A scalable overlay networking tool with a focus on performance, simplicity and security
#nebula #tailscale #mesh #vpn #overlay #p2p

Wade Simmons add1b21777 only create a CIDRTree for each host if necessary (#198) 5 rokov pred
.github 1cb3201b5e Github Actions: cache modules and only run when necessary (#197) 5 rokov pred
cert 328db6bb82 Root constraint usage and support in nebula-cert 5 rokov pred
cmd 1592da921d fix(nebula-cert): flag duration is optional, so reflect this is the cli help (#117) 5 rokov pred
examples 41968551f9 clarify that lighthouse IP should be nebula range (#196) 5 rokov pred
sshd f22b4b584d Public Release 5 rokov pred
.gitignore c4c334fedb Support for 1.0.0 release 5 rokov pred
AUTHORS f22b4b584d Public Release 5 rokov pred
CHANGELOG.md 13941aa723 Prepare for 1.1.0 release. (#167) 5 rokov pred
LICENSE f22b4b584d Public Release 5 rokov pred
Makefile 0eb5ce6b41 better windows targets in Makefile (#125) 5 rokov pred
README.md 25bf80d8d3 add new invite link without expiration date (#165) 5 rokov pred
bits.go f22b4b584d Public Release 5 rokov pred
bits_test.go f22b4b584d Public Release 5 rokov pred
cert.go f22b4b584d Public Release 5 rokov pred
cidr_radix.go c1182869c4 Add a way to find the most specific network 5 rokov pred
cidr_radix_test.go c1182869c4 Add a way to find the most specific network 5 rokov pred
config.go fb9b36f677 allow any config file name if specified directly (#189) 5 rokov pred
config_test.go f22b4b584d Public Release 5 rokov pred
connection_manager.go 9333a8e3b7 subnet support 5 rokov pred
connection_manager_test.go 179a369130 add configuration options for HandshakeManager (#179) 5 rokov pred
connection_state.go f22b4b584d Public Release 5 rokov pred
dns_server.go a086d60edc Allow configuration of dns listener host/port (#74) 5 rokov pred
dns_server_test.go f22b4b584d Public Release 5 rokov pred
firewall.go add1b21777 only create a CIDRTree for each host if necessary (#198) 5 rokov pred
firewall_test.go add1b21777 only create a CIDRTree for each host if necessary (#198) 5 rokov pred
go.mod 065e2ff88a update golang.org/x/crypto (#188) 5 rokov pred
go.sum 065e2ff88a update golang.org/x/crypto (#188) 5 rokov pred
handshake.go 6a460ba38b remove old hmac function. superceded by ix_psk0 5 rokov pred
handshake_ix.go 9333a8e3b7 subnet support 5 rokov pred
handshake_manager.go 179a369130 add configuration options for HandshakeManager (#179) 5 rokov pred
handshake_manager_test.go 179a369130 add configuration options for HandshakeManager (#179) 5 rokov pred
header.go f22b4b584d Public Release 5 rokov pred
header_test.go f22b4b584d Public Release 5 rokov pred
hostmap.go add1b21777 only create a CIDRTree for each host if necessary (#198) 5 rokov pred
hostmap_test.go 9333a8e3b7 subnet support 5 rokov pred
inside.go a91a40212d check that packet isn't bound for my vpn ip (#192) 5 rokov pred
interface.go 45a5de2719 Print the udp listen address on startup (#181) 5 rokov pred
lighthouse.go efe741ad66 Allow ValidateLHStaticEntries to check all static host map entries (#141) 5 rokov pred
lighthouse_test.go 1640a9bc77 Fail with a better error message if lh a hosts is unparsable 5 rokov pred
main.go 179a369130 add configuration options for HandshakeManager (#179) 5 rokov pred
main_test.go f22b4b584d Public Release 5 rokov pred
metadata.go f22b4b584d Public Release 5 rokov pred
nebula.pb.go f22b4b584d Public Release 5 rokov pred
nebula.proto f22b4b584d Public Release 5 rokov pred
noise.go f22b4b584d Public Release 5 rokov pred
outside.go 9333a8e3b7 subnet support 5 rokov pred
outside_test.go f22b4b584d Public Release 5 rokov pred
ssh.go df43f6466e gofmt 5 rokov pred
stats.go e9b0498b21 Correct typo (#150) 5 rokov pred
timeout.go f22b4b584d Public Release 5 rokov pred
timeout_system.go f22b4b584d Public Release 5 rokov pred
timeout_system_test.go f22b4b584d Public Release 5 rokov pred
timeout_test.go f22b4b584d Public Release 5 rokov pred
tun_common.go 9981510554 new mtu setting and const for default 5 rokov pred
tun_darwin.go df69371620 use absolute paths on darwin and windows (#191) 5 rokov pred
tun_linux.go 9db16d226c Make linux tx queue length an error log instead of a fatal on error 5 rokov pred
tun_test.go f22b4b584d Public Release 5 rokov pred
tun_windows.go 4d1928f1e3 Support unsafe_routes on Windows (#184) 5 rokov pred
udp_darwin.go f22b4b584d Public Release 5 rokov pred
udp_generic.go f22b4b584d Public Release 5 rokov pred
udp_linux.go 5350b9ef6f fix listen.host 5 rokov pred
udp_linux_32.go 4bbf6dc29c Rework udp for linux into just 2 files, add more mips targets 5 rokov pred
udp_linux_64.go 4bbf6dc29c Rework udp for linux into just 2 files, add more mips targets 5 rokov pred
udp_windows.go f22b4b584d Public Release 5 rokov pred

README.md

What is Nebula?

