VPN on VyOS
VyOS supports a wide range of VPN protocols for building secure tunnels between networks and remote users.
Available VPN protocols
WireGuard
A modern, fast, and secure VPN protocol.
Advantages:
- High performance (faster than IPsec and OpenVPN)
- Simple configuration
- Modern cryptography (ChaCha20, Curve25519)
- Fast reconnection (ideal for mobile devices)
- Automatic roaming
Use cases:
- Site-to-Site VPN between offices
- Road Warrior for remote employees
- Hub-and-Spoke topology
- Any scenario where performance matters
Protocol: UDP (port 51820)
IPsec
Enterprise-grade VPN with broad compatibility.
Covers:
- Site-to-Site IPsec VPN
- IKEv2 for mobile clients
- Road Warrior with pre-shared keys
- Road Warrior with certificates
- IPsec with dynamic routing (BGP over IPsec)
Advantages:
- Standardized protocol
- Compatible with any vendor
- High security
- Hardware acceleration support
OpenVPN
SSL VPN for legacy and specialized scenarios.
Covers:
- OpenVPN server for remote access
- SSL/TLS tunnels
- Client configuration (Windows, Linux, macOS, mobile)
- Multi-factor authentication
- Push routes for clients
Advantages:
- Works over TCP (bypasses blocking)
- SSL certificates for authentication
- Flexible configuration
- Broad client support
L2TP/IPsec
Legacy VPN for Windows and macOS clients.
Covers:
- L2TP/IPsec server
- Configuration for Windows clients
- Configuration for macOS/iOS
- RADIUS integration for authentication
Advantages:
- Built-in support in Windows/macOS/iOS
- No additional client required
- Simple setup for end users
VPN protocol comparison
| Characteristic | WireGuard | IPsec | OpenVPN | L2TP/IPsec |
|---|---|---|---|---|
| Performance | Excellent | Good | Moderate | Moderate |
| Ease of setup | Excellent | Complex | Moderate | Simple |
| Security | Excellent | Excellent | Good | Good |
| Compatibility | Good | Excellent | Excellent | Excellent |
| Roaming | Excellent | Poor | Good | Poor |
| NAT traversal | Excellent | Complex | Excellent | Good |
| Mobile clients | Excellent | Good | Good | Excellent |
| Hardware acceleration | No | Yes | No | Yes |
Choosing a VPN protocol
Use WireGuard if:
- You need maximum performance
- Ease of setup is critical
- Mobile clients (fast reconnection)
- Modern infrastructure
- Site-to-Site between VyOS devices
Use IPsec if:
- You need compatibility with other vendors
- Enterprise environment
- Hardware acceleration is available
- Standardization is required
- Integration with corporate policies
Use OpenVPN if:
- You need TCP mode (bypassing blocking)
- Legacy clients
- Flexible configuration is required
- SSL certificates for authentication
- Specific routing requirements
Use L2TP/IPsec if:
- Windows/macOS clients without additional software
- Simplicity for end users
- Legacy infrastructure
- RADIUS authentication
Common VPN concepts
Site-to-Site VPN
A permanent connection between two networks (offices).
Characteristics:
- Static tunnels between sites
- Automatic reconnection
- Routing between networks
- Typically used with dynamic routing (BGP/OSPF)
Road Warrior (Remote Access)
Remote access for mobile users.
Characteristics:
- Client-server architecture
- Dynamic client connections
- User authentication
- Push configuration for clients
Hub-and-Spoke
A central hub connects multiple spoke sites.
Characteristics:
- Centralized management
- Spoke sites connect to the hub
- Routing through the hub
- Scalable topology
VPN best practices
Security
- Use strong cryptography (AES-256, SHA-256+)
- Generate unique keys for each tunnel
- Rotate keys periodically
- Restrict firewall access to VPN ports
- Use certificates instead of pre-shared keys where possible
Performance
- Set the correct MTU (typically 1420 for WireGuard)
- Use hardware acceleration for IPsec where available
- Optimize routing (minimize hop count)
- Monitor bandwidth usage
- Use compression only when necessary
Reliability
- Configure keepalive to detect drops
- Use monitoring to track tunnels
- Configure backup tunnels for critical connections
- Automate reconnection on failures
- Log tunnel events
Management
- Document the VPN topology
- Use descriptive names for peers
- Version your configuration in Git
- Automate deployment via Ansible/API
- Regularly test failover scenarios
Integration with cloud platforms
Yandex Cloud
- VPN tunnels to Yandex Cloud VPC
- Site-to-Site between the datacenter and the cloud
- Road Warrior access to cloud resources
- Integration with Yandex Cloud Interconnect
VK Cloud
- VPN connection to a VK Cloud private network
- Hybrid scenarios (on-premise + cloud)
- Secure access to cloud VMs
- Backup channels over VPN
VPN troubleshooting
Common commands
# WireGuard
show interfaces wireguard
show interfaces wireguard wg0 summary
# IPsec (to be added)
show vpn ipsec sa
show vpn ipsec status
# OpenVPN (to be added)
show openvpn status
show openvpn server
# General troubleshooting
ping <remote-ip> interface <vpn-interface>
monitor interfaces <vpn-interface> traffic
show log | grep vpnAdditional resources
Additional VPN protocols
- DMVPN - Dynamic Multipoint VPN for scalable hub-and-spoke topologies
- OpenConnect - SSL VPN server for Remote Access
- SSTP Server - SSL VPN over port 443
- PPTP Server - Legacy VPN (Deprecated)
- RSA Keys - RSA keys for VPN authentication
Reviewed by OpenNix LLC · Last updated on