A scalable overlay networking tool with a focus on performance, simplicity and security

#nebula #slack #slackhq #vpn #mesh #p2p #overlay #network #virtual-network

Dave Russell db11e2f1af Revert "smoke test" 4 gadi atpakaļ
.github db11e2f1af Revert "smoke test" 4 gadi atpakaļ
cert 68e3e84fdc More like a library (#279) 4 gadi atpakaļ
cmd 68e3e84fdc More like a library (#279) 4 gadi atpakaļ
dist 7b3f23d9a1 Start nebula after the network is up (#270) 5 gadi atpakaļ
examples ef498a31da Add disable_timestamp option (#288) 4 gadi atpakaļ
sshd aba42f9fa6 enforce the use of goimports (#248) 5 gadi atpakaļ
util 68e3e84fdc More like a library (#279) 4 gadi atpakaļ
.gitignore c4c334fedb Support for 1.0.0 release 5 gadi atpakaļ
AUTHORS f22b4b584d Public Release 5 gadi atpakaļ
CHANGELOG.md 0d6b55e495 Bring in the new version of kardianos/service and output logfiles on osx (#303) 4 gadi atpakaļ
LICENSE f22b4b584d Public Release 5 gadi atpakaļ
Makefile e94c6b0125 mips-softfloat (#231) 5 gadi atpakaļ
README.md 25bf80d8d3 add new invite link without expiration date (#165) 5 gadi atpakaļ
allow_list.go 0a474e757b Add lighthouse.{remoteAllowList,localAllowList} (#217) 5 gadi atpakaļ
allow_list_test.go 0a474e757b Add lighthouse.{remoteAllowList,localAllowList} (#217) 5 gadi atpakaļ
bits.go f22b4b584d Public Release 5 gadi atpakaļ
bits_test.go 41578ca971 Be more like a library to support mobile (#247) 5 gadi atpakaļ
cert.go 25964b54f6 Use inclusive terminology for cert blocking (#272) 5 gadi atpakaļ
cidr_radix.go c1182869c4 Add a way to find the most specific network 5 gadi atpakaļ
cidr_radix_test.go c1182869c4 Add a way to find the most specific network 5 gadi atpakaļ
config.go ef498a31da Add disable_timestamp option (#288) 4 gadi atpakaļ
config_test.go aba42f9fa6 enforce the use of goimports (#248) 5 gadi atpakaļ
connection_manager.go b4f2f7ce4e log `certName` alongside `vpnIp` (#200) 5 gadi atpakaļ
connection_manager_test.go b37a91cfbc add meta packet statistics (#230) 5 gadi atpakaļ
connection_state.go f22b4b584d Public Release 5 gadi atpakaļ
control.go 2ee428b067 Hook send should use a code path that actually firewalls 4 gadi atpakaļ
control_test.go 68e3e84fdc More like a library (#279) 4 gadi atpakaļ
dns_server.go a086d60edc Allow configuration of dns listener host/port (#74) 5 gadi atpakaļ
dns_server_test.go f22b4b584d Public Release 5 gadi atpakaļ
firewall.go 68e3e84fdc More like a library (#279) 4 gadi atpakaļ
firewall_test.go f3a6d8d990 Preserve conntrack table during firewall rules reload (SIGHUP) (#233) 5 gadi atpakaļ
go.mod 0d6b55e495 Bring in the new version of kardianos/service and output logfiles on osx (#303) 4 gadi atpakaļ
go.sum 0d6b55e495 Bring in the new version of kardianos/service and output logfiles on osx (#303) 4 gadi atpakaļ
handler.go ae3ee42469 Provide hooks for custom message packet handlers 4 gadi atpakaļ
handshake.go 4f6313ebd3 fix config name for {remote,local}_allow_list (#219) 5 gadi atpakaļ
handshake_ix.go 5545cff6ef log remote certificate fingerprint on handshakes (#262) 5 gadi atpakaļ
handshake_manager.go a54f3fc681 fix fast handshake trigger for static hosts (#265) 5 gadi atpakaļ
handshake_manager_test.go 4756c9613d trigger handshakes when lighthouse reply arrives (#246) 5 gadi atpakaļ
header.go 2c931d5691 Move inside packet handlers into map 4 gadi atpakaļ
