Go to file
Andrii Chubatiuk d13f4b5948
fixed recv_errors spoofing condition (#482)
Hi @nbrownus
Fixed a small bug that was introduced in
df7c7ee#diff-5d05d02296a1953fd5fbcb3f4ab486bc5f7c34b14c3bdedb068008ec8ff5beb4
having problems due to it
2021-06-03 13:04:04 -04:00
.github/workflows Remove log when no handshake message is sent (#452) 2021-04-30 18:19:40 -05:00
cert IPv6 support for outside (udp) (#369) 2021-03-18 20:37:24 -05:00
cmd Minor windows focused improvements (#443) 2021-04-30 15:04:47 -05:00
dist Remove obsolete systemd unit settings (take 2) (#438) 2021-04-07 12:02:40 -05:00
e2e Refactor remotes and handshaking to give every address a fair shot (#437) 2021-04-14 13:50:09 -05:00
examples Refactor remotes and handshaking to give every address a fair shot (#437) 2021-04-14 13:50:09 -05:00
sshd Add locking around ssh conns to avoid concurrent map access on reload (#447) 2021-04-23 14:43:16 -05:00
util More like a library (#279) 2020-09-18 09:20:09 -05:00
.gitignore Support for 1.0.0 release 2019-11-19 10:31:59 -08:00
AUTHORS Public Release 2019-11-19 17:00:20 +00:00
CHANGELOG.md fixed recv_errors spoofing condition (#482) 2021-06-03 13:04:04 -04:00
LICENSE Public Release 2019-11-19 17:00:20 +00:00
Makefile Minor windows focused improvements (#443) 2021-04-30 15:04:47 -05:00
README.md Update README for supported platforms (#312) 2020-10-12 13:11:32 -05:00
allow_list.go More LH cleanup (#429) 2021-04-01 10:23:31 -05:00
allow_list_test.go IPv6 support for outside (udp) (#369) 2021-03-18 20:37:24 -05:00
bits.go Don't use a global logger (#423) 2021-03-26 09:46:30 -05:00
bits_test.go Don't use a global logger (#423) 2021-03-26 09:46:30 -05:00
cert.go Don't use a global ca pool (#426) 2021-03-29 12:10:19 -05:00
cidr6_radix.go More LH cleanup (#429) 2021-04-01 10:23:31 -05:00
cidr6_radix_test.go More LH cleanup (#429) 2021-04-01 10:23:31 -05:00
cidr_radix.go More LH cleanup (#429) 2021-04-01 10:23:31 -05:00
cidr_radix_test.go Add a way to find the most specific network 2019-12-09 16:28:58 -08:00
config.go Don't use a global logger (#423) 2021-03-26 09:46:30 -05:00
config_test.go Don't use a global logger (#423) 2021-03-26 09:46:30 -05:00
connection_manager.go Don't use a global logger (#423) 2021-03-26 09:46:30 -05:00
connection_manager_test.go More LH cleanup (#429) 2021-04-01 10:23:31 -05:00
connection_state.go Don't use a global logger (#423) 2021-03-26 09:46:30 -05:00
control.go Fully close tunnels when CloseAllTunnels is called (#448) 2021-04-26 10:42:24 -05:00
control_test.go Refactor remotes and handshaking to give every address a fair shot (#437) 2021-04-14 13:50:09 -05:00
control_tester.go Refactor remotes and handshaking to give every address a fair shot (#437) 2021-04-14 13:50:09 -05:00
dns_server.go Only set serveDns if the host is also configured to be a lighthouse. (#433) 2021-04-16 13:33:56 -05:00
dns_server_test.go Public Release 2019-11-19 17:00:20 +00:00
firewall.go Add more metrics (#450) 2021-04-27 22:23:18 -04:00
firewall_test.go Don't use a global logger (#423) 2021-03-26 09:46:30 -05:00
go.mod Lighthouse performance pass (#418) 2021-03-31 17:32:02 -05:00
go.sum Lighthouse performance pass (#418) 2021-03-31 17:32:02 -05:00
handshake.go Don't use a global logger (#423) 2021-03-26 09:46:30 -05:00
handshake_ix.go Increase the timestamp resolution for handshakes (#453) 2021-05-03 14:10:00 -05:00
handshake_manager.go Remove log when no handshake message is sent (#452) 2021-04-30 18:19:40 -05:00
handshake_manager_test.go Refactor remotes and handshaking to give every address a fair shot (#437) 2021-04-14 13:50:09 -05:00
header.go Public Release 2019-11-19 17:00:20 +00:00
header_test.go enforce the use of goimports (#248) 2020-06-30 18:53:30 -04:00
hostmap.go Unlock the hostmap quickly, lock hostinfo instead (#459) 2021-05-05 13:10:55 -05:00
hostmap_test.go Refactor remotes and handshaking to give every address a fair shot (#437) 2021-04-14 13:50:09 -05:00
