# IoT IP Overlay Network Security Performance Analysis with Open Source Infrastructure Deployment
## 5 Implemented Scenarios and Experimental Results  
We evaluate the performance of different VPN protocols on different operating systems and hardware as represented in Table 2. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Overlay Network** & **Overlay Deploy** & **Overlay Implemented** & **Operative Systems** & **Platforms** \\ \hline  & & & Linux DEBIAN 12 & armv7 \\  & & & WINDOWS 10/11 (client) & x86 \\  & & DEBIAN 11/12 (client) & x86-64 \\ IPsec & & IKEv2 PSK TUNNIEL & ANDROID 11 (client) & ARM64 \\ LibreSwan 4.15 & Site to Site & IKEv2 PSK TRANSPORT & iOS 16 (client) & ARM \\  & & MAC OS X 14 (client) & MIPSBE \\  & & RASPBERRY Pi 2/3/4 & MMIPS \\  & & & OpenWrt 23.x & SMIPS \\  & & & PPC \\ \hline IPsec & & IKEv2 XFRMi/VTI & & \\ LibreSwan 4.15 & Site to Site & ROUTE BASED & Same as above & Same as above \\ \hline FOU & Site to Site & Same as above & & armv7 \\  & & & x86 \\ \hline GUE & Site to Site & Same as above & & \\  & & & x86 \\ GRE & Site to Site & Same as above & & \\  & & & x86 \\ GRETAP & Site to Site & Same as above & & \\  & & & x86 \\ IPIP & Site to Site & Same as above & & \\  & & & x86 \\ GENEVE & Site to Site & Same as above & & \\  & & & x86 \\ VXLAN & Site to Site & Same as above & & \\  & & & x86 \\  & & & x86-64 \\ \hline MACSEC & Site to Site & Same as above & & \\  & & & x86 \\ Nebula Overlay VPN & Site to Site & Same as above & & ARM64 \\
1.6.1 & Host to Host & & MIPSBE \\  & & & MMIPS \\  & & & SPIC \\ \hline \hline \end{tabular}
\end{table} 
Table 2: A summary of the Overlay Network implemented testbeds. The choice to use guest KVM stems from the ability to nest container networks, possibly using a _MACVLAN_ approach instead of a classical bridge, directly on individual guest networks. This would enable harnessing the capabilities of both virtual machines, such as resilience, and containers, such as lightweightness and portability. Both Iperf v2.2 and Atop v 2.11 software are used to record the activities of the server's operating system during the various VPN sessions. Network topology nodes are shown in Table 3.  
Listings 1-3 (bash scripts) depict the script executed by Ansible to activate a tunnel (in this case of FOU type) and automatically configure the network settings and kernel firewall parameters. ```
#MAIN-left-fou-iface-up.sh
#!/bin/bash IFACE_MTU=\"1472\" LOCAL_KVM_NET=\"192.168.122.0/24\" REMOTE_KVM_NET=\"192.168.123.0/24\" echo\"Setting up FOU TUNNEL left side...\" modprobe ipip ip fou add port 5555 ipproto 4 ip link add name fou0 type ipp remote $HOSTB) local $HOSTA) mode ipip < ttl 255 dev eth0 encap for encap-sport 5555 encap-dport 6666 ip link set dev fou0 up mut $(IFACE_MTU) ip a a 10.0.0.1 peer 10.0.0.2 dev fou0 ip r a $(REMOTE_KVM_NET) dev fou0
```  
Listing 2: Bash script for an FOU interface Iptables Rule. ```
#----IPTABLESVERSION---- iptables-tangle-AFORWARD-oeth0 \ -p tcp -m tcp -m tcp -m tcp-flags SYN,RST SYN-s $(LOCAL_KVM_NET) \ -m tcpmss -mss $(IFACE_MTU):9100 -j TCPMSS -set-mss $(IFACE_MTU) \begin{table}
\begin{tabular}{l c} \hline \hline
**Hardware** & **Quantity** \\ \hline Workstation with 12 th Gen Intel(R) Core(TM) i7-1280P-2.00 GHz, 32 GB RAM & 1 \\ \hline VMWare VM Debian 12 x86-64 virtualized & 2 \\ \hline VMWare VM Alpine Linux Latest x86-64 virtualized & 1 \\ \hline VMWare VM OpenWrt 23.x x86-64 virtualized & 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Network topology HW components. ```
#------_NftablesVersion__---
#filter tableipfilter{ chaininput{ typefilterhookinputpriority0;policyaccept; } chainoutput{ typefilterhookoutputpriority0;policyaccept; countercomment\"countacceptedpackets\" } chainforward{ typefilterhookforwardpriority0;policyaccept; ipsaddr{<LOCAL_KVM_NET}ofinameeth0 tcpflagsyntcp -optionmaxsegsizeset1360:9100 countercomment\"countdroppedpackets\" } }
```

The nodes are connected to a gigabit VMWARE Ethernet switch with 1000 Mbps links.