13 ms·

Other interesting solutions in this space: - https://tailscale.com/ https://tailscale.com/ - https://github.com/juanfont/headscale https://github.com/juanfont

by ptman 5y ago

Other interesting solutions in this space: - https://tailscale.com/ https://tailscale.com/ - https://github.com/juanfont/headscale https://github.com/juanfont/headscale - https://github.com/tonarino/innernet https://github.com/tonarino/innernet - https://github.com/slackhq/nebula https://github.com/slackhq/nebula Something I'm missing?

cassianoleal 5y ago
https://zerotier.com https://zerotier.com Not Wireguard based, but similar functionality.
- api 5y ago
  It has a bunch of other functionality including virtualizing at layer 2 and a distributed rules engine.
  - linsomniac 5y ago
    ... and "public" VPNs, where all you need is the network ID to connect. Seems great for playing LAN games. It also has a userspace implementation, which I was able to use on bitbucket CI/CD where I couldn't bring up a tun/tap device, to connect via SSH to a private server. It also has Ad-Hoc networks that are public, IPv6 addressed, and based on port-range, so you can expose your SSH server to anyone with the IPv6 address, for example.
- artificialLimbs 5y ago
  I had enough problems that I had to stop using it, though when it worked it was fantastic. Client intermittently had seizures (at least on Windows) and I couldn't join/unjoin networks properly. Would have to restart the service and close the program for it to begin to work again. Sometimes the traffic just didn't flow ... at all. Randomly couldn't connect to other clients on the network. I quit about 6 mo ago. Has it improved since?
  - cassianoleal 5y ago
    I haven't had to use it much since covid started as I'm mostly at home these days and I used it to access my LAN when I was out. I have tried to use it over mobile data and wasn't very lucky, and that's something that used to work great. I couldn't tell if it was due to ZT or the carrier. There's CGNAT on both ends, which could be getting in the way, although like I said it used to work great. I have also noticed that it takes longer than I was used to get IP, find routes between nodes, etc but once those are up it works well.
  - mattmein 5y ago
    I've used Zerotier for several years now, and it does feel that the stability on mobile has improved in the past couple of months.
- awesomeusername 5y ago
  I feel like my whole life got simpler with less headaches when I discovered ZT. I adore it. Maybe there are other things out there which do the same thing but ZT is the single 'it just works' thing that has made my life easier the most. Not associated with them in any way other than being a user.
naggie 5y ago
I made this: https://github.com/naggie/dsnet/ https://github.com/naggie/dsnet/ -- a simple command to manage a wireguard VPN. Think wg-quick but quicker: key generation + address allocation. It's not distributed, however.
deleted 5y ago
[deleted]
5e92cb50239222b 5y ago
Don't forget tinc: https://github.com/gsliepen/tinc/tree/1.1 https://github.com/gsliepen/tinc/tree/1.1 It isn't based on WireGuard, but is a true mesh network, unlike everything you've listed. No central coordination point, every node is equal. Think of it as BitTorrent with a few initial peers you set up through a config file, and it learns of every other peer at runtime (like BitTorrent does through Peer Exchange). It can forward traffic through other nodes (like Tailscale and unlike Nebula) and recomputes the most efficient route as peers become (un)available.
- formerly_proven 5y ago
  How secure is tinc?
  - pedrocr 5y ago
    I really like it for my use case but just assume it's not secure at all. I change the default Ubuntu install to not run the daemon as root (a major flaw in my view) and then just assume that network is as insecure as any other. It's really useful to have all my personal machines always connected between each other at the same IP independently of network config. Security comes from SSH/TLS on top of it.
    - formerly_proven 5y ago
      Considering that the wireguard mesh solutions seem to require static IPs, I'm now wondering whether it might be a good idea to run a wireguard mesh on top of tinc, basically just using tinc as a way to get static IPs and routing connectivity between nodes. That still leaves the issue of updating the wireguard configuration, though.
      - JacobiX 5y ago
        Not sure about that, I use Tailscale (wireguard based) and none of my devices have a public IP.
Jiocus 5y ago
Cjdns, > An encrypted IPv6 network using public-key cryptography for address allocation and a distributed hash table for routing. https://github.com/cjdelisle/cjdns https://github.com/cjdelisle/cjdns
JeremyNT 5y ago
Wireguard based solutions get all the attention these days, but I really love working with Nebula. It's dead simple to set up and the mobile client works well. That said, Nebula feels way less popular, and I don't know if it's had a third party security audit. WG's popularity means it should presumably have had a lot of attention given to both its architecture and its code. This is one area where using a "niche" solution feels somewhat risky.
- atonse 5y ago
  Thankfully both Nebula and Wireguard are built on top of the Noise Framework. So neither is a compromise security-design wise.
  - wolverine876 5y ago
    > Thankfully both Nebula and Wireguard are built on top of the Noise Framework. > So neither is a compromise security-design wise. Security involves much more than the crypto framework being used; just crypto requires much more than the framework. Noise could be implemented insecurely, as a basic example.
    - atonse 5y ago
      Yeah that’s probably true. But I meant in the sense of it’s not roll your own crypto.
      - wolverine876 5y ago
        Yes, absolutely. That reduces a lot of likely error.
- KingMachiavelli 5y ago
  Nebula is pretty great. However, the Android client does not allow for specifying a DNS server and breaks the Android system DNS over TLS. Google thinks the VPN app/client should handle DNS and Nebula app development seems very slow. This means you cannot use adblocking DNS while using Nebula.
jordanwhited 5y ago
https://github.com/jwhited/wgsd https://github.com/jwhited/wgsd is a building block that can be used to achieve something similar, minus TURN-like NAT traversal fallback. The peer discovery leverages DNS and UDP hole punching uses WireGuard itself.
nyolfen 5y ago
https://vpncloud.ddswd.de/ https://vpncloud.ddswd.de/
trickstra 5y ago
https://github.com/gravitl/netmaker/ https://github.com/gravitl/netmaker/
handrous 5y ago
A major differentiator for the (many) mesh net projects is whether they are GPL (or similar) or BSD. The latter can be distributed in the iOS/iPadOS App Store, so have a lot more potential value for both hobbyist and business end users. Of course, if it's mostly a server-to-server mesh net with few end user devices, then it hardly matters.
ctrlc-root 5y ago
There's also fastd: https://github.com/NeoRaider/fastd https://github.com/NeoRaider/fastd
cypherpunks1 5y ago
https://codeberg.org/vula/vula https://codeberg.org/vula/vula aims to thwart surveillance adversaries by automatically building wireguard tunnels between LAN hosts with zero configuration using existing IP addresses and .local hostnames inside and outside the tunnels, and uses CSIDH to provide post-quantum protection. Unlike these other projects, it doesn't (yet?) do anything over the internet, and as a result doesn't require a server or any infrastructure. If it is installed on the router, internet-bound traffic is also protected on the LAN.
deleted 5y ago
[deleted]
ukd1 5y ago
https://zerotier.com https://zerotier.com / https://github.com/zerotier/ZeroTierOne https://github.com/zerotier/ZeroTierOne
zxcvbn4038 5y ago
Everyone mentions tailscale but they want to charge you per user. Their client is open source, the thing the client connects to is not. I think there are better options.
- ItalyPaleAle 5y ago
  https://github.com/juanfont/headscale https://github.com/juanfont/headscale replaces the tailscale control panel with something open source and self-hosted. However, it doesn't have all the features of the official tailscale control panel.

