Add additional tunnel encapsulation choices: PPTP, L2TP, EoIP, SSTP

[jmcguir]

NetBox version

v4.1.4

Feature type

Change to existing functionality

Triage priority

I volunteer to perform this work (if approved)

Proposed functionality

I'd like to add PPTP, L2TP, and EoIP as Tunnel Encapsulation Choices. PPTP, and L2TP are standards based tunnel protocols while EoIP is a MikroTik proprietary protocol and SSTP is a Microsoft proprietary protocol.

PPTP: https://datatracker.ietf.org/doc/html/rfc2637
L2TP: https://datatracker.ietf.org/doc/html/rfc2661
EoIP: https://help.mikrotik.com/docs/spaces/ROS/pages/24805521/EoIP
SSTP: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-sstp/c50ed240-56f3-4309-8e0c-1644898f0ea8

As far as I can tell the only change here would be to add these fourto the choices.py here: https://github.com/netbox-community/netbox/blob/develop/netbox/vpn/choices.py

Use case

This lets users model more accurately their VPN tunnels. Right now the choices don't have an other so you have to use an incorrect Encapsulation choice.

Database changes

No response

External dependencies

No response

[chbally]

Please also add WireGuard:
WireGuard: https://datatracker.ietf.org/doc/html/rfc8922#name-wireguard
and if possible OpenVPN:
OpenVPN: https://datatracker.ietf.org/doc/html/rfc8922#name-openvpn

I think even if is kind of IP in IP lots of people would appreciate these two protokolls in Netbox:
#14683

[jmcguir]

If approved I'd be happy to add WireGuard and OpenVPN to a PR I'm willing to write.

[jeremystretch]

Let's not turn this into a wishlist for every potential tunneling protocol.

L2TP is a standard protocol with its own IP protocol number (115); I see no issue adding this.

Likewise, PPTP is a standard protocol which runs atop GRE using TCP/1723. This also makes sense to add.

EoIP appears to be a vendor-proprietary implementation of GRE. From the documentation provided, I see no justification for declaring this as a discrete tunnel type.

As far as I'm aware, SSTP is employed for client access and does not support site-to-site VPN tunneling. If this is the case, it does not make sense IMO to add it as a site-to-site tunnel encapsulation type.

Wireguard is a relatively newer VPN technology that utilizes multiple UDP ports beginning at 51820. As noted here we need to be careful not to imply that this change implements support for the configuration of Wireguard VPNs, but I have no issue with adding it as an encapsulation option.

Likewise, OpenVPN is a complete VPN solution; we can add it as a tunnel encapsulation option provided the scope of this change does not seek to implement support for specific configuration options.

To summarize, I believe this PR should be limited to adding the following tunnel encapsulation choices:

• L2TP
• PPTP
• Wireguard
• OpenVPN

[jmcguir]

Thanks for your input Jeremy. I'll revise my PR with this feedback.