# VPN on VyOS

> Configure VPN on VyOS: WireGuard, IPsec, OpenVPN, L2TP. Site-to-Site and Road Warrior setups for Yandex Cloud and VK Cloud

Source: https://opennix.org/en/docs/vyos/vpn/


VyOS supports a wide range of VPN protocols for building secure tunnels between networks and remote users.

## Available VPN protocols

### [WireGuard](vyos-wireguard)
A modern, fast, and secure VPN protocol.

**Advantages:**
- High performance (faster than IPsec and OpenVPN)
- Simple configuration
- Modern cryptography (ChaCha20, Curve25519)
- Fast reconnection (ideal for mobile devices)
- Automatic roaming

**Use cases:**
- Site-to-Site VPN between offices
- Road Warrior for remote employees
- Hub-and-Spoke topology
- Any scenario where performance matters

**Protocol:** UDP (port 51820)

---

### [IPsec](vyos-ipsec)
Enterprise-grade VPN with broad compatibility.

**Covers:**
- Site-to-Site IPsec VPN
- IKEv2 for mobile clients
- Road Warrior with pre-shared keys
- Road Warrior with certificates
- IPsec with dynamic routing (BGP over IPsec)

**Advantages:**
- Standardized protocol
- Compatible with any vendor
- High security
- Hardware acceleration support

---

### [OpenVPN](vyos-openvpn)
SSL VPN for legacy and specialized scenarios.

**Covers:**
- OpenVPN server for remote access
- SSL/TLS tunnels
- Client configuration (Windows, Linux, macOS, mobile)
- Multi-factor authentication
- Push routes for clients

**Advantages:**
- Works over TCP (bypasses blocking)
- SSL certificates for authentication
- Flexible configuration
- Broad client support

---

### [L2TP/IPsec](vyos-l2tp)
Legacy VPN for Windows and macOS clients.

**Covers:**
- L2TP/IPsec server
- Configuration for Windows clients
- Configuration for macOS/iOS
- RADIUS integration for authentication

**Advantages:**
- Built-in support in Windows/macOS/iOS
- No additional client required
- Simple setup for end users

---

## VPN protocol comparison

| Characteristic | WireGuard | IPsec | OpenVPN | L2TP/IPsec |
|---------------|-----------|-------|---------|------------|
| **Performance** | Excellent | Good | Moderate | Moderate |
| **Ease of setup** | Excellent | Complex | Moderate | Simple |
| **Security** | Excellent | Excellent | Good | Good |
| **Compatibility** | Good | Excellent | Excellent | Excellent |
| **Roaming** | Excellent | Poor | Good | Poor |
| **NAT traversal** | Excellent | Complex | Excellent | Good |
| **Mobile clients** | Excellent | Good | Good | Excellent |
| **Hardware acceleration** | No | Yes | No | Yes |

## Choosing a VPN protocol

### Use WireGuard if:
- You need maximum performance
- Ease of setup is critical
- Mobile clients (fast reconnection)
- Modern infrastructure
- Site-to-Site between VyOS devices

### Use IPsec if:
- You need compatibility with other vendors
- Enterprise environment
- Hardware acceleration is available
- Standardization is required
- Integration with corporate policies

### Use OpenVPN if:
- You need TCP mode (bypassing blocking)
- Legacy clients
- Flexible configuration is required
- SSL certificates for authentication
- Specific routing requirements

### Use L2TP/IPsec if:
- Windows/macOS clients without additional software
- Simplicity for end users
- Legacy infrastructure
- RADIUS authentication

---

## Common VPN concepts

### Site-to-Site VPN
A permanent connection between two networks (offices).

**Characteristics:**
- Static tunnels between sites
- Automatic reconnection
- Routing between networks
- Typically used with dynamic routing (BGP/OSPF)

### Road Warrior (Remote Access)
Remote access for mobile users.

**Characteristics:**
- Client-server architecture
- Dynamic client connections
- User authentication
- Push configuration for clients

### Hub-and-Spoke
A central hub connects multiple spoke sites.

**Characteristics:**
- Centralized management
- Spoke sites connect to the hub
- Routing through the hub
- Scalable topology

---

## VPN best practices

### Security
1. **Use strong cryptography** (AES-256, SHA-256+)
2. **Generate unique keys** for each tunnel
3. **Rotate keys** periodically
4. **Restrict firewall** access to VPN ports
5. **Use certificates** instead of pre-shared keys where possible

### Performance
1. **Set the correct MTU** (typically 1420 for WireGuard)
2. **Use hardware acceleration** for IPsec where available
3. **Optimize routing** (minimize hop count)
4. **Monitor bandwidth** usage
5. **Use compression** only when necessary

### Reliability
1. **Configure keepalive** to detect drops
2. **Use monitoring** to track tunnels
3. **Configure backup tunnels** for critical connections
4. **Automate reconnection** on failures
5. **Log tunnel** events

### Management
1. **Document the VPN** topology
2. **Use descriptive names** for peers
3. **Version your configuration** in Git
4. **Automate deployment** via Ansible/API
5. **Regularly test** failover scenarios

---

## Integration with cloud platforms

### Yandex Cloud
- VPN tunnels to Yandex Cloud VPC
- Site-to-Site between the datacenter and the cloud
- Road Warrior access to cloud resources
- Integration with Yandex Cloud Interconnect

### VK Cloud
- VPN connection to a VK Cloud private network
- Hybrid scenarios (on-premise + cloud)
- Secure access to cloud VMs
- Backup channels over VPN

---

## VPN troubleshooting

### Common commands
```bash
# WireGuard
show interfaces wireguard
show interfaces wireguard wg0 summary

# IPsec (to be added)
show vpn ipsec sa
show vpn ipsec status

# OpenVPN (to be added)
show openvpn status
show openvpn server

# General troubleshooting
ping <remote-ip> interface <vpn-interface>
monitor interfaces <vpn-interface> traffic
show log | grep vpn
```

---

## Additional resources

- [VyOS VPN Documentation](https://docs.vyos.io/en/latest/configuration/vpn/)
- [WireGuard Official Site](https://www.wireguard.com/)
- [IPsec VPN Guide](https://docs.vyos.io/en/latest/configuration/vpn/ipsec.html)

## Additional VPN protocols

- [DMVPN](/docs/vyos/vpn/vyos-dmvpn/) - Dynamic Multipoint VPN for scalable hub-and-spoke topologies
- [OpenConnect](/docs/vyos/vpn/vyos-openconnect/) - SSL VPN server for Remote Access
- [SSTP Server](/docs/vyos/vpn/vyos-sstp-server/) - SSL VPN over port 443
- [PPTP Server](/docs/vyos/vpn/vyos-pptp-server/) - Legacy VPN (Deprecated)
- [RSA Keys](/docs/vyos/vpn/vyos-rsa-keys/) - RSA keys for VPN authentication