[HN Gopher] Testing "Exotic" P2P VPN
___________________________________________________________________
Testing "Exotic" P2P VPN
Author : todsacerdoti
Score : 76 points
Date : 2025-09-28 16:47 UTC (6 hours ago)
(HTM) web link (blog.nommy.moe)
(TXT) w3m dump (blog.nommy.moe)
| jasonjayr wrote:
| FWIW; Tinc has been my workhorse between my various cloud
| providers, some on prem remote access for a few offices I consult
| with, and my home + workstations.
|
| I keep telling myself I should switch it to a wireguard mesh, but
| the configuration of tinc + the "right defaults" make it pretty
| neat. It's fun to watch as you roll out a configuration to one
| node in the mesh, and ping times drop suddenly once it can make a
| direct connection with the optimal route.
|
| I keep my provisioning script + the public keys in git; so
| deploying it to a new machine is a git pull, generate key, push
| public key, and pull on the other nodes. I have about 17+ hosts
| on it; not using it for very high bandwidth, but I couldn't do
| what I do without it.
| HumanOstrich wrote:
| Tinc sounds pretty awesome, but based on the repo activity and
| a post from the author[1], it looks to be unmaintained.
|
| [1]:
| https://github.com/gsliepen/tinc/issues/443#issuecomment-184...
| jasonjayr wrote:
| That is sadly, the biggest worry about it. Once I collect a
| few round tuit's, I wanted to see if I could build up a tool
| to build up the same mesh + routing, perhaps confined to a
| linux namespace so as to keep it contained, and try to
| reproduce the ease of configuration, on top of much better
| maintained core linux tools.
|
| But the key has to be -- the configuration has to be just as
| simple as tinc to be effective. Like, almost just parse the
| configuration files and build it up with WG tunnels.
|
| https://github.com/m13253/VxWireguard-Generator <-- this is
| what I use with a more serious "internal business" use case,
| so I know wireguard is in the sensitive security/encryption
| loop. It uses wireguard tunnels to make a broadcast/mesh
| Layer2 network with vxlan connections, and you then run
| OSPF/babel/your-favorite-routing-protocol over that.
| jrm4 wrote:
| Nailed it. Long time Tinc user here as well for all my personal
| stuff. Besides the fact that onboarding individual machines is
| a garbage process, it's my second best "set it and forget it
| thing" I use; the first being Syncthing which came later (and
| additionally, the two work very nicely together through weird
| edge cases like work VPNS and suc.)
| coppsilgold wrote:
| Sometimes you don't need a P2P VPN, but rather a P2P stream
| manager (eg. BitTorrent).
|
| A somewhat nice solution for that is Iroh (QUIC P2P w/ hole
| punching): https://www.iroh.computer
|
| They also provide a solution to discoverability:
| https://www.iroh.computer/docs/concepts/discovery
|
| Which boils down to storing ECC signed arbitrary data on the
| mainline DHT.
|
| Two showcase Iroh utilities that are actually useful in practice:
|
| https://github.com/n0-computer/dumbpipe
|
| https://github.com/n0-computer/sendme
| ValdikSS wrote:
| There used to be many p2p vpn (full mesh) solutions, which
| disappeared into obscurity.
|
| Social VPN, Remobo, NeoRouter, GBridge, Wippien, PeerVPN.
| Remember any of these?
|
| Just checked -- none of the domains are working.
| mrbluecoat wrote:
| Yep, lots of VPN options:
| https://gist.github.com/mrbluecoat/e725474483dbd81b6195bd3b9...
|
| I'll need to add EasyTier -
| https://github.com/EasyTier/EasyTier
| Imustaskforhelp wrote:
| Hey amazing post. I have a really interesting project which I
| want to share which I really obsess about which is called piping
| server.
|
| https://github.com/nwtgck/piping-server
|
| I really think of ways on how I can use this which seems an
| amazing almost uncensorable-ish tech on how to connect two pc's.
| Like sometimes my brain just thinks "pipes (piping server) just
| for email". Its a bit of an obsession...
|
| Something like a VPN could theoretically be created where the
| piping server well "pipes" it in an encrypted manner through
| internet.
|
| I would love to create something like this just for the funzies
| but what I am more interested about is the transport layer.
|
| Like I want something which can be independent of udp or whatever
| and the only thing I am worried about is how I will transport
| them to the other pc and then I can then lets say send them over
| piping server, send them over matrix or signal if need be too
| idk.
|
| Is there any foss projects that can help me just hook up into
| things in a similar manner as to what I am asking?
|
| I want a implementation independent-ish transport layer so that I
| can experiment with things which I can just pipe if I can be
| really really honest.
