Manual Configuration - Revision history

Stephen304 at 15:58, 13 September 2020

2020-09-13T15:58:04Z

Lurker42o: Link to gateway configuration page

2020-01-17T04:06:05Z

Link to gateway configuration page

Lurker42o: /* Gateway Config */ Moving to its own page

2020-01-17T04:00:47Z

Gateway Config: Moving to its own page

Stephen304: /* Gateway Config */

2019-11-21T03:34:04Z

Gateway Config

Stephen304: /* Gateway Config */

2019-11-20T05:19:48Z

Gateway Config

Lurker42o: /* DO */

2019-11-18T01:47:48Z

Lurker42o: /* DO */

2019-11-18T01:45:43Z

Lurker42o: /* DO */ Fix a couple commands.

2019-11-18T01:13:33Z

DO: Fix a couple commands.

Stephen304 at 00:25, 13 November 2019

2019-11-13T00:25:25Z

Stephen304: Add more nodes, I don't want to be a single point of failure

2019-10-20T22:19:53Z

Add more nodes, I don't want to be a single point of failure

← Older revision		Revision as of 15:58, 13 September 2020
Line 27:		Line 27:
	Once these steps are completed, your node will be capable of meshing with any other similarly configured node, as well as relaying encrypted mesh traffic to nodes over the internet if an internet connection is supplied to the node. Clients of the node will also be able to access in-mesh services using mesh IPs that the node assigns to connected devices. You can test this out by visiting the [http://[203:e0b0:ec08:4e1f:f004:19a9:577a:90ba]/wiki/index.php?title=Main_Page in-mesh wiki] while connected to a LAN port of the node.		Once these steps are completed, your node will be capable of meshing with any other similarly configured node, as well as relaying encrypted mesh traffic to nodes over the internet if an internet connection is supplied to the node. Clients of the node will also be able to access in-mesh services using mesh IPs that the node assigns to connected devices. You can test this out by visiting the [http://[203:e0b0:ec08:4e1f:f004:19a9:577a:90ba]/wiki/index.php?title=Main_Page in-mesh wiki] while connected to a LAN port of the node.

−	{{Note\|At this point, your mesh node cannot access any services 'outside' the Yggdrasil network. To enable that, follow the [[Gateway Configuration]] guide.}}	+	{{Note\|At this point, your mesh node cannot access any services 'outside' the Yggdrasil network. To enable that, follow the [[Manual Gateway Configuration]] guide.}}

← Older revision		Revision as of 04:06, 17 January 2020
Line 26:		Line 26:

	Once these steps are completed, your node will be capable of meshing with any other similarly configured node, as well as relaying encrypted mesh traffic to nodes over the internet if an internet connection is supplied to the node. Clients of the node will also be able to access in-mesh services using mesh IPs that the node assigns to connected devices. You can test this out by visiting the [http://[203:e0b0:ec08:4e1f:f004:19a9:577a:90ba]/wiki/index.php?title=Main_Page in-mesh wiki] while connected to a LAN port of the node.		Once these steps are completed, your node will be capable of meshing with any other similarly configured node, as well as relaying encrypted mesh traffic to nodes over the internet if an internet connection is supplied to the node. Clients of the node will also be able to access in-mesh services using mesh IPs that the node assigns to connected devices. You can test this out by visiting the [http://[203:e0b0:ec08:4e1f:f004:19a9:577a:90ba]/wiki/index.php?title=Main_Page in-mesh wiki] while connected to a LAN port of the node.
		+
		+	{{Note\|At this point, your mesh node cannot access any services 'outside' the Yggdrasil network. To enable that, follow the [[Gateway Configuration]] guide.}}

← Older revision		Revision as of 04:00, 17 January 2020
Line 26:		Line 26:

