https://github.com/tonarino/innernet Skip to content Toggle navigation Sign up * Product + Actions Automate any workflow + Packages Host and manage packages + Security Find and fix vulnerabilities + Codespaces Instant dev environments + Copilot Write better code with AI + Code review Manage code changes + Issues Plan and track work + Discussions Collaborate outside of code + Explore + All features + Documentation + GitHub Skills + Changelog * Solutions + By Plan + Enterprise + Teams + Compare all + By Solution + CI/CD & Automation + DevOps + DevSecOps + Case Studies + Customer Stories + Resources * Open Source + GitHub Sponsors Fund open source developers + The ReadME Project GitHub community articles + Repositories + Topics + Trending + Collections * Pricing [ ] * # In this repository All GitHub | Jump to | * No suggested jump to results * # In this repository All GitHub | Jump to | * # In this organization All GitHub | Jump to | * # In this repository All GitHub | Jump to | Sign in Sign up {{ message }} tonarino / innernet Public * Notifications * Fork 135 * Star 3.6k A private network system that uses WireGuard under the hood. blog.tonari.no/introducing-innernet License MIT license 3.6k stars 135 forks Star Notifications * Code * Issues 66 * Pull requests 3 * Discussions * Actions * Security * Insights More * Code * Issues * Pull requests * Discussions * Actions * Security * Insights tonarino/innernet This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. main Switch branches/tags [ ] Branches Tags Could not load branches Nothing to show {{ refName }} default View all branches Could not load tags Nothing to show {{ refName }} default View all tags 2 branches 42 tags Code * Clone HTTPS GitHub CLI [https://github.com/t] Use Git or checkout with SVN using the web URL. [gh repo clone tonari] Work fast with our official CLI. Learn more. * Open with GitHub Desktop * Download ZIP Launching GitHub Desktop If nothing happens, download GitHub Desktop and try again. Launching GitHub Desktop If nothing happens, download GitHub Desktop and try again. Launching Xcode If nothing happens, download Xcode and try again. Launching Visual Studio Code Your codespace will open once ready. There was a problem preparing your codespace, please try again. Latest commit @mcginty mcginty meta: cargo fmt ... e98c065 Aug 10, 2022 meta: cargo fmt e98c065 Git stats * 295 commits Files Permalink Failed to load latest commit information. Type Name Latest commit message Commit time .github/workflows actions: use Swatinem/rust-cache for simpler build caching Feb 1, 2022 client meta: appease clippy Aug 10, 2022 doc meta: release v1.5.4 Mar 16, 2022 docker-tests docker-tests: add simultaneous peer invitation test Nov 12, 2021 hostsfile meta: fix new cargo clippy warnings Jan 31, 2022 netlink-request meta: cargo update Aug 10, 2022 publicip meta: rust edition 2018 -> 2021 Jan 11, 2022 rpm client, server: add shell completions (#84) May 25, 2021 server meta: appease clippy Aug 10, 2022 shared meta: cargo fmt Aug 10, 2022 wireguard-control meta: appease clippy Aug 10, 2022 .dockerignore docker-tests: initial integration tests (#55) Apr 19, 2021 .gitignore kabloomers. public release v1.0.0 Mar 29, 2021 Cargo.lock shared: update nix to 0.24 Aug 10, 2022 Cargo.toml meta: optimize release binary for size Feb 1, 2022 LICENSE kabloomers. public release v1.0.0 Mar 29, 2021 README.md meta: release v1.5.4 Mar 16, 2022 release.sh release.sh: make sure wireguard-control-sys version is synced Sep 15, 2021 release.toml release: update release.toml for latest cargo-release Jan 11, 2022 rustfmt.toml kabloomers. public release v1.0.0 Mar 29, 2021 taplo.toml kabloomers. public release v1.0.0 Mar 29, 2021 View code [ ] innernet Usage Server Creation Peer Initialization Adding Associations between CIDRs Enabling/Disabling Peers Specifying a Manual Endpoint Setting the Local WireGuard Listen Port Remove Network Security recommendations Enable strict Reverse Path Filtering (RFC 3704) Bind to the WireGuard device IP addresses alone often aren't enough authentication Installation Runtime Dependencies Arch Linux Ubuntu macOS Cargo Development innernet-server Build dependencies innernet Client CLI Build dependencies Releases README.md innernet A private network system that uses WireGuard under the hood. See the announcement blog post for a longer-winded explanation. [118917068-09ae7700-b96b-11eb-80f4-6860072d504d] innernet is similar in its goals to Slack's nebula or Tailscale, but takes a