Sometimes depending on the network architecture you find your traffic inside a tunnel encapsulated inside another and maybe also inside another tunnel. So double to tripple encryption without that much of a security benefit. When the clients already establishing a VPN connection there is no need for the S2S encryption tunneling. We only getting smaller and smaller packets through the pipe because of the overhead of each IPsec tunnel reducing the MTU further.

This is my 2026 overview of my homelab. Here I go over everything I use almost on a daily basis. Feel free to surf around.

Network

The heart of my network is my Mikrotik hEX router. It has multiple VLANs, doing DNS forwarding and distributing IP addresses over DHCP.

Additionally it has some Wireguard tunnels towards my Hetzner Cloud servers that I don’t have to expose the management access towards the wild wild internet. Overall I have three different VLAN segments terminating on the router:

This blog demonstrate a possible IPsec hub and spoke design with IKEv2 and VTI. The focus here is on an IPsec configuration that is identical on all sides to ensure a consistent configuration. The basic design is shown in the figure below.

Security considerations

In general, this example uses AES (CBC) with at least 256 bits. On newer Cisco routers, it is possible to use AES in GCM mode. GCM is the newer mode compared to CBC. However, there are potential security concerns with GCM if the initial vector is reused. One advantage of GCM is that it combines encryption and integrity, eliminating the need for an additional algorithm for integrity (as is the case with CBC).