	Once these steps are completed, your node will be capable of meshing with any other similarly configured node, as well as relaying encrypted mesh traffic to nodes over the internet if an internet connection is supplied to the node. Clients of the node will also be able to access in-mesh services using mesh IPs that the node assigns to connected devices. You can test this out by visiting the [http://[203:e0b0:ec08:4e1f:f004:19a9:577a:90ba]/wiki/index.php?title=Main_Page in-mesh wiki] while connected to a LAN port of the node.		Once these steps are completed, your node will be capable of meshing with any other similarly configured node, as well as relaying encrypted mesh traffic to nodes over the internet if an internet connection is supplied to the node. Clients of the node will also be able to access in-mesh services using mesh IPs that the node assigns to connected devices. You can test this out by visiting the [http://[203:e0b0:ec08:4e1f:f004:19a9:577a:90ba]/wiki/index.php?title=Main_Page in-mesh wiki] while connected to a LAN port of the node.
−
−	~~== Gateway Config ==~~
−
−	~~=== Diagnostics Commands ===~~
−
−	~~tcpdump -nqi any net 4.2.2.1~~
−	~~ip a \| grep 200~~
−	~~# think metric as in "cost" -> higher is lower priority~~
−	~~ip route del default via 192.168.42.1 dev enp0s25~~
−	~~ip route del default via 192.168.42.1 dev enp0s25 metric 700~~
−	~~./build -d # build w/ debug flag~~
−	~~env PPROFLISTEN=localhost:6060 ./yggdrasil -useconffile /etc/yggdrasil/yggdrasil.conf~~
−	~~http://localhost:6060/debug/pprof/~~
−	~~./yggdrasilctl -v getself~~
−
−	~~=== Gateway Config ===~~
−
−	~~Add <code>0.0.0.0/0</code> to <code>IPv4LocalSubnets</code> and enable <code>TunnelRouting</code> in <code>/etc/yggdrasil.conf</code>~~
−
−	~~TunnelRouting:~~
−	{
−	~~# Enable or disable tunnel routing.~~
−	~~Enable: true~~
−	~~# IPv4 subnets belonging to this node's end of the tunnels. Only traffic~~
−	~~# from these ranges will be tunnelled.~~
−	~~IPv4LocalSubnets:~~
−	[
−	~~0.0.0.0/0~~
−	]
−	}
−
−	~~Restart yggdrasil with <code>systemctl restart yggdrasil.service</code> or <code>service yggdrasil restart</code>~~
−
−	~~Assign an IP/subnet to the yggdrasil interface (<code>tun0</code> or <code>ygg0</code>)~~
−
−	~~ip addr add 10.42.0.1/16 dev tun0~~
−
−	~~For every node using the gateway, pick an IP address in the previous subnet and inform yggdrasil of the public key of the node to be associated with the chosen IP~~
−
−	~~yggdrasilctl addremotesubnet subnet=10.42.0.10/32 box_pub_key=<client_public_key>~~
−
−	~~Finally, add iptables rules to route / forward traffic to the internet. Replace eth0 with the WAN interface of the gateway~~
−
−	~~iptables -A FORWARD -i eth0 -j ACCEPT~~
−	~~iptables -A FORWARD -o eth0 -j ACCEPT~~
−	~~iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE~~
−	~~echo 1 \| tee /proc/sys/net/ipv4/ip_forward~~
−
−	~~=== Client Config ===~~
−
−	~~Add <code>0.0.0.0/0</code> to <code>IPv4LocalSubnets</code> and enable <code>TunnelRouting</code> in <code>/etc/yggdrasil.conf</code>~~
−
−	~~TunnelRouting:~~
−	{
−	~~# Enable or disable tunnel routing.~~
−	~~Enable: true~~
−	~~# IPv4 subnets belonging to this node's end of the tunnels. Only traffic~~
−	~~# from these ranges will be tunnelled.~~
−	~~IPv4LocalSubnets:~~
−	[
−	~~0.0.0.0/0~~
−	]
−	}
−
−	~~Restart yggdrasil with <code>systemctl restart yggdrasil.service</code> or <code>service yggdrasil restart</code>~~
−
−	~~Add the IP address allocated on the gateway for this node to the yggdrasil interface~~
−
−	~~ip addr add 10.42.0.10/16 dev ygg0~~
−
−	~~Inform yggdrasil of the gateway node's public key~~
−
−	~~yggdrasilctl addremotesubnet subnet=0.0.0.0/0 box_pub_key=<gateway_public_key>~~
−
−	If the client device is connected to WAN, add routes to each yggdrasil peer's IP address to override the default route. Replace <code><peer_ip></code> with the IP address of the yggdrasil peer (likely found in yggdrasil.conf), replace <code><wan_gw></code> with the IP address of the router or gateway the client device is connected to (likely 192.168.1.1), and replace <code><wan_dev></code> with the interface name of the WAN port on the client device. Do this for every peer yggdrasil is configured to use.
−
−	~~ip ro add <peer_ip> via <wan_gw> dev <wan_dev>~~
−
−	~~Finally, replace the default route with one pointing to the gateway node's tunnel IP~~
−
−	~~ip ro replace default via 10.42.0.1~~