bit of a different approach. It aims to take advantage of existing networking concepts like CIDRs and the security properties of WireGuard to turn your computer's basic IP networking into more powerful ACL primitives. innernet is not an official WireGuard project, and WireGuard is a registered trademark of Jason A. Donenfeld. This has not received an independent security audit, and should be considered experimental software at this early point in its lifetime. Usage Server Creation Every innernet network needs a coordination server to manage peers and provide endpoint information so peers can directly connect to each other. Create a new one with sudo innernet-server new The init wizard will ask you questions about your network and give you some reasonable defaults. It's good to familiarize yourself with network CIDRs as a lot of innernet's access control is based upon them. As an example, let's say the root CIDR for this network is 10.60.0.0/16. Server initialization creates a special "infra" CIDR which contains the innernet server itself and is reachable from all CIDRs on the network. Next we'll also create a humans CIDR where we can start adding some peers. sudo innernet-server add-cidr For the parent CIDR, you can simply choose your network's root CIDR. The name will be humans, and the CIDR will be 10.60.64.0/24 (not a great example unless you only want to support 256 humans, but it works for now...). By default, peers which exist in this new CIDR will only be able to contact peers in the same CIDR, and the special "infra" CIDR which was created when the server was initialized. A typical workflow for creating a new network is to create an admin peer from the innernet-server CLI, and then continue using that admin peer via the innernet client CLI to add any further peers or network CIDRs. sudo innernet-server add-peer Select the humans CIDR, and the CLI will automatically suggest the next available IP address. Any name is fine, just answer "yes" when asked if you would like to make the peer an admin. The process of adding a peer results in an invitation file. This file contains just enough information for the new peer to contact the innernet server and redeem its invitation. It should be transferred securely to the new peer, and it can only be used once to initialize the peer. You can run the server with innernet-server serve , or if you're on Linux and want to run it via systemctl, run systemctl enable --now innernet-server@. If you're on a home network, don't forget to configure port forwarding to the Listen Port you specified when creating the innernet server. Peer Initialization Let's assume the invitation file generated in the steps above have been transferred to the machine a network admin will be using. You can initialize the client with sudo innernet install /path/to/invitation.toml You can customize the network name if you want to, or leave it at the default. innernet will then connect to the innernet server via WireGuard, generate a new key pair, and register that pair with the server. The private key in the invitation file can no longer be used. If everything was successful, the new peer is on the network. You can run things like sudo innernet list or sudo innernet list --tree to view the current network and all CIDRs visible to this peer. Since we created an admin peer, we can also add new peers and CIDRs from this peer via innernet instead of having to always run commands on the server. Adding Associations between CIDRs In order for peers from one CIDR to be able to contact peers in another CIDR, those two CIDRs must be "associated" with each other. With the admin peer we created above, let's add a new CIDR for some theoretical CI servers we have. sudo innernet add-cidr The name is ci-servers and the CIDR is 10.60.64.0/24, but for this example it can be anything. For now, we want peers in the humans CIDR to be able to access peers in the ci-servers CIDR. sudo innernet add-association The CLI will ask you to select the two CIDRs you want to associate. That's all it takes to allow peers in two different CIDRs to communicate! You can verify the association with sudo innernet list-associations and associations can be deleted with sudo innernet delete-associations Enabling/Disabling Peers For security reasons, IP addresses cannot be re-used by new peers, and therefore peers cannot be deleted. However, they can be disabled. Disabled peers will not show up in the list of peers when fetching the config for an interface. Disable