WireGuard & BGP
in Proxmox VE SDN

Encrypted transport

WireGuard lets you set up a VPN between Proxmox nodes (and external nodes). On its own it does not route dynamically — it's a tunnel. You pair it with a layer-3 protocol (OSPF, BGP) to get encrypted, dynamically routed transport that can carry e.g. EVPN or VXLAN traffic between sites.

Route maps and prefix lists

The BGP and EVPN controllers now take an incoming and an outgoing route map. The incoming map runs against routes received from a peer before they're installed; the outgoing map runs against routes before you announce them. Combined with prefix lists this gives fine-grained control over what enters and leaves the fabric.

What we inject into the fabric

For an OSPF fabric you can choose which routes the BGP router on each node should redistribute into the fabric. Supported sources:

• connected — directly connected networks
• kernel — kernel routes
• static — static routes
• ospf — OSPF routes

An optional route map can be attached per source to further shape the announced routes.

EVPN over IPv6

EVPN controllers can now be configured with IPv6 peer addresses — so the EVPN underlay can run fully over IPv6. That matters for modern, IPv6-first environments and large deployments.