When I started collecting topics for the September 2021 ipSpace.net Design Clinic one of the subscribers sent me an interesting challenge: are there any open-source alternatives to Cisco’s DMVPN?
I had no idea and posted the question on Twitter, resulting in numerous responses pointing to a half-dozen alternatives. Thanks a million to @MarcelWiget, @FlorianHeigl1, @PacketGeekNet, @DubbelDelta, @Tomm3h, @Joy, @RoganDawes, @Yassers_za, @MeNotYouSharp, @Arko95, @DavidThurm and several others who chimed in with additional information.
Here’s what I learned:
As Close As You Can Get to DMVPN
- VyOS implemented DMVPN, and you can run a DMVPN network without Cisco routers.
- OpenNHRP is a compliant open-source implementation available for (at least) Alpine Linux, VyOS, OpenWrt, and Ubuntu.
- Alpine Linux had DMVPN support since ages.
- FRR has NHRP and can create shortcut tunnels over mGRE.
- I was told Zerotier could do routing or bridging, so it could be a DMVPN replacement. Have to dig deeper into the docs.
- Tailscale is a WireGuard-based VPN with centralized (closed-source) control plane, so technically it doesn’t count.
- Nebula – seems to be a host-based implementation of an overlay subnet. However, you should be able to add a routing protocol on top of it and route between Linux interfaces.
- Tinc-VPN is another host-based overlay VPN solution with the ability to bridge Ethernet segments over VPN. What could possibly go wrong with that? Being a bit more creative, one could use it the same was as Nebula to route between LAN segments and overlay network.
- Innernet is a configuration system on top of WireGuard. It looks like I’ll have to figure out what WireGuard does as well ;)
- OpenOverlayRouter is a LISP+VXLAN implementation. In theory you should be able to run IP routing on Linux nodes to implement something like DMVPN.
Have we missed something? Would you like to add more details? Please write a comment (and yes, it’s perfectly fine to post links to product documentation ;).