a peer with sudo innernet disable-peer Or re-enable a peer with sudo innernet enable-peer Specifying a Manual Endpoint The innernet server will try to use the internet endpoint it sees from a peer so other peers can connect to that peer as well. This doesn't always work and you may want to set an endpoint explicitly. To set an endpoint, use sudo innernet override-endpoint You can go back to automatic endpoint discovery with sudo innernet override-endpoint -u Setting the Local WireGuard Listen Port If you want to change the port which WireGuard listens on, use sudo innernet set-listen-port or unset the port and use a randomized port with sudo innernet set-listen-port -u Remove Network To permanently uninstall a created network, use sudo innernet-server uninstall Use with care! Security recommendations If you're running a service on innernet, there are some important security considerations. Enable strict Reverse Path Filtering (RFC 3704) Strict RPF prevents packets from other interfaces from having internal source IP addresses. This is not the default on Linux, even though it is the right choice for 99.99% of situations. You can enable it by adding the following to a /etc/sysctl.d/ 60-network-security.conf: net.ipv4.conf.all.rp_filter=1 net.ipv4.conf.default.rp_filter=1 Bind to the WireGuard device If possible, to ensure that packets are only ever transmitted over the WireGuard interface, it's recommended that you use SO_BINDTODEVICE on Linux or IP_BOUND_IF on macOS/BSDs. If you have strict reverse path filtering, though, this is less of a concern. IP addresses alone often aren't enough authentication Even following all the above precautions, rogue applications on a peer's machines could be able to make requests on their behalf unless you add extra layers of authentication to mitigate this CSRF-type vector. It's recommended that you carefully consider this possibility before deciding that the source IP is sufficient for your authentication needs on a service. Installation innernet has only officially been tested on Linux and MacOS, but we hope to support as many platforms as is feasible! Runtime Dependencies It's assumed that WireGuard is installed on your system, either via the kernel module in Linux 5.6 and later, or via the wireguard-go userspace implementation. WireGuard Installation Instructions Arch Linux pacman -S innernet Ubuntu Fetch the appropriate .deb packages from https://github.com/tonarino/ innernet/releases and install with sudo apt install ./innernet*.deb macOS brew install tonarino/innernet/innernet Cargo # to install innernet: cargo install --git https://github.com/tonarino/innernet --tag v1.5.4 client # to install innernet-server: cargo install --git https://github.com/tonarino/innernet --tag v1.5.4 server Note that you'll be responsible for updating manually. Development innernet-server Build dependencies * rustc / cargo (version 1.50.0 or higher) * libclang (see more info at https://crates.io/crates/clang-sys) * libsqlite3 Build: cargo build --release --bin innernet-server The resulting binary will be located at ./target/release/ innernet-server innernet Client CLI Build dependencies * rustc / cargo (version 1.50.0 or higher) * libclang (see more info at https://crates.io/crates/clang-sys) Build: cargo build --release --bin innernet The resulting binary will be located at ./target/release/innernet Releases 1. Run cargo release [--dry-run] [minor|major|patch|...] to automatically bump the crates appropriately. 2. Create a new git tag (ex. v0.6.0). 3. Push (with tags) to the repo. innernet uses GitHub Actions to automatically produce a debian package for the releases page. About A private network system that uses WireGuard under the hood. blog.tonari.no/introducing-innernet Resources Readme License MIT license Stars 3.6k stars Watchers 61 watching Forks 135 forks Releases 41 v1.5.4 Latest Mar 16, 2022 + 40 releases Packages 0 No packages published Used by 42 * @firezone * @juanbono * @maaft * @tiberiuv * @CyberFlameGO * @fdkevin0 * @tyong920 * @WillBuik + 34 Contributors 22 * @mcginty * @strohel * @bschwind * @kbknapp * @Johann150 * @dbr * @hellerbarde * @fabaff * @tianon * @alerque * @tommie + 11 contributors Languages * Rust 97.2% * Shell 2.6% * Dockerfile 0.2% Footer (c) 2022 GitHub, Inc. Footer navigation * Terms * Privacy * Security * Status * Docs * Contact GitHub * Pricing * API * Training * Blog * About You can't perform that action at this time. You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.