4 ms·
Not entirely as it only really allows stuff thats running in that service mesh's world to connect to the network. But they want a global VPN for _everything_ i
by KaiserPro 7y ago
Not entirely as it only really allows stuff thats running in that service mesh's world to connect to the network.
But they want a global VPN for _everything_ including laptops. This means some level of access control.
What I like here is the use of lighhouses, to allow external nodes to punch in and discover the rest of the network. Something which is very difficult to do if you are relying on a service mesh in an unknown and unconnectable network.
- hedwall 7y agoWith Consul intentions and edge gateways you may be able to have the same functionality, but those are quite recent and was not present 2 years ago.
- thu2111 7y agoHow does this differ from cjdns?
- KaiserPro 7y agoI suspect that the goals are slightly different. The thing that immediately stands out is the routing. It looks like cjdns is a traditional-ish multi-hop network. The DHT routing table allows you to map out a route to peer A via peer B, R, & D. What wireguard and nebula allow is for the underlying network to figure out most of the routing, and effectively create a massive point to-point network. whilst you can have concentrators/gateways, the idea is that most of the traffic goes direct from peer to peer. This can reduce load considerably.
- thu2111 7y agoI think cjdns allows arbitrary peering, so you can certainly set up a full mesh if you want point-to-point traffic, with multiple hops only for cases where the underlying network topology requires it.
- neilalexander 7y agoRight, cjdns and Yggdrasil will both forward on behalf of other nodes where no direct paths are available.