11 ms·
Wiretrustee: WireGuard-Based Mesh Network
- ptman 5y agoOther interesting solutions in this space: - https://tailscale.com/ https://tailscale.com/ - https://github.com/juanfont/headscale https://github.com/juanfont/headscale - https://github.com/tonarino/innernet https://github.com/tonarino/innernet - https://github.com/slackhq/nebula https://github.com/slackhq/nebula Something I'm missing?
- cassianoleal 5y agohttps://zerotier.com https://zerotier.com Not Wireguard based, but similar functionality.
- api 5y agoIt has a bunch of other functionality including virtualizing at layer 2 and a distributed rules engine.
- linsomniac 5y ago... and "public" VPNs, where all you need is the network ID to connect. Seems great for playing LAN games. It also has a userspace implementation, which I was able to use on bitbucket CI/CD where I couldn't bring up a tun/tap device, to connect via SSH to a private server. It also has Ad-Hoc networks that are public, IPv6 addressed, and based on port-range, so you can expose your SSH server to anyone with the IPv6 address, for example.
- artificialLimbs 5y agoI had enough problems that I had to stop using it, though when it worked it was fantastic. Client intermittently had seizures (at least on Windows) and I couldn't join/unjoin networks properly. Would have to restart the service and close the program for it to begin to work again. Sometimes the traffic just didn't flow ... at all. Randomly couldn't connect to other clients on the network. I quit about 6 mo ago. Has it improved since?
- cassianoleal 5y agoI haven't had to use it much since covid started as I'm mostly at home these days and I used it to access my LAN when I was out. I have tried to use it over mobile data and wasn't very lucky, and that's something that used to work great. I couldn't tell if it was due to ZT or the carrier. There's CGNAT on both ends, which could be getting in the way, although like I said it used to work great. I have also noticed that it takes longer than I was used to get IP, find routes between nodes, etc but once those are up it works well.
- mattmein 5y agoI've used Zerotier for several years now, and it does feel that the stability on mobile has improved in the past couple of months.
- awesomeusername 5y agoI feel like my whole life got simpler with less headaches when I discovered ZT. I adore it. Maybe there are other things out there which do the same thing but ZT is the single 'it just works' thing that has made my life easier the most. Not associated with them in any way other than being a user.
- naggie 5y agoI made this: https://github.com/naggie/dsnet/ https://github.com/naggie/dsnet/ -- a simple command to manage a wireguard VPN. Think wg-quick but quicker: key generation + address allocation. It's not distributed, however.
- deleted 5y ago[deleted]
- 5e92cb50239222b 5y agoDon't forget tinc: https://github.com/gsliepen/tinc/tree/1.1 https://github.com/gsliepen/tinc/tree/1.1 It isn't based on WireGuard, but is a true mesh network, unlike everything you've listed. No central coordination point, every node is equal. Think of it as BitTorrent with a few initial peers you set up through a config file, and it learns of every other peer at runtime (like BitTorrent does through Peer Exchange). It can forward traffic through other nodes (like Tailscale and unlike Nebula) and recomputes the most efficient route as peers become (un)available.
- formerly_proven 5y agoHow secure is tinc?
- pedrocr 5y agoI really like it for my use case but just assume it's not secure at all. I change the default Ubuntu install to not run the daemon as root (a major flaw in my view) and then just assume that network is as insecure as any other. It's really useful to have all my personal machines always connected between each other at the same IP independently of network config. Security comes from SSH/TLS on top of it.
- formerly_proven 5y agoConsidering that the wireguard mesh solutions seem to require static IPs, I'm now wondering whether it might be a good idea to run a wireguard mesh on top of tinc, basically just using tinc as a way to get static IPs and routing connectivity between nodes. That still leaves the issue of updating the wireguard configuration, though.
- JacobiX 5y agoNot sure about that, I use Tailscale (wireguard based) and none of my devices have a public IP.
- Jiocus 5y agoCjdns, > An encrypted IPv6 network using public-key cryptography for address allocation and a distributed hash table for routing. https://github.com/cjdelisle/cjdns https://github.com/cjdelisle/cjdns
- JeremyNT 5y agoWireguard based solutions get all the attention these days, but I really love working with Nebula. It's dead simple to set up and the mobile client works well. That said, Nebula feels way less popular, and I don't know if it's had a third party security audit. WG's popularity means it should presumably have had a lot of attention given to both its architecture and its code. This is one area where using a "niche" solution feels somewhat risky.
