4 ms·

Is it possible to use Yggdrasil in a way that it never gets connected to the public mesh and without knowing the public IP addresses of all the nodes in your pr

Is it possible to use Yggdrasil in a way that it never gets connected to the public mesh and without knowing the public IP addresses of all the nodes in your private mesh? Specifically, I'm wondering if it's possible to prevent outside nodes from completely establishing a connection to your nodes and therefore cause your private traffic to route over the public mesh. That is, assuming that your Yggdrasil traffic has to route over the public Internet and is not contained within a private network itself.

neilalexander 3y ago
The next version will make it much simpler to deploy isolated networks by using TLS roots to prevent accidental peerings. It's also worth noting that Yggdrasil doesn't have the equivalent of "peer exchange" — only directly connected peers would ever find out your public IP address. Yggdrasil will not form new peerings automatically, with the single exception being multicast-discovered nodes on the same LAN.
- someplaceguy 3y ago
  > The next version will make it much simpler to deploy isolated networks by using TLS roots to prevent accidental peerings. Is that PR #1038 [1]? Any info on how to use that feature and whether it works over multicast as well? I noticed this PR uses SHA-1 for matching fingerprints. SHA-1 has been broken for 18 years now. Is it possible to use something more secure? > It's also worth noting that Yggdrasil doesn't have the equivalent of "peer exchange" — only directly connected peers would ever find out your public IP address. Yggdrasil will not form new peerings automatically, with the single exception being multicast-discovered nodes on the same LAN. Right, my worry is that by having a server with a public IPv4 address and Yggdrasil running on an open port (so that my other nodes can connect to it) will allow someone else to connect to it (either on purpose or accidentally) and cause my traffic to route over their node(s) and/or the public mesh. Thanks! [1] https://github.com/yggdrasil-network/yggdrasil-go/pull/1038 https://github.com/yggdrasil-network/yggdrasil-go/pull/1038

neilalexander 3y ago

The next version will make it much simpler to deploy isolated networks by using TLS roots to prevent accidental peerings. It's also worth noting that Yggdrasil doesn't have the equivalent of "peer exchange" — only directly connected peers would ever find out your public IP address. Yggdrasil will not form new peerings automatically, with the single exception being multicast-discovered nodes on the same LAN.

someplaceguy 3y ago
> The next version will make it much simpler to deploy isolated networks by using TLS roots to prevent accidental peerings. Is that PR #1038 [1]? Any info on how to use that feature and whether it works over multicast as well? I noticed this PR uses SHA-1 for matching fingerprints. SHA-1 has been broken for 18 years now. Is it possible to use something more secure? > It's also worth noting that Yggdrasil doesn't have the equivalent of "peer exchange" — only directly connected peers would ever find out your public IP address. Yggdrasil will not form new peerings automatically, with the single exception being multicast-discovered nodes on the same LAN. Right, my worry is that by having a server with a public IPv4 address and Yggdrasil running on an open port (so that my other nodes can connect to it) will allow someone else to connect to it (either on purpose or accidentally) and cause my traffic to route over their node(s) and/or the public mesh. Thanks! [1] https://github.com/yggdrasil-network/yggdrasil-go/pull/1038 https://github.com/yggdrasil-network/yggdrasil-go/pull/1038