by ptman 5y ago

cassianoleal 5y ago

https://zerotier.com https://zerotier.com Not Wireguard based, but similar functionality.

api 5y ago
It has a bunch of other functionality including virtualizing at layer 2 and a distributed rules engine.
- linsomniac 5y ago
  ... and "public" VPNs, where all you need is the network ID to connect. Seems great for playing LAN games. It also has a userspace implementation, which I was able to use on bitbucket CI/CD where I couldn't bring up a tun/tap device, to connect via SSH to a private server. It also has Ad-Hoc networks that are public, IPv6 addressed, and based on port-range, so you can expose your SSH server to anyone with the IPv6 address, for example.
artificialLimbs 5y ago
I had enough problems that I had to stop using it, though when it worked it was fantastic. Client intermittently had seizures (at least on Windows) and I couldn't join/unjoin networks properly. Would have to restart the service and close the program for it to begin to work again. Sometimes the traffic just didn't flow ... at all. Randomly couldn't connect to other clients on the network. I quit about 6 mo ago. Has it improved since?
- cassianoleal 5y ago
  I haven't had to use it much since covid started as I'm mostly at home these days and I used it to access my LAN when I was out. I have tried to use it over mobile data and wasn't very lucky, and that's something that used to work great. I couldn't tell if it was due to ZT or the carrier. There's CGNAT on both ends, which could be getting in the way, although like I said it used to work great. I have also noticed that it takes longer than I was used to get IP, find routes between nodes, etc but once those are up it works well.
- mattmein 5y ago
  I've used Zerotier for several years now, and it does feel that the stability on mobile has improved in the past couple of months.
awesomeusername 5y ago
I feel like my whole life got simpler with less headaches when I discovered ZT. I adore it. Maybe there are other things out there which do the same thing but ZT is the single 'it just works' thing that has made my life easier the most. Not associated with them in any way other than being a user.

naggie 5y ago

I made this: https://github.com/naggie/dsnet/ https://github.com/naggie/dsnet/ -- a simple command to manage a wireguard VPN. Think wg-quick but quicker: key generation + address allocation. It's not distributed, however.

deleted 5y ago

[deleted]