- atonse 5y agoThankfully both Nebula and Wireguard are built on top of the Noise Framework. So neither is a compromise security-design wise.
- wolverine876 5y ago> Thankfully both Nebula and Wireguard are built on top of the Noise Framework. > So neither is a compromise security-design wise. Security involves much more than the crypto framework being used; just crypto requires much more than the framework. Noise could be implemented insecurely, as a basic example.
- atonse 5y agoYeah that’s probably true. But I meant in the sense of it’s not roll your own crypto.
- wolverine876 5y agoYes, absolutely. That reduces a lot of likely error.
- KingMachiavelli 5y agoNebula is pretty great. However, the Android client does not allow for specifying a DNS server and breaks the Android system DNS over TLS. Google thinks the VPN app/client should handle DNS and Nebula app development seems very slow. This means you cannot use adblocking DNS while using Nebula.
- jordanwhited 5y agohttps://github.com/jwhited/wgsd https://github.com/jwhited/wgsd is a building block that can be used to achieve something similar, minus TURN-like NAT traversal fallback. The peer discovery leverages DNS and UDP hole punching uses WireGuard itself.
- nyolfen 5y agohttps://vpncloud.ddswd.de/ https://vpncloud.ddswd.de/
- trickstra 5y agohttps://github.com/gravitl/netmaker/ https://github.com/gravitl/netmaker/
- handrous 5y agoA major differentiator for the (many) mesh net projects is whether they are GPL (or similar) or BSD. The latter can be distributed in the iOS/iPadOS App Store, so have a lot more potential value for both hobbyist and business end users. Of course, if it's mostly a server-to-server mesh net with few end user devices, then it hardly matters.
- ctrlc-root 5y agoThere's also fastd: https://github.com/NeoRaider/fastd https://github.com/NeoRaider/fastd
- cypherpunks1 5y agohttps://codeberg.org/vula/vula https://codeberg.org/vula/vula aims to thwart surveillance adversaries by automatically building wireguard tunnels between LAN hosts with zero configuration using existing IP addresses and .local hostnames inside and outside the tunnels, and uses CSIDH to provide post-quantum protection. Unlike these other projects, it doesn't (yet?) do anything over the internet, and as a result doesn't require a server or any infrastructure. If it is installed on the router, internet-bound traffic is also protected on the LAN.
- deleted 5y ago[deleted]
- ukd1 5y agohttps://zerotier.com https://zerotier.com / https://github.com/zerotier/ZeroTierOne https://github.com/zerotier/ZeroTierOne
- zxcvbn4038 5y agoEveryone mentions tailscale but they want to charge you per user. Their client is open source, the thing the client connects to is not. I think there are better options.
- ItalyPaleAle 5y agohttps://github.com/juanfont/headscale https://github.com/juanfont/headscale replaces the tailscale control panel with something open source and self-hosted. However, it doesn't have all the features of the official tailscale control panel.
- xaduha 5y agohttps://github.com/wiretrustee/wiretrustee/projects/2 https://github.com/wiretrustee/wiretrustee/projects/2 Router Nodes is what I would really like to have, I want a node that doesn't have internet connection, but in the local network with another node to get access to the internet through that node. Wasn't able to achieve it with plain Wireguard, my linux networking kungfu is weak. EDIT: thanks, I'll try mentioned projects, Yggdrasil seems most interesting.
- damvigilante 5y agoTailscale supports what you’re looking for I believe https://tailscale.com/kb/1103/exit-nodes/ https://tailscale.com/kb/1103/exit-nodes/
- thepete2 5y agoDon't you just need to set the gateway and enable package routing on the other one?
- xaduha 5y agoI omitted some details, there was a third node that I was trying to use as an exit. It was a while back, but whatever I tried wasn't working, if it is trivial for someone else it wasn't for me.
- 5e92cb50239222b 5y agotinc supports this since forever, FWIW, and is fully open / self-hosted, no ties to a central server at all (so one node going down does not take your whole network with it).
- MayeulC 5y agoHow about yggdrasil? (Note: you'd still need to set up NAT and default gateway yourself). https://yggdrasil-network.github.io https://yggdrasil-network.github.io
- api 5y agowww.zerotier.com has this at both L3 and L2 (bridging). You can push routes or merge virtual and physical Ethernet.