inside.go Don't check for rebind if we are closing the tunnel (#457) 2021-05-04 19:15:24 -05:00
interface.go Add more metrics (#450) 2021-04-27 22:23:18 -04:00
lighthouse.go Fix a failed return in an error case (#445) 2021-04-17 18:47:31 -05:00
lighthouse_test.go Refactor remotes and handshaking to give every address a fair shot (#437) 2021-04-14 13:50:09 -05:00
logger.go More like a library (#279) 2020-09-18 09:20:09 -05:00
logger_test.go enforce the use of goimports (#248) 2020-06-30 18:53:30 -04:00
main.go Only set serveDns if the host is also configured to be a lighthouse. (#433) 2021-04-16 13:33:56 -05:00
main_test.go Don't use a global logger (#423) 2021-03-26 09:46:30 -05:00
message_metrics.go add meta packet statistics (#230) 2020-06-26 13:45:48 -04:00
metadata.go Public Release 2019-11-19 17:00:20 +00:00
nebula.pb.go More LH cleanup (#429) 2021-04-01 10:23:31 -05:00
nebula.proto More LH cleanup (#429) 2021-04-01 10:23:31 -05:00
noise.go Correct typos in noise.go (#205) 2020-03-30 11:23:55 -07:00
outside.go fixed recv_errors spoofing condition (#482) 2021-06-03 13:04:04 -04:00
outside_test.go enforce the use of goimports (#248) 2020-06-30 18:53:30 -04:00
punchy.go add configurable punching delay because of race-condition-y conntracks (#210) 2020-03-27 11:26:39 -07:00
punchy_test.go Don't use a global logger (#423) 2021-03-26 09:46:30 -05:00
remote_list.go Get out faster on nil udpAddr (#449) 2021-04-26 20:21:47 -05:00
remote_list_test.go Refactor remotes and handshaking to give every address a fair shot (#437) 2021-04-14 13:50:09 -05:00
ssh.go Fully close tunnels when CloseAllTunnels is called (#448) 2021-04-26 10:42:24 -05:00
stats.go Ensure the Nebula device exists before attempting to bind to the Nebula IP (#375) 2021-04-16 10:34:28 -05:00
timeout.go Public Release 2019-11-19 17:00:20 +00:00
timeout_system.go Public Release 2019-11-19 17:00:20 +00:00
timeout_system_test.go Public Release 2019-11-19 17:00:20 +00:00
timeout_test.go enforce the use of goimports (#248) 2020-06-30 18:53:30 -04:00
tun_android.go Fix tun funcs for ios and android (#446) 2021-04-22 15:23:40 -05:00
tun_common.go unsafe_routes mtu (#209) 2020-04-06 11:33:30 -07:00
tun_darwin.go Start of end to end testing with a good handshake between two nodes (#425) 2021-03-29 14:29:20 -05:00
tun_disabled.go Don't use a global logger (#423) 2021-03-26 09:46:30 -05:00
tun_freebsd.go Start of end to end testing with a good handshake between two nodes (#425) 2021-03-29 14:29:20 -05:00
tun_ios.go Fix tun funcs for ios and android (#446) 2021-04-22 15:23:40 -05:00
tun_linux.go Start of end to end testing with a good handshake between two nodes (#425) 2021-03-29 14:29:20 -05:00
tun_linux_test.go Start of end to end testing with a good handshake between two nodes (#425) 2021-03-29 14:29:20 -05:00
tun_test.go Don't use a global logger (#423) 2021-03-26 09:46:30 -05:00
tun_tester.go Refactor remotes and handshaking to give every address a fair shot (#437) 2021-04-14 13:50:09 -05:00
tun_windows.go Simple lie test (#427) 2021-03-31 10:26:35 -05:00
udp_all.go Get out faster on nil udpAddr (#449) 2021-04-26 20:21:47 -05:00
udp_android.go Don't use a global logger (#423) 2021-03-26 09:46:30 -05:00
udp_darwin.go Don't use a global logger (#423) 2021-03-26 09:46:30 -05:00
udp_freebsd.go Don't use a global logger (#423) 2021-03-26 09:46:30 -05:00
udp_generic.go Don't use a global logger (#423) 2021-03-26 09:46:30 -05:00
udp_linux.go Refactor remotes and handshaking to give every address a fair shot (#437) 2021-04-14 13:50:09 -05:00
udp_linux_32.go Don't use a global logger (#423) 2021-03-26 09:46:30 -05:00
udp_linux_64.go Don't use a global logger (#423) 2021-03-26 09:46:30 -05:00
udp_tester.go Refactor remotes and handshaking to give every address a fair shot (#437) 2021-04-14 13:50:09 -05:00
udp_windows.go Simple lie test (#427) 2021-03-31 10:26:35 -05:00