Nebula is a scalable overlay networking tool with a focus on performance, simplicity and security. It lets you seamlessly connect computers anywhere in the world. Nebula is portable, and runs on Linux, OSX, and Windows. (Also: keep this quiet, but we have an early prototype running on iOS). It can be used to connect a small number of computers, but is also able to connect tens of thousands of computers.

Nebula incorporates a number of existing concepts like encryption, security groups, certificates, and tunneling, and each of those individual pieces existed before Nebula in various forms. What makes Nebula different to existing offerings is that it brings all of these ideas together, resulting in a sum that is greater than its individual parts.

You can read more about Nebula here.

You can also join the NebulaOSS Slack group here

Technical Overview

Nebula is a mutually authenticated peer-to-peer software defined network based on the Noise Protocol Framework. Nebula uses certificates to assert a node's IP address, name, and membership within user-defined groups. Nebula's user-defined groups allow for provider agnostic traffic filtering between nodes. Discovery nodes allow individual peers to find each other and optionally use UDP hole punching to establish connections from behind most firewalls or NATs. Users can move data between nodes in any number of cloud service providers, datacenters, and endpoints, without needing to maintain a particular addressing scheme.

Nebula uses elliptic curve Diffie-Hellman key exchange, and AES-256-GCM in its default configuration.

Nebula was created to provide a mechanism for groups hosts to communicate securely, even across the internet, while enabling expressive firewall definitions similar in style to cloud security groups.

Getting started (quickly)

To set up a Nebula network, you'll need:

1. The Nebula binaries for your specific platform. Specifically you'll need nebula-cert and the specific nebula binary for each platform you use.

2. (Optional, but you really should..) At least one discovery node with a routable IP address, which we call a lighthouse.

Nebula lighthouses allow nodes to find each other, anywhere in the world. A lighthouse is the only node in a Nebula network whose IP should not change. Running a lighthouse requires very few compute resources, and you can easily use the least expensive option from a cloud hosting provider. If you're not sure which provider to use, a number of us have used $5/mo DigitalOcean droplets as lighthouses.

Once you have launched an instance, ensure that Nebula udp traffic (default port udp/4242) can reach it over the internet.

3. A Nebula certificate authority, which will be the root of trust for a particular Nebula network.

  ./nebula-cert ca -name "Myorganization, Inc"

This will create files named ca.key and ca.cert in the current directory. The ca.key file is the most sensitive file you'll create, because it is the key used to sign the certificates for individual nebula nodes/hosts. Please store this file somewhere safe, preferably with strong encryption.

4. Nebula host keys and certificates generated from that certificate authority

This assumes you have four nodes, named lighthouse1, laptop, server1, host3. You can name the nodes any way you'd like, including FQDN. You'll also need to choose IP addresses and the associated subnet. In this example, we are creating a nebula network that will use 192.168.100.x/24 as its network range. This example also demonstrates nebula groups, which can later be used to define traffic rules in a nebula network.

./nebula-cert sign -name "lighthouse1" -ip "192.168.100.1/24"
./nebula-cert sign -name "laptop" -ip "192.168.100.2/24" -groups "laptop,home,ssh"
./nebula-cert sign -name "server1" -ip "192.168.100.9/24" -groups "servers"
./nebula-cert sign -name "host3" -ip "192.168.100.10/24"

5. Configuration files for each host

Download a copy of the nebula example configuration.

  • On the lighthouse node, you'll need to ensure am_lighthouse: true is set.

  • On the individual hosts, ensure the lighthouse is defined properly in the static_host_map section, and is added to the lighthouse hosts section.

6. Copy nebula credentials, configuration, and binaries to each host

For each host, copy the nebula binary to the host, along with config.yaml from step 5, and the files ca.crt, {host}.crt, and {host}.key from step 4.

DO NOT COPY ca.key TO INDIVIDUAL NODES.

7. Run nebula on each host

./nebula -config /path/to/config.yaml

Building Nebula from source

Download go and clone this repo. Change to the nebula directory.

To build nebula for all platforms: make all

To build nebula for a specific platform (ex, Windows): make bin-windows

See the Makefile for more details on build targets

Credits

Nebula was created at Slack Technologies, Inc by Nate Brown and Ryan Huber, with contributions from Oliver Fross, Alan Lam, Wade Simmons, and Lining Wang.