0

Let's say you wanted to transfer a 1 GB file from a machine at site 1 to a machine at site 2. You can either connect the two machines via a VPN (L2TP) or basic port forwarding. Which connection method would move the file faster (or would it be a tie?), and why?

2
  • 2
    What do you mean by "basic port forwarding"? Nov 19, 2020 at 9:21
  • Rather than tunneling using a configuration where a router will forward traffic for a certain port to a machine in its network Nov 19, 2020 at 15:12

2 Answers 2

7
+100

Port forwarding would be quicker, but it would be less secure, in the sense that there is no confidentiality, or integrity. If you don't care then it is not a problem. Any VPN or tunnelling will add overhead, both in terms of the Packet header, and processing on the gateway that is encrypting and encapsulating your data. Different VPN technologies can use varying levels of encryption and hashing, and often that is also supported in the hardware of devices.

The actual speed and throughput you receive will be dependent on quite a few variables. You also need to consider the protocol you use for the transfer, and the latency of the end to end connection. Protocols like CIFS are very bad over a WAN circuit as they do not have effective TCP window scaling, so your total throughput is constrained by your round trip latency. sftp is much better of a WAN link and it would also provide encryption. SCP not as fast, but still pretty effective.

1
  • 2
    With modern CPUs the bottleneck is usually moved to how much data payload is in each transmitted data packet, and just how fast is your internet. Unless you have a 10gbps connection on both ends, then CPU overhead will come in to play. The amount of data overhead SlyOne is talking about is usually only a few percent for a VPN these days. You can usually watch this efficiency by comparing the bandwidth going through the router to the source or destination disk usage if not much else is happening on that disk. With most VPNs also doing compression this changes depending on data. Nov 23, 2020 at 0:22
2

I don't think you'd have a relevant performance gain for this specific example. Nonetheless, bear in mind a layer 2 to VPN would handle more traffic, like broadcasts, ARP packets, and NetBIOS packets.

If your need is just forwarding a specific service/port, I'd rather go with port forwarding and denying incoming packets to anything else that doesn't need to be exposed.

Bear in mind that, enabling a L2 VPN you're somehow exposing all your nodes to both networks. If you trust both networks and it sounds OK, well, no problem. If it doesn't, expose only what need to be exposed.

2
  • A layer 2 VPN is not the only option. Most VPN suites these days default to a layer 3 routed setup, where none of the broadcast traffic is transmitted. Try something like TincVPN (tinc-vpn.org) or OpenVPN community edition (openvpn.net/community-downloads-2). Popular router distro's like pfsense (pfsense.org) have nice gui's built in or as a simple addon available. Nov 23, 2020 at 1:05
  • @BeowulfNode42 I have faced some scenarios where a L2 VPN was needed because of some legacy requirements. As I said, if I can choose, I rather go with port forwarding, but sometimes I can't choose for a L3 VPN. Nov 23, 2020 at 1:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .