Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

IPsec, at least using IKEv2, also uses UDP in most deployments where you are not using IPsec directly without encapsulation (not that it makes a real difference). You may be confusing with OpenVPN, which can run over TCP.

In terms of speed, they are comparable. The great benefit of WireGuard is simplicity on Linux compared to the configuration nightmare that is StrongSWAN, but implementing IPsec/IKEv2 on OpenBSD using OpenIKEd is roughly comparable if you use Let's Encrypt certificates.

You can get really inexpensive GL.inet GL-MT300N-V2 "mango" boxes (about $20) that will provide transparent WireGuard or OpenVPN encryption for a device that doesn't support VPNs out of the box (ahem, a Smart TV or streaming box, to bypass geo restrictions). They don't support IPsec.

https://www.gl-inet.com/products/gl-mt300n-v2/



> OpenVPN, which can run over TCP

Can run. OpenVPN is UDP 1194 by default.

TCP-over-TCP is a well known tricky problem, so it's not something you want to run unless you have to.


I've been really happy with the GL.inet Slate, if anyone's looking for recommendations.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: