9 ms·

Freelan - an open-source, multi-platform, peer-to-peer VPN software

157 points by bowyakka 13y ago

Nanzikambe 13y ago
A little pet peeve, why do people always overlook the most ubiquitous VPN solution of them all? OpenSSH Can create a full spectrum VPN & supports a stronger and a broader range of ciphers than virtually all competing software, is entirely open source, runs on every platform I can think of, the list goes on. Heck via pointopoint it can even mimic freelan and be peer to peer :)
- pault 13y ago
  It takes longer to read the man page than to spin up an AMI with openVPN. That's my only excuse. :)
- rwg 13y ago
  Because... • TCP-in-TCP (or ${ANY_RELIABLE_STREAM}-in-${ANY_RELIABLE_STREAM}) performs very poorly in the face of packet loss. • SSH itself becomes a bottleneck on networks with a large bandwidth-delay product because of statically sized buffers in the client and server. (Though there's been some work done in OpenSSH to mitigate that.) • "Real" VPN software generally has niceties like MSS mangling TCP connections inside the tunnel to help prevent fragmentation of the encapsulated packets due to VPN overhead. SSH is great when you need a quick and dirty tunnel (I use it in SOCKS mode a fair bit), but it's not something I'd want to use for long-lived tunnels that will see a lot of data.
- gaadd33 13y ago
  Its not trivial (afaik) to route all traffic over an OpenSSH connection on most platforms is it? I mean you can have it act as a SOCKS proxy without much trouble but there's no easy way to route DNS lookups over it is there?
  - icebraining 13y ago
    There's sshuttle: https://github.com/apenwarr/sshuttle https://github.com/apenwarr/sshuttle
  - jebblue 13y ago
    Firefox can be made set to do its DNS lookups over SOCKS: http://support.vpnsecure.me/articles/ssh-tunnelling-proxy-troubleshooting/ssh-socks-dns-leaks-in-mozilla-firefox http://support.vpnsecure.me/articles/ssh-tunnelling-proxy-tr...
  - Nanzikambe 13y ago
    It is trivial, I use this simple script to open an SSH tunnel to a remote host, assign me and the remote host private IP on tunnel interfaces (/dev/tun0), setup a pointopoint route between them, nuke my regular routing table & and fix it so my default route points down the newly created tunnel. http://pastebin.com/CxaH6z49 http://pastebin.com/CxaH6z49
    - gaadd33 13y ago
      I wouldn't really call that trivial compared to enabling a VPN connection in most operating systems (i.e. clicking on the vpn icon and saying enable). Also it appears to require root access on the remote machine which would make it difficult to securely let a few people use it. Definitely a useful script for a quick linux to linux tunnel.
- dingaling 13y ago
  SSH is quenched by many firewalls in corporate and hotel networks. Not just blocking port 22 but also dropping the packets based on protocol inspection. There are hacks to tunnel SSH over HTTPS ( really ) but at that point you've abandoned the simplicity of SSH and might as well go with OpenVPN.
  - simgidacav 13y ago
    Oh yeah, Corkscrew! I used that many times! :)
- huhtenberg 13y ago
  It's not P2P unless at least one of the P's is directly accessible.
icebraining 13y ago
When comparing with OpenVPN, they say the latter "does not allow direct client-to-client communication." Can anyone explain it? I thought point-to-point mode was not only supported, but the default.
- blhack 13y ago
  it is the default... (for most practical definitions).
- radiowave 13y ago
  My reading of it is that they appear to be saying that freelan does transparent NAT traversal, whereas OpenVPN would require explicit port-forwarding.
  - jmomo 13y ago
    Scratch everything I said below. After reading what little documentation there is on FreeLAN, which isn't much, it looks like just another VPN solution like all the rest with nothing really special about it. The configuration looks different and it is interesting, but I don't see anything that makes it special, and the products claims of superiority over others seem unfounded. -- I just happen to be here doing my first OpenVPN implementation this last few days. It appears that FreeLAN is all about transparent bridging VPN, rather than routing VPN. Thus, the "LAN" part of the FreeLAN product name is particular apt. It is noteworthy that the words "Ethernet" and "bridging" are absent from the product FAQ. This is most unfortunate.
    - deleted 13y ago
      [deleted]
- Shish2k 13y ago
  I think the key word there is "direct" -- AFAIK FreeLAN is P2P, where OpenVPN is "client -> server -> other client"
  - 13y ago
kika 13y ago
btw, anyone interested in something like this? I have an extensive codebase after trying to build a business around p2p vpn/filesync software. The business didn't go too well (various reasons) but the code is very high quality and still lying around collecting digital dust. We had (we think we had :-)) the best NAT traversal algorithms at that time. Multiplatform - Linux, Win, Mac. Written mostly in very readable old school die hard ANSI C :-) In the wake of the recent NSA-related news I thought that this stuff may find a new use. If you have an idea and would like to devote some time and effort - you're welcome (I guess my contact info is visible in the profile). I have no issues opensourcing it, it contains no close licensed and/or GPL-poisoned code. Everything we borrowed was BSD-type licensed. I just want to have some product to opensource instead of just dumping it on