 years from now a new version of pfsense might support it.
  • OpenVPN: doesn't inherently support multicast traffic. I did read however that it has a Bridged VPN mode where it can support multicast traffic by treating it as a broadcast, someone on a random forums post I found via google-fu shared a story about 1 user watching a large multicast stream, which was then broadcast to all other users on the VPN connection, it acted as a denial of service for the other OpenVPN clients, so I wouldn't recommend OpenVPN for multicast.
  • EtherSoft is VPN Server Software: it offers its own home-brewed VPN server service that involves a virtual switch, it simultaneously offers OpenVPN server service, and a L2TP server service. From what I can tell mobile clients can only connect to the L2TP server. (which from what I've read is insecure due to exploits) It treats multicast traffic as broadcast traffic, it's "virtual hubs" have a default security policy that limits broadcast traffic/starts dropping traffic beyond a limit, you can lift the limit, but then you'd have the same issue as OpenVPN Bridge VPN mode.
Improve this answer
3
  • Just wanted to add that VXLAN is a brand new virtualized networking technology. It seems to be purpose-built to accomplish Multicast over a VPN, because it extends layer 2 over layer 3 via an overlay network. Search "Logical Switch" on youtube or "VMware NSX - Logical Switch" (It's different from a virtual switch, A logical switch exists on an overlay network that is created via VXLAN providing MAC to MAC encapsulation of layer 2 traffic over layer 3, so you can do equal cost multipathing, cool stuff!)
    – neoakris
    Commented May 9, 2018 at 3:56
  • Wait nevermind VXLAN doesn't offer native encryption, so it's not a private network/it's just a virtual network, although apparently, you can combine it with MACsec to encrypt it. It can also be combined with IPsec a bit as well it seems. I hope they keep advancing this technology and make an encrypted by default version of it!
    – neoakris
    Commented May 9, 2018 at 4:35
  • Draft as of March 2018, Geneve: Generic Network Virtualization is an Network Virtualization, Layer 2 Overlay network, that seems to be for NSX-T (Open Source friendly fork of VMware's Network Virtualization), and it looks like it supports IPSec/the ability to have encrypted Network Virtualization. That's going to be huge when it becomes mainstream.
    – neoakris
    Commented Jun 19, 2018 at 17:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.