header_test.go aba42f9fa6 enforce the use of goimports (#248) 5 gadi atpakaļ
hostmap.go b37a91cfbc add meta packet statistics (#230) 5 gadi atpakaļ
hostmap_test.go ff13aba8fc allow `go test -bench=.` to run (#234) 5 gadi atpakaļ
inside.go 2ee428b067 Hook send should use a code path that actually firewalls 4 gadi atpakaļ
interface.go 2ee428b067 Hook send should use a code path that actually firewalls 4 gadi atpakaļ
lighthouse.go 4756c9613d trigger handshakes when lighthouse reply arrives (#246) 5 gadi atpakaļ
lighthouse_test.go aba42f9fa6 enforce the use of goimports (#248) 5 gadi atpakaļ
logger.go 68e3e84fdc More like a library (#279) 4 gadi atpakaļ
logger_test.go aba42f9fa6 enforce the use of goimports (#248) 5 gadi atpakaļ
main.go 68e3e84fdc More like a library (#279) 4 gadi atpakaļ
main_test.go f22b4b584d Public Release 5 gadi atpakaļ
message_metrics.go b37a91cfbc add meta packet statistics (#230) 5 gadi atpakaļ
metadata.go f22b4b584d Public Release 5 gadi atpakaļ
nebula.pb.go f22b4b584d Public Release 5 gadi atpakaļ
nebula.proto f22b4b584d Public Release 5 gadi atpakaļ
noise.go 9e2ff7df57 Correct typos in noise.go (#205) 5 gadi atpakaļ
outside.go ae3ee42469 Provide hooks for custom message packet handlers 4 gadi atpakaļ
outside_test.go aba42f9fa6 enforce the use of goimports (#248) 5 gadi atpakaļ
punchy.go 1297090af3 add configurable punching delay because of race-condition-y conntracks (#210) 5 gadi atpakaļ
punchy_test.go aba42f9fa6 enforce the use of goimports (#248) 5 gadi atpakaļ
ssh.go 6238f1550b Handle panic when invalid IP entered in sshd (#296) 4 gadi atpakaļ
stats.go aba42f9fa6 enforce the use of goimports (#248) 5 gadi atpakaļ
timeout.go f22b4b584d Public Release 5 gadi atpakaļ
timeout_system.go f22b4b584d Public Release 5 gadi atpakaļ
timeout_system_test.go f22b4b584d Public Release 5 gadi atpakaļ
timeout_test.go aba42f9fa6 enforce the use of goimports (#248) 5 gadi atpakaļ
tun_android.go 9b06748506 Make Interface.Inside an interface type (#252) 5 gadi atpakaļ
tun_common.go ff64d1f952 unsafe_routes mtu (#209) 5 gadi atpakaļ
tun_darwin.go 9b06748506 Make Interface.Inside an interface type (#252) 5 gadi atpakaļ
tun_disabled.go 9b8b3c478b Support startup without a tun device (#269) 5 gadi atpakaļ
tun_freebsd.go 9b06748506 Make Interface.Inside an interface type (#252) 5 gadi atpakaļ
tun_ios.go 9b06748506 Make Interface.Inside an interface type (#252) 5 gadi atpakaļ
tun_linux.go 9b06748506 Make Interface.Inside an interface type (#252) 5 gadi atpakaļ
tun_linux_test.go 1ea8847085 linux: set advmss correctly when route MTU is used (#245) 5 gadi atpakaļ
tun_test.go ff64d1f952 unsafe_routes mtu (#209) 5 gadi atpakaļ
tun_windows.go 9b06748506 Make Interface.Inside an interface type (#252) 5 gadi atpakaļ
udp_android.go 68e3e84fdc More like a library (#279) 4 gadi atpakaļ
udp_darwin.go 41578ca971 Be more like a library to support mobile (#247) 5 gadi atpakaļ
udp_freebsd.go 68e3e84fdc More like a library (#279) 4 gadi atpakaļ
udp_generic.go 68e3e84fdc More like a library (#279) 4 gadi atpakaļ
udp_linux.go 68e3e84fdc More like a library (#279) 4 gadi atpakaļ
udp_linux_32.go 41578ca971 Be more like a library to support mobile (#247) 5 gadi atpakaļ
udp_linux_64.go 41578ca971 Be more like a library to support mobile (#247) 5 gadi atpakaļ
udp_windows.go 68e3e84fdc More like a library (#279) 4 gadi atpakaļ

README.md

What is Nebula?

Nebula is a scalable overlay networking tool with a focus on performance, simplicity and security. It lets you seamlessly connect computers anywhere in the world. Nebula is portable, and runs on Linux, OSX, and Windows. (Also: keep this quiet, but we have an early prototype running on iOS). It can be used to connect a small number of computers, but is also able to connect tens of thousands of computers.

Nebula incorporates a number of existing concepts like encryption, security groups, certificates, and tunneling, and each of those individual pieces existed before Nebula in various forms. What makes Nebula different to existing offerings is that it brings all of these ideas together, resulting in a sum that is greater than its individual parts.

You can read more about Nebula here.

You can also join the NebulaOSS Slack group here

Technical Overview

Nebula is a mutually authenticated peer-to-peer software defined network based on the Noise Protocol Framework. Nebula uses certificates to assert a node's IP address, name, and membership within user-defined groups. Nebula's user-defined groups allow for provider agnostic traffic filtering between nodes. Discovery nodes allow individual peers to find each other and optionally use UDP hole punching to establish connections from behind most firewalls or NATs. Users can move data between nodes in any number of cloud service providers, datacenters, and endpoints, without needing to maintain a particular addressing scheme.

Nebula uses elliptic curve Diffie-Hellman key exchange, and AES-256-GCM in its default configuration.

Nebula was created to provide a mechanism for groups hosts to communicate securely, even across the internet, while enabling expressive firewall definitions similar in style to cloud security groups.

Getting started (quickly)

To set up a Nebula network, you'll need:

1. The Nebula binaries for your specific platform. Specifically you'll need nebula-cert and the specific nebula binary for each platform you use.

2. (Optional, but you really should..) At least one discovery node with a routable IP address, which we call a lighthouse.

Nebula lighthouses allow nodes to find each other, anywhere in the world. A lighthouse is the only node in a Nebula network whose IP should not change. Running a lighthouse requires very few compute resources, and you can easily use the least expensive option from a cloud hosting provider. If you're not sure which provider to use, a number of us have used $5/mo DigitalOcean droplets as lighthouses.

Once you have launched an instance, ensure that Nebula udp traffic (default port udp/4242) can reach it over the internet.

3. A Nebula certificate authority, which will be the root of trust for a particular Nebula network.

  ./nebula-cert ca -name "Myorganization, Inc"

This will create files named ca.key and ca.cert in the current directory. The ca.key file is the most sensitive file you'll create, because it is the key used to sign the certificates for individual nebula nodes/hosts. Please store this file somewhere safe, preferably with strong encryption.

4. Nebula host keys and certificates generated from that certificate authority

This assumes you have four nodes, named lighthouse1, laptop, server1, host3. You can name the nodes any way you'd like, including FQDN. You'll also need to choose IP addresses and the associated subnet. In this example, we are creating a nebula network that will use 192.168.100.x/24 as its network range. This example also demonstrates nebula groups, which can later be used to define traffic rules in a nebula network.

./nebula-cert sign -name "lighthouse1" -ip "192.168.100.1/24"
./nebula-cert sign -name "laptop" -ip "192.168.100.2/24" -groups "laptop,home,ssh"
./nebula-cert sign -name "server1" -ip "192.168.100.9/24" -groups "servers"
./nebula-cert sign -name "host3" -ip "192.168.100.10/24"

5. Configuration files for each host

Download a copy of the nebula example configuration.

  • On the lighthouse node, you'll need to ensure am_lighthouse: true is set.

  • On the individual hosts, ensure the lighthouse is defined properly in the static_host_map section, and is added to the lighthouse hosts section.

6. Copy nebula credentials, configuration, and binaries to each host

For each host, copy the nebula binary to the host, along with config.yaml from step 5, and the files ca.crt, {host}.crt, and {host}.key from step 4.

DO NOT COPY ca.key TO INDIVIDUAL NODES.

7. Run nebula on each host

./nebula -config /path/to/config.yaml

Building Nebula from source

Download go and clone this repo. Change to the nebula directory.

To build nebula for all platforms: make all

To build nebula for a specific platform (ex, Windows): make bin-windows

See the Makefile for more details on build targets

Credits

Nebula was created at Slack Technologies, Inc by Nate Brown and Ryan Huber, with contributions from Oliver Fross, Alan Lam, Wade Simmons, and Lining Wang.