- qbasic_forever 5y agoDid they copyright the term WireGuard (capitol G)? Wow. edit: Ah this was a dumb comment, it's trademark the creators of wireguard. These folks are using the name correctly. Nothing fishy or weird going on.
- Heliosmaster 5y ago> © Copyright 2015-2020 Jason A. Donenfeld. All Rights Reserved. "WireGuard" and the "WireGuard" logo are registered trademarks of Jason A. Donenfeld. From the original website
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- throwawaysea 5y agoFor someone who has no idea what this means, can someone please offer a simple explanation? When I read "mesh network" I think about those routers with modules you can use to get good WiFi coverage at home. This sounds more like connecting your devices across the Internet in some private manner. What would you use this for?
- ptman 5y agoWireGuard is a VPN protocol. There are roughly two kinds of VPN. Those that you use to hide who you are when accessing the Internet (route all your traffic via the VPN to an exit node) and those that you use to build a private network over a public one for e.g. a company or other organization. Wiretrustee seems to be for generating a private org network. Could be personal, work, circle of friends or anything. Most traditional work VPNs have one or more nodes that all traffic pass through and that all connect to. A mesh VPN instead allows VPN peers to send traffic directly to each other over the public Internet. There seems to be a central coordination/signaling server, as with tailscale, headscale and innernet. But that is mainly used to find where the traffic should be sent, not for sending all traffic through it.
- zimpenfish 5y agoI use it for connecting my tiny SMTP ingress machine to my big SMTP backend machine and doing the ClamAV scanning over the VPN link (because it's now far too heavy for the tiny SMTP machine these days but the big machine has plenty of resources free.)
- seddona 5y agoCurrently running our corporate VPN on Wireguard, would highly recommend. Wiretrustee looks like a very useful featurset on top of Wireguard, nice work.
- dgan 5y agoBare bones wireguard? Or some solution like tailscale? Or maybe FOSS
- tbronchain 5y agoLooks great! I've been using wg-meshconf[1] to assist in setting up Wireguard Mesh Networks on Linux for a while, works amazing! A massive use case is to setup Kubernetes clusters, where end to end network encryption is quite important. [1]: https://github.com/k4yt3x/wg-meshconf https://github.com/k4yt3x/wg-meshconf
- ptman 5y agoThis assumes the peers have static IPs? Or how is changing peer IPs handled?
- tbronchain 5y agoCorrect, peers must have a static IP. We could imagine to build a small extra tool to automate regenerate the config in case of IP change but could be a bit tricky :)
- isatty 5y agoLooks good. I use ansible to automate WireGuard setup between my nodes (n=5, m=5, m being personal devices such as phones, iPad etc and n being servers) and it works well. Can’t automate the part where I’ve to manually scan a QR code for phones though.
- Tepix 5y agoHow well does this perform with UDP traffic?
- bschwindHN 5y agoAssuming this tool results in two peers connected over WireGuard (no relay server), the UDP performance should be great. Probably fine with a relay server too but I can't say definitively.
- braginini 5y agoGood answer! Wiretrustee uses kernel Wireguard if available, therefore the performance is the same as plain Wireguard. There are some caveats though. We use a fixed mtu value of 1280 to be on a safe side while wg-quick dynamically detects the best value. We will improve it. If the Wireguard kernel module isn't available (true for older Linux, Mac and Windows) then userspace implementation is used (wireguard-go) which is slower.
- unixhero 5y agoWe need an awesomelist for Wireguard
- Forbo 5y agoI don't get the obsession with awesomelists. Seems like every time I go to check them out, there's five different lists for the same subject, and none of them are kept up to date. Just seems like someone's weekend project that gets immediately forgotten.
- atonse 5y agoYet it tends to be often the best way for me to find competing or alternative libraries for elixir and other tech I use. Google just doesn’t cut it because there are so many spammy sites that dominate the search results when you search for alternatives.
- unixhero 5y agoThis is the answer.
- est 5y agoDoes Android ship newest kernel with Wireguard? If so can we have mesh network on Android devices?
- ptman 5y agowireguard works in userspace as well. It just works faster with kernel support.