README.md

What is Nebula?

Nebula is a scalable overlay networking tool with a focus on performance, simplicity and security. It lets you seamlessly connect computers anywhere in the world. Nebula is portable, and runs on Linux, OSX, Windows, iOS, and Android. It can be used to connect a small number of computers, but is also able to connect tens of thousands of computers.

Nebula incorporates a number of existing concepts like encryption, security groups, certificates, and tunneling, and each of those individual pieces existed before Nebula in various forms. What makes Nebula different to existing offerings is that it brings all of these ideas together, resulting in a sum that is greater than its individual parts.

You can read more about Nebula here.

You can also join the NebulaOSS Slack group here

Supported Platforms

Desktop and Server

Check the releases page for downloads

  • Linux - 64 and 32 bit, arm, and others
  • Windows
  • MacOS
  • Freebsd

Mobile

Technical Overview

Nebula is a mutually authenticated peer-to-peer software defined network based on the Noise Protocol Framework. Nebula uses certificates to assert a node's IP address, name, and membership within user-defined groups. Nebula's user-defined groups allow for provider agnostic traffic filtering between nodes. Discovery nodes allow individual peers to find each other and optionally use UDP hole punching to establish connections from behind most firewalls or NATs. Users can move data between nodes in any number of cloud service providers, datacenters, and endpoints, without needing to maintain a particular addressing scheme.

Nebula uses elliptic curve Diffie-Hellman key exchange, and AES-256-GCM in its default configuration.

Nebula was created to provide a mechanism for groups hosts to communicate securely, even across the internet, while enabling expressive firewall definitions similar in style to cloud security groups.

Getting started (quickly)

To set up a Nebula network, you'll need:

1. The Nebula binaries for your specific platform. Specifically you'll need nebula-cert and the specific nebula binary for each platform you use.

2. (Optional, but you really should..) At least one discovery node with a routable IP address, which we call a lighthouse.

Nebula lighthouses allow nodes to find each other, anywhere in the world. A lighthouse is the only node in a Nebula network whose IP should not change. Running a lighthouse requires very few compute resources, and you can easily use the least expensive option from a cloud hosting provider. If you're not sure which provider to use, a number of us have used $5/mo DigitalOcean droplets as lighthouses.

Once you have launched an instance, ensure that Nebula udp traffic (default port udp/4242) can reach it over the internet.

3. A Nebula certificate authority, which will be the root of trust for a particular Nebula network.

./nebula-cert ca -name "Myorganization, Inc"

This will create files named ca.key and ca.cert in the current directory. The ca.key file is the most sensitive file you'll create, because it is the key used to sign the certificates for individual nebula nodes/hosts. Please store this file somewhere safe, preferably with strong encryption.

4. Nebula host keys and certificates generated from that certificate authority

This assumes you have four nodes, named lighthouse1, laptop, server1, host3. You can name the nodes any way you'd like, including FQDN. You'll also need to choose IP addresses and the associated subnet. In this example, we are creating a nebula network that will use 192.168.100.x/24 as its network range. This example also demonstrates nebula groups, which can later be used to define traffic rules in a nebula network.

./nebula-cert sign -name "lighthouse1" -ip "192.168.100.1/24"
./nebula-cert sign -name "laptop" -ip "192.168.100.2/24" -groups "laptop,home,ssh"
./nebula-cert sign -name "server1" -ip "192.168.100.9/24" -groups "servers"
./nebula-cert sign -name "host3" -ip "192.168.100.10/24"

5. Configuration files for each host

Download a copy of the nebula example configuration.

  • On the lighthouse node, you'll need to ensure am_lighthouse: true is set.

  • On the individual hosts, ensure the lighthouse is defined properly in the static_host_map section, and is added to the lighthouse hosts section.

6. Copy nebula credentials, configuration, and binaries to each host

For each host, copy the nebula binary to the host, along with config.yaml from step 5, and the files ca.crt, {host}.crt, and {host}.key from step 4.

DO NOT COPY ca.key TO INDIVIDUAL NODES.

7. Run nebula on each host

./nebula -config /path/to/config.yaml

Building Nebula from source

Download go and clone this repo. Change to the nebula directory.

To build nebula for all platforms: make all

To build nebula for a specific platform (ex, Windows): make bin-windows

See the Makefile for more details on build targets

Credits

Nebula was created at Slack Technologies, Inc by Nate Brown and Ryan Huber, with contributions from Oliver Fross, Alan Lam, Wade Simmons, and Lining Wang.