Can wireguard replace DMVPN?


#1

I compared these two items and found that the wireguard configuration is simpler, but DMVPN is more cumbersome. Many people recommend me to use DMVPN, but I don’t know where the advantages of DMVPN are? Because I don’t know much about DMVPN, I would like to ask you. Thank you!


#2

Hi Toadzhou!

There are two different aproaches behind DMVPN and Wireguard, wireguard is quite hardwired at it’s working (at least for the moment) you need to configure all the neighbors you want to talk to and all ip-nets they provide. this is in wireguard called cryptokey routing. you are routing packets inside the tunnel based on the Layer3 destination. because of that you cant have a L3 routing protocol like ospf to manage the routing, because then ospf will quite possible be out of sync with the wireguard configuration.

DMVPN on the other hand uses a protocol names NHRP (next-hop routing protocol) to discover neighbors in a L2 GRE tunnel. All neighbors will register at the NHRP service and no configuration about the clients/endpoints need to be statically configured. DMVPN also uses the L3 nexthop/L2 mac address in the packet to route traffic and thous is independent of the ip routing table and where address the packet is destined for. This makes is possible to use L3 routing protocols as ospf to do routing in the tunnel. DMVPN could also hundreds or thousands of nodes in a vpn without problems if you scale it and configure it correctly.

actually… it is possible to run ospf inside a wireguard tunnel… but only if you have only one neighbor pr. tunnel.

That’s a small summary of the two protocols, but it comes down to your scale and requirements whats best to use… For now vyos have great support for wireguard, but vyos 1.2 for now has someissues with the encrypted tunnels in dmvpn… (hopefully they would be solved befor 1.2 is released… :slight_smile:

If you need only a few nodes in your vpn, and routing is not an issue i think its better to stick with wireguard because of the simplicity of getting it up’n’running. (its only a UDP port and a few lines of code thats needed)