5e92cb50239222b 5y ago

Don't forget tinc: https://github.com/gsliepen/tinc/tree/1.1 https://github.com/gsliepen/tinc/tree/1.1 It isn't based on WireGuard, but is a true mesh network, unlike everything you've listed. No central coordination point, every node is equal. Think of it as BitTorrent with a few initial peers you set up through a config file, and it learns of every other peer at runtime (like BitTorrent does through Peer Exchange). It can forward traffic through other nodes (like Tailscale and unlike Nebula) and recomputes the most efficient route as peers become (un)available.

formerly_proven 5y ago
How secure is tinc?
- pedrocr 5y ago
  I really like it for my use case but just assume it's not secure at all. I change the default Ubuntu install to not run the daemon as root (a major flaw in my view) and then just assume that network is as insecure as any other. It's really useful to have all my personal machines always connected between each other at the same IP independently of network config. Security comes from SSH/TLS on top of it.
  - formerly_proven 5y ago
    Considering that the wireguard mesh solutions seem to require static IPs, I'm now wondering whether it might be a good idea to run a wireguard mesh on top of tinc, basically just using tinc as a way to get static IPs and routing connectivity between nodes. That still leaves the issue of updating the wireguard configuration, though.
    - JacobiX 5y ago
      Not sure about that, I use Tailscale (wireguard based) and none of my devices have a public IP.

Jiocus 5y ago

Cjdns, > An encrypted IPv6 network using public-key cryptography for address allocation and a distributed hash table for routing. https://github.com/cjdelisle/cjdns https://github.com/cjdelisle/cjdns

JeremyNT 5y ago

Wireguard based solutions get all the attention these days, but I really love working with Nebula. It's dead simple to set up and the mobile client works well. That said, Nebula feels way less popular, and I don't know if it's had a third party security audit. WG's popularity means it should presumably have had a lot of attention given to both its architecture and its code. This is one area where using a "niche" solution feels somewhat risky.

atonse 5y ago
Thankfully both Nebula and Wireguard are built on top of the Noise Framework. So neither is a compromise security-design wise.
- wolverine876 5y ago
  > Thankfully both Nebula and Wireguard are built on top of the Noise Framework. > So neither is a compromise security-design wise. Security involves much more than the crypto framework being used; just crypto requires much more than the framework. Noise could be implemented insecurely, as a basic example.
  - atonse 5y ago
    Yeah that’s probably true. But I meant in the sense of it’s not roll your own crypto.
    - wolverine876 5y ago
      Yes, absolutely. That reduces a lot of likely error.
KingMachiavelli 5y ago
Nebula is pretty great. However, the Android client does not allow for specifying a DNS server and breaks the Android system DNS over TLS. Google thinks the VPN app/client should handle DNS and Nebula app development seems very slow. This means you cannot use adblocking DNS while using Nebula.

jordanwhited 5y ago

https://github.com/jwhited/wgsd https://github.com/jwhited/wgsd is a building block that can be used to achieve something similar, minus TURN-like NAT traversal fallback. The peer discovery leverages DNS and UDP hole punching uses WireGuard itself.

nyolfen 5y ago

https://vpncloud.ddswd.de/ https://vpncloud.ddswd.de/

trickstra 5y ago

https://github.com/gravitl/netmaker/ https://github.com/gravitl/netmaker/

handrous 5y ago

A major differentiator for the (many) mesh net projects is whether they are GPL (or similar) or BSD. The latter can be distributed in the iOS/iPadOS App Store, so have a lot more potential value for both hobbyist and business end users. Of course, if it's mostly a server-to-server mesh net with few end user devices, then it hardly matters.

ctrlc-root 5y ago

There's also fastd: https://github.com/NeoRaider/fastd https://github.com/NeoRaider/fastd

cypherpunks1 5y ago

https://codeberg.org/vula/vula https://codeberg.org/vula/vula aims to thwart surveillance adversaries by automatically building wireguard tunnels between LAN hosts with zero configuration using existing IP addresses and .local hostnames inside and outside the tunnels, and uses CSIDH to provide post-quantum protection. Unlike these other projects, it doesn't (yet?) do anything over the internet, and as a result doesn't require a server or any infrastructure. If it is installed on the router, internet-bound traffic is also protected on the LAN.

deleted 5y ago

[deleted]

ukd1 5y ago

https://zerotier.com https://zerotier.com / https://github.com/zerotier/ZeroTierOne https://github.com/zerotier/ZeroTierOne

zxcvbn4038 5y ago

Everyone mentions tailscale but they want to charge you per user. Their client is open source, the thing the client connects to is not. I think there are better options.

ItalyPaleAle 5y ago
https://github.com/juanfont/headscale https://github.com/juanfont/headscale replaces the tailscale control panel with something open source and self-hosted. However, it doesn't have all the features of the official tailscale control panel.