@@ Line 65: / Line 65: @@
 For every node using the gateway, pick an IP address in the previous subnet and inform yggdrasil of the public key of the node to be associated with the chosen IP
-  yggdrasilctl addremotesubnet subnet=10.42.0.10/16 box_pub_key=<client_public_key>
+  yggdrasilctl addremotesubnet subnet=10.42.0.10/32 box_pub_key=<client_public_key>
 Finally, add iptables rules to route / forward traffic to the internet. Replace eth0 with the WAN interface of the gateway

@@ Line 29: / Line 29: @@
 == Gateway Config ==
-=== DIAG ===
+=== Diagnostics Commands ===
   tcpdump -nqi any net 4.2.2.1
@@ Line 41: / Line 41: @@
   ./yggdrasilctl -v getself
-=== DO ===
+=== Gateway Config ===
   iptables -A FORWARD -i eth0 -j ACCEPT
   iptables -A FORWARD -o eth0 -j ACCEPT
@@ Line 54: / Line 74: @@
   echo 1 | tee /proc/sys/net/ipv4/ip_forward
-=== RPI ===
+=== Client Config ===
- yggdrasilctl addlocalsubnet subnet=0.0.0.0/0
+  ip ro add <peer_ip> via <wan_gw> dev <wan_dev>
-=== LAPTOP ===
+Finally, replace the default route with one pointing to the gateway node's tunnel IP
- ./yggdrasilctl addpeer yggdrasil addpeer uri=tcp://167.71.82.204:2617
+  ip ro replace default via 10.42.0.1

@@ Line 49: / Line 49: @@
   yggdrasilctl settunnelrouting enabled
-  iptables -A FORWARD -i ygg0 -j ACCEPT
+  iptables -A FORWARD -i eth0 -j ACCEPT
-  iptables -A FORWARD -o ygg0 -j ACCEPT
+  iptables -A FORWARD -o eth0 -j ACCEPT
   iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
   echo 1 | tee /proc/sys/net/ipv4/ip_forward

@@ Line 46: / Line 46: @@
   yggdrasilctl addremotesubnet subnet=192.168.69.10/24 box_pub_key=c34739a55e013d5fbccd1741658bea2885e418e0c100cffa5f286d1c41c93817 #DO pubkey!
   yggdrasilctl addremotesubnet subnet=192.168.69.30/32 box_pub_key=33da15e48ac664defab0dedca3e91c26e759452ce0ea8f4387925557ca4eb653 #laptop pubkey!
-  ip addr add 192.168.69.1/24 dev ygg0
+  ip addr add 192.168.69.1/24 dev tun0
   yggdrasilctl settunnelrouting enabled

← Older revision		Revision as of 00:25, 13 November 2019
Line 26:		Line 26:

