3 ms·

Could someone explain this please?

• xena 3y ago
  Here's the key paragraph in the article: > In Linux, you can create a TUN/TAP device to let applications control how network or datagram links work. In essence, it lets you create a file descriptor that you can read packets from and write packets to. As long as you get the packets to their intended destination somehow and get any other packets that come back to the same file descriptor, the implementation isn't relevant. This is how OpenVPN, ZeroTier, FreeLAN, Tinc, Hamachi, WireGuard and Tailscale work: they read packets from the kernel, encrypt them, send them to the destination, decrypt incoming packets, and then write them back into the kernel.
• wolfgang42 3y ago
  This is one of those articles where the journey is far more interesting than the destination. (Edit: this comment made more sense when it was replying to a different complaint about the article; the parent comment seems to have been edited in the interim.)
• ignoramous 3y ago
  Setup a TUN/TAP device, which is a file one can read (egress packets) / write to (ingress packets). Setup appropriate ip routes. Read (egress) packets from the TUN/TAP device. Serialize them, assign sequence numbers, and upload them to S3. On the recieve side, poll for newer objects (packets) in S3. Write them to your TUN/TAP device. --- Here, the TUN device is a router using S3 as gateway.
• dikei 3y ago
  So the premise of the problem is the need to egress traffic to the internet from a private VPC, without using an expensive NAT gateway. The solution is to do NAT manually by having an EC2 instance in a public VPC, and tunneling traffic from the private VPC through that instance. The meat of the article is how to create that tunnel using S3 for data transfer instead of using a more traditional VPN service.