tinc
sshuttle
Our great sponsors
tinc | sshuttle | |
---|---|---|
19 | 39 | |
1,835 | 11,074 | |
- | 1.4% | |
4.5 | 7.9 | |
10 days ago | 4 days ago | |
C | Python | |
GNU General Public License v3.0 or later | GNU Lesser General Public License v3.0 only |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
tinc
-
Would we still create Nebula today?
But both Nebula and tinc max out at around 1 Gbit/s on my Hetzner servers, thus not using most of my 10 Gbit/s connectivity. This is because they cap out at 100% of 1 CPU. The Nebula issue about that was closed due to "inactivity" [2].
I also observed that when Nebula operates at 100% CPU usage, you get lots of package loss. This causes software that expects reasonable timings on ~0.2ms links to fail (e.g. consensus software like Consul, or Ceph). This in turn led to flakiness / intermittent outages.
I had to resolve to move the big data pushing softwares like Ceph outside of the VPN to get 10 Gbit/s speed for those, and to avoid downtimes due to the packet loss.
Such software like Ceph has its own encryption, but I don't trust it, and that mistrust was recently proven right again [3].
So I'm currently looking to move the Ceph into WireGuard.
Summary: For small-data use, tinc and Nebula are fine, but if you start to push real data, they break.
[1]: https://github.com/gsliepen/tinc/issues/218
[2]: https://github.com/slackhq/nebula/issues/637
[3]: https://github.com/google/security-research/security/advisor...
No love for tinc[1]?
It's the granddaddy of mesh networking, long before Wireguard, and while it's not quite zeroconf, it's very simple to setup and maintain. It also runs on everything.
- Which overlay network?
-
Tailscale/golink: A private shortlink service for tailnets
From a purely networking perspective, there are far better solutions than tailscale.
Have a look at full mesh VPNs like:
https://github.com/cjdelisle/cjdns
https://github.com/yggdrasil-network/yggdrasil-go
https://github.com/gsliepen/tinc
https://github.com/costela/wesher
These build actual mesh networks where every node is equal and can serve as a router for other nodes to resolve difficult network topologies (where some nodes might not be connected to the internet, but do have connections to other nodes with an internet connection).
Sending data through multiple routers is also possible. They also deal with nodes disappearing and change routes accordingly.
tailscale (and similar solutions like netbird) still use a bunch of "proxy servers" for that. You can set them up on intermediate nodes, but that have to be dealt with manually (and you get two kinds of nodes).
-
Tunneling to Synology NAS without opening ports.
Two other options are Tinc https://tinc-vpn.org/ or Nebula https://www.defined.net/nebula/
-
Port Forward Security & Alternatives
And there is Tinc; the OG overlay network. I don't have experience with this. Seemed a bit of a pain to setup. https://tinc-vpn.org
-
WireGuard multihop available in the Mullvad app
For what its worth I have used the open source Tinc VPN [1] for mesh multihop routing for ages. It is nowhere near as fast as Wireguard but I could envision Tinc incorporating support for Wireguard if the author were so inclined. Like you mentioned Tinc does not mesh with other VPN's AFAIK.
[1] - https://tinc-vpn.org/
-
Tinc Is Not Catan
I clicked expected some broken analogy between https://tinc-vpn.org/ and the Catan board game, but instead it is a Catan implementation. Fair enough.
-
Graphviz: Open-source graph visualization software
will generate a real-time network graph using the Graphviz DOT language. It's a cool feature that I find quite useful.
sshuttle
- Curiosità: come fa ChatGPT a bloccare le connessioni dall'Italia? Domanda con esempi...
- Proxify the traffic of your command line apps.
-
Any plans for kernel version in the future?
That's really good to hear! They got a (well deserved!) 100M investment recently. I didn't know it until recently, but apenwarr made some of my favourite tools (sshuttle, bup) and now tailscale! If you come across the podcast again, please post the link, I'd love to listen to it.
-
Wireguard completely banned in Iran
There are several ways suggested there. And as an alternative to SSH tunneling, you can also use sshuttle which is faster and easy to set up.
-
SSH Tunnel vs VPN
Have you seen sshuttle (https://github.com/sshuttle/sshuttle).
-
Share your greatest free tools
sshuttle Let's you route over ssh tunnels.
-
A Database for 2022
> Using openssl with a wrapper service?
One of tailscale's founders already built this: https://github.com/sshuttle/sshuttle
- Impact of tomorrow's EU decision on "unhosted wallets"
-
Top 10 uncommon DevOps tools you should know
Sshuttle is an excellent tool that acts as a “poor man” VPN, allowing you to create a VPN connection from your machine to any remote server you can connect to via ssh. The exciting part is that it is not precisely a VPN and not exactly port forwarding. Internally it assembles the TCP stream locally, multiplexes it statefully over an ssh session, and disassembles it back into packets at the other end to achieve data-over-TCP, which is safe. Useful if your VPN breaks down.
-
My campus has blocked almost all pages and VPNs as well
I generally meant collocate a HTTPS service with a VPN service. I was thinking of a setup I used to run which was something contrived with haproxy sslh and sshuttle. This exploits the property of who talks first in the protocol
What are some alternatives?
OpenVPN - OpenVPN is an open source VPN daemon
Nebula - A scalable overlay networking tool with a focus on performance, simplicity and security
ZeroTier - A Smart Ethernet Switch for Earth
SoftEther - Cross-platform multi-protocol VPN software. Pull requests are welcome. The stable version is available at https://github.com/SoftEtherVPN/SoftEtherVPN_Stable.
tailscale - The easiest, most secure way to use WireGuard and 2FA.
badvpn - NCD scripting language, tun2socks proxifier, P2P VPN
proxychains-ng - proxychains ng (new generation) - a preloader which hooks calls to sockets in dynamically linked programs and redirects it through one or more socks/http proxies. continuation of the unmaintained proxychains project. the sf.net page is currently not updated, use releases from github release page instead.
wsl2-ssh-pageant - bridge between windows pageant and wsl2
docker-ssh-tunnel - Simple SSH tunnel with Docker
headscale - An open source, self-hosted implementation of the Tailscale control server
Pritunl - Enterprise VPN server
proxychains - proxychains - a tool that forces any TCP connection made by any given application to follow through proxy like TOR or any other SOCKS4, SOCKS5 or HTTP(S) proxy. Supported auth-types: "user/pass" for SOCKS4/5, "basic" for HTTP.