- aquaticsunset 5y agoI'm a huge fan of Tailscale, and in an effort to understand better everything they've done under the hood to make it work, I decided to redo my network with native WireGuard. A) WireGuard works great when it's all set up! Config is a bear but it's a great protocol. Works well on lots of different devices in different usages - Android, laptops, desktops, headless servers, IoT. B) I have even more respect for Tailscale for doing all of this in such a polished, seamless way.
- atonse 5y agoWe’ve been using Tailscale and it’s been excellent. I’d like the ACL system to be a bit more robust but I totally get that They’re putting their energy into a seamless experience with the nuts and bolts of the actual tech first and it really shows in how solid it has been for us.
- fabian2k 5y agoAre there any simple tools to manage a small WireGuard VPN with a handful of servers and something like low double-digit number of clients? By servers I mean Linux servers/VMs that expose some web services and clients are simply desktop/notebooks that need to access the servers, but don't expose services to the VPN. From the description, this tool isn't what I want. I have configured a simple version by hand with Wireguard, but it did seem like raw WireGuard is too low-level for my purpose and my networking knowledge. Setting up the keys does need some level of automation for anything larger than a sandbox. And I didn't figure out a way to resolve domains within the VPN without interfering with the DNS on the clients for everything else.
- EwanToo 5y agoPritunl maybe? It has a Wireguard option that works https://docs.pritunl.com/docs/wireguard https://docs.pritunl.com/docs/wireguard
- andriosr 5y agoI think it can’t get easier than https://runops.io https://runops.io No VPN, DNS, IPs, and so on; and get to the same result: any device accessing resources in private networks, besides a few extra features.
- 411111111111111 5y agoI've never used it myself, but a sister comment mentioned related projects working with wireguard and innernet seems to be exactly that use case from a casual glance. You can specify full cidr rules, so it should be possible to prohibit connections between nodes by segmenting the IPs https://github.com/tonarino/innernet https://github.com/tonarino/innernet There are easier options around if all you wish is ssh access to your servers though. Personally I'd recommend gravitational teleport, mainly because the name is so hilarious https://goteleport.com/ https://goteleport.com/
- SEJeff 5y agoTeleport also has some really neat approval workflows where you can say "2 of these 3 people need to approve a request for people in group Y to access servers in group X". The incoming request can ping you on slack and then you go to the teleport webui (U2F authenticated with SSO) to approve. It also has some neat stuff around eBPF session recording if you want to be able to playback user sessions for high security environments. Teleport is good tech.
- timwis 5y agoSorry if I'm a bit thick here, but can someone give me an example use case of how someone might use this?
- handrous 5y agoThe promise of most mesh nets is that they're (more or less) a self-configuring distributed VPN. Give a node some credentials and (usually) a few real, publicly-routable IP addresses to "bootstrap" nodes, and that's it. It's on the network. There's no "real" network that they provide a gateway to, necessarily, just a bunch of nodes, potentially none of which are on the same physical or logical local network, aside from the mesh network itself, which is an overlay network—think of an overlay network like a virtual machine, but for networks, incidentally: a protocol stack built on top of, or within, if you prefer, another protocol stack. You feel like you're talking TCP/IP over it, but under the hood your TCP packets are carried in other packets (may or may not also be TCP—often it's UDP when possible) over the normal Internet, then reconstructed back into this virtualized, if you will, packet stream on the other end. With a traditional VPN, you'd connect to a real device that provides a gateway to, say, a corporate network, which may have routing connecting multiple locations but is essentially a normal network. Mesh networks operate much more peer-to-peer than that, usually leveraging known peers to find routes to others that are (for whatever reason) unreachable or initially unknown. The "mesh" part refers to the routing, mainly, the job of which is to search out and find good paths to nodes. If "corporate" has fiber cut by a backhoe, "the VPN" isn't down—many, many nodes might be, but the network might survive in a useful form.
- e12e 5y agoAnyone have a comparison to headscale (self-host/oss tailscale)? https://github.com/juanfont/headscale https://github.com/juanfont/headscale I suppose the turn server support for nat hole punching is the biggest difference?
- atonse 5y agoI would love for this to be integrated into Consul Connect so all our systems just run in one mesh and all internal traffic is encrypted without even thinking about it.
- Saris 5y agoI feel like these wireguard based solutions are still too complex for mobile/roaming client usage.