|
| I also want more people to look into it as I use sometimes
| piping-server as a way to transporting files between podman
| containers even though its a bit slow just to try it out and
| honestly, just having the fun of installing curl and then being
| ready to go makes it so much more easier to transport files out
| of the box... and I want to experiment more with it, its been an
| obsession for almost an year on and off thinking about piping
| servers and how elegant they are. I used them of sorts to break
| an intel nat once, but since then we got some better options if
| somebody wants to know how to break any nats without any root
| without any emulation but maybe I want to create a blog post
| about it someday but I am lazy.
| ignoramous wrote:
| > _And Amnezia VPN has made their own fork of Wireguard,
| specifically for breaking through government censorship. But the
| main problem with obfuscation is the reduction of effective
| packet MTU_
|
| The "obfuscation" in Amnezia's fork does not shrink the available
| MTU (important for QUIC as it requires a minimum MTU of 1280
| while WireGuard itself needs +80 bytes or so for route
| encapsulation). Amnezia's fork modifies the 4 WireGuard header
| values (which must be pre-agreed between peers) & occassionally
| appends (to handshake packets) or sends randomly generated "junk"
| data.
| 97nomad wrote:
| Yes, this is just a bad writing. I wanted to say something
| about Amnezia, but didn't find a good place for that
| c0balt wrote:
| > And also Nebula's interface is absolutely shit. Instead of a
| normal CLI, you need to configure an internal sshd and connect
| via SSH to localhost. Maybe it's more secure, but it's utterly
| disgusting.
|
| This seems to be a strong misunderstanding? The ssh interface is
| for debugging only. You can disable it and configuration is
| solely handled by the daemon configuration file.
|
| I operate a small (few dozen hosts) network on Nebula with mostly
| NixOS hosts, so I have some applicable experience. Nebula was
| primarily chosen because it allows me to, among other things,
| assign fixed prefixes to hosts and have a full declarative
| config.
|
| You don't configure a host via a CLI, instead you provide it a
| signed cert for the privkey + CA cert + private key + lighthouses
| and that's it. The daemon listens on the IPs from the cert and
| the lighthouses offer a public exchange where peers advertise
| their IPs (and associated endpoints for p2p).
|
| The CA approach is also an important part here as all your peers
| effectively have the CA cert in their config file and use it to
| verify other peers. The CA signs a cert for each host that
| contains the IP prefixes that a peer may handle packets for. The
| only CLI you actually regularly use is here, for creating keys
| and signing certs.
| Jnr wrote:
| I am not sure I understand why Headscale was excluded. As far as
| I know, it is made by people not related to Tailscale.
|
| It would be like complaining Vaultwarden is bad because the
| Bitwarden project is not fully open source even though
| Vaultwarden is fully open source and has most of the features
| implemented.
|
| And Headscale kind of ticks all the other boxes mentioned, except
| "not headscale", because:
|
| * p2p mesh network - it is a mesh network. And even when mesh is
| blocked, you can use multiple relay servers (derp) which will
| relay to the mesh from closest location. And you can host your
| own derp servers.
|
| * Open source and selfhosted - check
|
| * Not Wireguard ( _Signature-based blocking) - in cases where
| wireguard is blocked, the derp relay servers run over https and
| are usually not blocked based on signatures. For example, I use
| it with Traefik proxy in TCP mode so I could run derp and other
| http services on the same 443 port and it works great. So -
| check?
|
| _ Packaged in nixpkgs - check
|
| On top of that, if you add Headplane admin UI you get nice
| graphical management, very similar to the one of Tailscale.
| 97nomad wrote:
| I did it mostly by religious reason, but also because everyone
| writes about Headscale and I didn't want to write about things
| that everyone already knows.
| kdmtctl wrote:
| It uses the same plain WG which doesn't pass across borders by
| the rules of this experiment.
| jis wrote:
| Another one to look at is vpncloud:
| https://github.com/dswd/vpncloud. It's written in Rust. I've used
| it in production for several years now.
| pkd wrote:
| It seems abandoned.
| sznio wrote:
| I'm wondering if a VPN in layer 2 mode would work better for such
| cases.
|
| - Make all participants keep a connection with each other, each
| connection equivalent to an ethernet cable, and each participant
| a network switch.
|
| - Just like real switches, use spanning-tree to decide which
| connection is used for data and which is kept as redundancy.
|
| - Bring your own router/dhcp/etc
|
| I think that would be quite robust.
| sunshine-o wrote:
| A yggdrasil private mesh [0] might be worth evaluating too.
|
| - [0] https://www.complete.org/using-yggdrasil-as-an-automatic-
| mes...
___________________________________________________________________
(page generated 2025-09-28 23:00 UTC)