## 5 Implemented Scenarios and Experimental Results  
To assess the efficiency of various VPN protocols across different OS and HW configurations illustrated in Table 2, various network configurations were established as depicted in Figures 2-4. Using guest KVM stems from the ability to nest container networks, possibly using a _MACVLAN_ approach instead of a classical bridge, directly on individual guest networks. This would enable harnessing the capabilities of both virtual machines, such as resilience, and containers, such as lightweightness and portability. The tools used to capture network traffic data during various VPN and Overlay Tunnel sessions are those referenced in [23] and the network hosts topology is shown in Table 3.  
Listings 1-3 (bash scripts) depict the script executed by Ansible to activate a tunnel (in this case a FOU type) and automatically configure the network settings and kernel firewall parameters. \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**VPN SOFTWARE MANAGED** & **VPN DEILOY** & **VPN IMPLENTERS** & **OPERATIVE SYSTEMS** & **PLATFORMS** \\ \hline \hline \multirow{8}{*}{IPsec LibreSwan 4.15} & \multirow{8}{*}{Site to Site IKEv2 PSK TUNNEL IKev2 PSK TUNNEL IKev2 PSK TRANSPORT & \begin{tabular}{c} Linux DEILAN 12 \\ \end{tabular}  } & armv7 \\  & & & WINDOWS 10/11 (client) & \(\approx\)86 \\  & & & DEILAN 11/12 (client) & ARM64 \\  & & & ANDROB 11 (client) & ARM64 \\  & & & IKEv2 PSK TRANSPORT & \begin{tabular}{c} JSG 16 (client) \\ MAC OS X14 \\ \end{tabular}  & \ \begin{tabular}{c} ARM \\ MIPSSE \\ \end{tabular}  \\  & & & PAFSPERPER 17 2.3/4 & SMIPS \\  & & & OpenWRT 23.x & PPC \\ \hline \hline \multirow{2}{*}{IPsec LibreSwan 4.15} & \multirow{2}{*}{Site to Site IKEv2 XFRM/VTI ROUTE BASED} & \multirow{2}{*}{Same as above} & \begin{tabular}{c} armv7 \\.866 \\ \end{tabular}  \\  & & & & \(\approx\)86 \\  & & & & \(\approx\)86 \\  & & & & \(\approx\)86 \\  & & & & ARM64 \\  &```
#MAIN-left-fou-iface-up.sh
#!/bin/bash IFACE_MTU=\"1472\" LOCAL_KVM_NET=\"192.168.122.0/24\" REMOTE_KVM_NET=\"192.168.123.0/24\" echo\"Setting up FOU TUNNEL left side...\" modprobe ipip ipu idd port 5555 ipproto 4 ip link add name fou0 type ipip remote ${HOSTB} local ${HOSTA} mode ipip - ttl 255 dev eth0 encap for encap-sport 5555 encap-dport 6666  ip link set dev fou0 up mtu ${IFACE_MTU} ip a a 10.0.0.1 peer 10.0.0.2 dev fou0 ip r a ${REMOTE_KVM_NET} dev fou0
```

Listing 2: Bash script for a FOU interface ipables rule. ```
#----IPTABLESVERSION ----
#filter table ipfilter { chain input { type filter hook input priority 0; policy accept; } chain output { type filter hook output priority 0; policy accept;  counter comment \"count accepted packets\" } chain forward { type filter hook forward priority 0; policy accept;  ip saddle ${LOCAL_KVM_NET} oifname eth0 tcp flags syn tcp - option max seg size set 1360:9100 counter comment \"count dropped packets\" } }
```

Listing 3: Bash script for a FOU interface Nftables rule. The nodes are connected to a gigabit VMWARE Ethernet switch with 1 Gbps links. The complete topology deploys a subnet representing the WAN (with _public IP_ assigned) and two private subnets (the KVM networks) for each workstation, as shown in Figure 6. In the _Site-to-Site_ scenario, we have two VPN/Overlay Endpoints used as terminations of the tunnels and linked to local hosts that create traffic flows. In the _Site-to-Multi-Site_ topology, three endpoints (the number of nodes can be increased) are linked to local hosts through which traffic flows. To generate the network traffic, the _Iperf, Netperf_ and ping tools are used to measure productivity, jitter, bandwidth, and round-trip time (RTT) while several counters of the same operating system measure the CPU usage. To run the emulations necessary to collect the data, Ansible (_Ansible Project_, [[https://www.ansible.com/](https://www.ansible.com/)]([https://www.ansible.com/](https://www.ansible.com/)) accessed on 23 June 2024) was used on the network endpoint machines.