the Github and then waiting 4 billion years for life to conceive itself there :-) Sorry for shameless plug. Update for "Github ++" commenters: I'm all in to put it on Github (BitBucket is more natural in my case, because it's a Hg repo). But: the architecture was quite well thought out and internal APIs are quite clear, but they're not documented. We didn't have immediate open source plans. You wont be able to figure out how to use it, especially if you're going to use our "lower" layer - NAT traversal and friends. You need to know how it works to build a more universal API on top of it. Trust me, I know what I'm talking about - I did a few experiments with this code about a year ago and I spent a _lot_ of time figuring out how we did this and that. And it was _our_ code, we wrote it and discussed it daily for two years.
- gooderlooking 13y ago
  I'd be very interested to check it out if it lands on GitHub. I don't think I'd be much of a contributor up front, I'm still getting my head around all the acronyms tossed around VPN networking, but I have a hobby project for which I've been researching how to build something like this.
- elyase 13y ago
  +1 for Github, I could think of some uses for this.
- StavrosK 13y ago
  Hey, the shameless plug would have been a lot better with a link to a Github repo. I'd advise you to put it up on Github and keep advertising it, good NAT traversal algorithms are probably worth something for open source projects.
autodidakto 13y ago
So this can be an open-source replacement for Himachi/Log-me-in?
- gooderlooking 13y ago
  It's similar in that it's peer-to-peer, but doesn't require an auth/directory server to establish connections. If any known peer is accessible, the two can authenticate directly.
  - kika 13y ago
    To successfully traverse many NATs you need a third party, which is already accessible from two parties trying to handshake.
    - gooderlooking 13y ago
      Yep, that's what I meant by "accessible" too. But with Hamachi, there's a central service for client authentication. With freelan, peers authenticate directly via signed crts.
      - XorNot 13y ago
        I looked into this heavily over the past few days. The punchline is this needs support for NAT traversal and some type of out-of-band way for clients to find each other. NAT traversal is an implementation thing, and I favor Jabber as the out-of-band these days since everyone can get at least a GTalk account. Though we now have libjingle, which basically merges both of these things and would probably elegantly solve the problem. But p2p vpn's aren't much use if you have to control the NAT router you're attached to.
        pyre 13y ago
        > I favor Jabber as the out-of-band these days since everyone can get at least a GTalk account. Isn't that deprecated in favour of Google Hangouts?
spindritf 13y ago
After skimming the website and the FAQ[1] it seems to be a safer tinc[2]. It's a very cool piece of software and I always wanted to set something like that up between my servers and routers but never found a need convincing enough to go through the trouble. [1] http://www.freelan.org/page/faq http://www.freelan.org/page/faq [2] http://www.tinc-vpn.org/ http://www.tinc-vpn.org/
- makefu 13y ago
  The points why freelan is better regarding security are no real issues, but tradeoffs in terms of performance which just copy-pasted from the tinc-vpn security faq[1]. I have been using tinc for quite a long time and it feels pretty stable, but the configuration of new nodes is quite a PITA. For that reason a lot of bootstrapping scripts have been built around this [2]. Also, i love the possibility to easily dump the whole (known) network graph and create great graphs from this info [3]. I am using it mostly for reaching hosts behind NAT and creating a secure environment for these hosts.I never have tried the 'connect whole network' feature. [1] http://www.tinc-vpn.org/security/ http://www.tinc-vpn.org/security/ [2] https://github.com/krebscode/painload/blob/master/retiolum/scripts/tinc_setup/new_install.sh https://github.com/krebscode/painload/blob/master/retiolum/s... [3] http://euer.krebsco.de/graphs/retiolum/retiolum_1.svg http://euer.krebsco.de/graphs/retiolum/retiolum_1.svg
  - bincat 13y ago
    Tinc's problematic protocol (security wise) killed it for me before. For example, it didn't have pfs. It seems that with 1.1pre3 or 4 they have gotten a new, experimental protocol. Hopefully it is an improvement.
devx 13y ago
Could this take advantage of Google's new QUIC protocol, or get any benefits from it? http://en.wikipedia.org/wiki/QUIC http://en.wikipedia.org/wiki/QUIC
- kolev 13y ago
  Pretty good idea, indeed!
AtlasLion 13y ago
How does this compare to Openswan for building multi lan tunnels?
Nesim 13y ago
anyone tried to install on windows 2003 server? no service creates on installation. Also I tried to install service manually "freelan --install" but getting an error. Error: An invalid argument was supplied. Any idea how to run on Windows 2003 32bit server.
- scott_karana 13y ago
  I'm not sure you'll get an answer here. :-) These are a better bet: http://www.freelan.org/page/contact http://www.freelan.org/page/contact
fabware 13y ago
I'm sure there are major typos in the configuration wiki( https://github.com/freelan-developers/freelan-all/wiki/Two-hosts-configuration-sample https://github.com/freelan-developers/freelan-all/wiki/Two-h... ), which prevent me setup two nodes within the same LAN.

