A Hacker News user asked whether to run VXLAN over WireGuard or the reverse for public network traversal. The discussion quickly flagged recursive tunneling as a bad idea, citing overhead and security concerns. With 12 points and 8 comments, the thread explored trade-offs between these two protocols in untrusted environments, aiming for a clear best practice.

Commenters noted VXLAN's design for trusted networks, suggesting it should run over an encrypted transport like WireGuard or IPSec. WireGuard operates at Layer 3, while VXLAN creates Layer 2 overlays. Combining them raises questions about Maximum Transmission Unit (MTU) fragmentation, a classic problem when stacking headers. The community agreed that avoiding recursive setups simplifies troubleshooting and improves performance.

Google's internal routing came up as a real-world example of layered security, using IPSec-like encryption underlaying VXLAN-like overlays. However, that approach works because they control MTU and packet fragmentation internally. On the public internet, packet size constraints become critical. The consensus leaned toward running VXLAN over WireGuard for encrypted transport, rather than nesting them unnecessarily.