question about performance when VPN packets go out ...

Skaperen

... of order

if i set up a symmetric shared-key VPN over UDP what kind of performance impact could i see if these UDP datagrams arrive out of order?

i am looking at a scheme where some of my own code manipulates a tunnel by capturing the UDP datagrams and arranges to send these packets over 2 or more physical networks. it would be round-robin load balancing. i could tag these datagrams and restore their original order. but if out of order is not much of an impact, then there would be little point in doing this.

the method of capturing the UDP packets would be to configure OpenVPN to communicate with alternate port numbers on localhost.

127.0.0.1:1194 <---> 127.0.0.1:4491

where my code in another process is working the other end of port 4491. it will forward the encrypted datagrams it receives on port 4491 via a round-robin selected path to the peer, which is doing the same thing, ending up with an OpenVPN interface.

this idea is to get around issues with recent versions of the Linux ifenslave driver that apparently are incompatible with bonding VPN tunnel interfaces, by totally avoiding the use of ifenslave.

maikcat

ome of my own code manipulates a tunnel by capturing the UDP datagrams and arranges to send these packets over 2 or more physical networks

you can use policy based routing for this

i could tag these datagrams and restore their original order

so are you trying to write a new l2 protocol?
or re-encapsulate them?
what about HMACs?

if you simply want to balance 2 vpns just take a look at zeroshell (i already answered another of your post)

Michael.