157 points by bowyakka 13y ago

A little pet peeve, why do people always overlook the most ubiquitous VPN solution of them all? OpenSSH Can create a full spectrum VPN & supports a stronger and a broader range of ciphers than virtually all competing software, is entirely open source, runs on every platform I can think of, the list goes on. Heck via pointopoint it can even mimic freelan and be peer to peer :)

pault 13y ago
It takes longer to read the man page than to spin up an AMI with openVPN. That's my only excuse. :)
rwg 13y ago
Because... • TCP-in-TCP (or ${ANY_RELIABLE_STREAM}-in-${ANY_RELIABLE_STREAM}) performs very poorly in the face of packet loss. • SSH itself becomes a bottleneck on networks with a large bandwidth-delay product because of statically sized buffers in the client and server. (Though there's been some work done in OpenSSH to mitigate that.) • "Real" VPN software generally has niceties like MSS mangling TCP connections inside the tunnel to help prevent fragmentation of the encapsulated packets due to VPN overhead. SSH is great when you need a quick and dirty tunnel (I use it in SOCKS mode a fair bit), but it's not something I'd want to use for long-lived tunnels that will see a lot of data.
gaadd33 13y ago
Its not trivial (afaik) to route all traffic over an OpenSSH connection on most platforms is it? I mean you can have it act as a SOCKS proxy without much trouble but there's no easy way to route DNS lookups over it is there?
- icebraining 13y ago
  There's sshuttle: https://github.com/apenwarr/sshuttle https://github.com/apenwarr/sshuttle
- jebblue 13y ago
  Firefox can be made set to do its DNS lookups over SOCKS: http://support.vpnsecure.me/articles/ssh-tunnelling-proxy-troubleshooting/ssh-socks-dns-leaks-in-mozilla-firefox http://support.vpnsecure.me/articles/ssh-tunnelling-proxy-tr...
- Nanzikambe 13y ago
  It is trivial, I use this simple script to open an SSH tunnel to a remote host, assign me and the remote host private IP on tunnel interfaces (/dev/tun0), setup a pointopoint route between them, nuke my regular routing table & and fix it so my default route points down the newly created tunnel. http://pastebin.com/CxaH6z49 http://pastebin.com/CxaH6z49
  - gaadd33 13y ago
    I wouldn't really call that trivial compared to enabling a VPN connection in most operating systems (i.e. clicking on the vpn icon and saying enable). Also it appears to require root access on the remote machine which would make it difficult to securely let a few people use it. Definitely a useful script for a quick linux to linux tunnel.
dingaling 13y ago
SSH is quenched by many firewalls in corporate and hotel networks. Not just blocking port 22 but also dropping the packets based on protocol inspection. There are hacks to tunnel SSH over HTTPS ( really ) but at that point you've abandoned the simplicity of SSH and might as well go with OpenVPN.
- simgidacav 13y ago
  Oh yeah, Corkscrew! I used that many times! :)
huhtenberg 13y ago
It's not P2P unless at least one of the P's is directly accessible.

icebraining 13y ago

When comparing with OpenVPN, they say the latter "does not allow direct client-to-client communication." Can anyone explain it? I thought point-to-point mode was not only supported, but the default.

blhack 13y ago
it is the default... (for most practical definitions).
radiowave 13y ago
My reading of it is that they appear to be saying that freelan does transparent NAT traversal, whereas OpenVPN would require explicit port-forwarding.
- jmomo 13y ago
  Scratch everything I said below. After reading what little documentation there is on FreeLAN, which isn't much, it looks like just another VPN solution like all the rest with nothing really special about it. The configuration looks different and it is interesting, but I don't see anything that makes it special, and the products claims of superiority over others seem unfounded. -- I just happen to be here doing my first OpenVPN implementation this last few days. It appears that FreeLAN is all about transparent bridging VPN, rather than routing VPN. Thus, the "LAN" part of the FreeLAN product name is particular apt. It is noteworthy that the words "Ethernet" and "bridging" are absent from the product FAQ. This is most unfortunate.
  - deleted 13y ago
    [deleted]
Shish2k 13y ago
I think the key word there is "direct" -- AFAIK FreeLAN is P2P, where OpenVPN is "client -> server -> other client"
- 13y ago

kika 13y ago

btw, anyone interested in something like this? I have an extensive codebase after trying to build a business around p2p vpn/filesync software. The business didn't go too well (various reasons) but the code is very high quality and still lying around collecting digital dust. We had (we think we had :-)) the best NAT traversal algorithms at that time. Multiplatform - Linux, Win, Mac. Written mostly in very readable old school die hard ANSI C :-) In the wake of the recent NSA-related news I thought that this stuff may find a new use. If you have an idea and would like to devote some time and effort - you're welcome (I guess my contact info is visible in the profile). I have no issues opensourcing it, it contains no close licensed and/or GPL-poisoned code. Everything we borrowed was BSD-type licensed. I just want to have some product to opensource instead of just dumping it on the Github and then waiting 4 billion years for life to conceive itself there :-) Sorry for shameless plug. Update for "Github ++" commenters: I'm all in to put it on Github (BitBucket is more natural in my case, because it's a Hg repo). But: the architecture was quite well thought out and internal APIs are quite clear, but they're not documented. We didn't have immediate open source plans. You wont be able to figure out how to use it, especially if you're going to use our "lower" layer - NAT traversal and friends. You need to know how it works to build a more universal API on top of it. Trust me, I know what I'm talking about - I did a few experiments with this code about a year ago and I spent a _lot_ of time figuring out how we did this and that. And it was _our_ code, we wrote it and discussed it daily for two years.

gooderlooking 13y ago
I'd be very interested to check it out if it lands on GitHub. I don't think I'd be much of a contributor up front, I'm still getting my head around all the acronyms tossed around VPN networking, but I have a hobby project for which I've been researching how to build something like this.
elyase 13y ago
+1 for Github, I could think of some uses for this.
StavrosK 13y ago
Hey, the shameless plug would have been a lot better with a link to a Github repo. I'd advise you to put it up on Github and keep advertising it, good NAT traversal algorithms are probably worth something for open source projects.

autodidakto 13y ago

So this can be an open-source replacement for Himachi/Log-me-in?

gooderlooking 13y ago
It's similar in that it's peer-to-peer, but doesn't require an auth/directory server to establish connections. If any known peer is accessible, the two can authenticate directly.
- kika 13y ago
  To successfully traverse many NATs you need a third party, which is already accessible from two parties trying to handshake.
  - gooderlooking 13y ago
    Yep, that's what I meant by "accessible" too. But with Hamachi, there's a central service for client authentication. With freelan, peers authenticate directly via signed crts.
    - XorNot 13y ago
      I looked into this heavily over the past few days. The punchline is this needs support for NAT traversal and some type of out-of-band way for clients to find each other. NAT traversal is an implementation thing, and I favor Jabber as the out-of-band these days since everyone can get at least a GTalk account. Though we now have libjingle, which basically merges both of these things and would probably elegantly solve the problem. But p2p vpn's aren't much use if you have to control the NAT router you're attached to.
      - pyre 13y ago
        > I favor Jabber as the out-of-band these days since everyone can get at least a GTalk account. Isn't that deprecated in favour of Google Hangouts?

spindritf 13y ago

After skimming the website and the FAQ[1] it seems to be a safer tinc[2]. It's a very cool piece of software and I always wanted to set something like that up between my servers and routers but never found a need convincing enough to go through the trouble. [1] http://www.freelan.org/page/faq http://www.freelan.org/page/faq [2] http://www.tinc-vpn.org/ http://www.tinc-vpn.org/

makefu 13y ago
The points why freelan is better regarding security are no real issues, but tradeoffs in terms of performance which just copy-pasted from the tinc-vpn security faq[1]. I have been using tinc for quite a long time and it feels pretty stable, but the configuration of new nodes is quite a PITA. For that reason a lot of bootstrapping scripts have been built around this [2]. Also, i love the possibility to easily dump the whole (known) network graph and create great graphs from this info [3]. I am using it mostly for reaching hosts behind NAT and creating a secure environment for these hosts.I never have tried the 'connect whole network' feature. [1] http://www.tinc-vpn.org/security/ http://www.tinc-vpn.org/security/ [2] https://github.com/krebscode/painload/blob/master/retiolum/scripts/tinc_setup/new_install.sh https://github.com/krebscode/painload/blob/master/retiolum/s... [3] http://euer.krebsco.de/graphs/retiolum/retiolum_1.svg http://euer.krebsco.de/graphs/retiolum/retiolum_1.svg
- bincat 13y ago
  Tinc's problematic protocol (security wise) killed it for me before. For example, it didn't have pfs. It seems that with 1.1pre3 or 4 they have gotten a new, experimental protocol. Hopefully it is an improvement.

devx 13y ago

Could this take advantage of Google's new QUIC protocol, or get any benefits from it? http://en.wikipedia.org/wiki/QUIC http://en.wikipedia.org/wiki/QUIC

kolev 13y ago
Pretty good idea, indeed!

AtlasLion 13y ago

How does this compare to Openswan for building multi lan tunnels?

Nesim 13y ago

anyone tried to install on windows 2003 server? no service creates on installation. Also I tried to install service manually "freelan --install" but getting an error. Error: An invalid argument was supplied. Any idea how to run on Windows 2003 32bit server.

scott_karana 13y ago
I'm not sure you'll get an answer here. :-) These are a better bet: http://www.freelan.org/page/contact http://www.freelan.org/page/contact

fabware 13y ago

I'm sure there are major typos in the configuration wiki( https://github.com/freelan-developers/freelan-all/wiki/Two-hosts-configuration-sample https://github.com/freelan-developers/freelan-all/wiki/Two-h... ), which prevent me setup two nodes within the same LAN.