	Once these steps are completed, your node will be capable of meshing with any other similarly configured node, as well as relaying encrypted mesh traffic to nodes over the internet if an internet connection is supplied to the node. Clients of the node will also be able to access in-mesh services using mesh IPs that the node assigns to connected devices. You can test this out by visiting the [http://[203:e0b0:ec08:4e1f:f004:19a9:577a:90ba]/wiki/index.php?title=Main_Page in-mesh wiki] while connected to a LAN port of the node.		Once these steps are completed, your node will be capable of meshing with any other similarly configured node, as well as relaying encrypted mesh traffic to nodes over the internet if an internet connection is supplied to the node. Clients of the node will also be able to access in-mesh services using mesh IPs that the node assigns to connected devices. You can test this out by visiting the [http://[203:e0b0:ec08:4e1f:f004:19a9:577a:90ba]/wiki/index.php?title=Main_Page in-mesh wiki] while connected to a LAN port of the node.
		+
		+	== Gateway Config ==
		+
		+	=== DIAG ===
		+
		+	tcpdump -nqi any net 4.2.2.1
		+	ip a \| grep 200
		+	# think metric as in "cost" -> higher is lower priority
		+	ip route del default via 192.168.42.1 dev enp0s25
		+	ip route del default via 192.168.42.1 dev enp0s25 metric 700
		+	./build -d # build w/ debug flag
		+	env PPROFLISTEN=localhost:6060 ./yggdrasil -useconffile /etc/yggdrasil/yggdrasil.conf
		+	http://localhost:6060/debug/pprof/
		+	./yggdrasilctl -v getself
		+
		+	=== DO ===
		+
		+	yctl addlocalsubnet 0.0.0.0/0
		+	yctl addremotesubnet subnet=192.168.69.10/24 box_pub_key=c34739a55e013d5fbccd1741658bea2885e418e0c100cffa5f286d1c41c93817 #DO pubkey!
		+	yctl addremotesubnet subnet=192.168.69.30/32 box_pub_key=33da15e48ac664defab0dedca3e91c26e759452ce0ea8f4387925557ca4eb653 #laptop pubkey!
		+	ip addr add 192.168.69.1/24 dev ygg0
		+	yggdrasilctl settunnelrouting enabled
		+
		+	iptables -A FORWARD -i ygg0 -j ACCEPT
		+	iptables -A FORWARD -o ygg0 -j ACCEPT
		+	iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
		+	echo 1 \| tee /proc/sys/net/ipv4/ip_forward
		+
		+	=== RPI ===
		+
		+	yggdrasilctl addlocalsubnet subnet=0.0.0.0/0
		+	yggdrasilctl addremotesubnet subnet=0.0.0.0/0 box_pub_key=cb240d63c9d69f2d6b133a77a341f035c2d62507c22f0302e40ace7e0245184e
		+	ip addr add 192.168.69.10/24 dev ygg0
		+	yggdrasilctl settunnelrouting enabled
		+	ip ro add 167.71.82.204 via 192.168.1.1 dev eth1
		+	ip ro replace default via 192.168.69.1
		+	yggdrasilctl addpeer yggdrasil addpeer uri=tcp://167.71.82.204:2617
		+
		+	=== LAPTOP ===
		+
		+	./yggdrasilctl addpeer yggdrasil addpeer uri=tcp://167.71.82.204:2617
		+	./yggdrasilctl addlocalsubnet subnet=0.0.0.0/0
		+	./yggdrasilctl addremotesubnet subnet=0.0.0.0/0 box_pub_key=cb240d63c9d69f2d6b133a77a341f035c2d62507c22f0302e40ace7e0245184e
		+	ip addr add 192.168.69.30/24 dev tun0
		+	./yggdrasilctl settunnelrouting enabled
		+	ip ro add 167.71.82.204 via 192.168.1.1 dev wlp4s0
		+	ip ro replace default via 192.168.69.1
		+
		+	# yggdrasilctl setconfig to set runtime configureation

@@ Line 12: / Line 12: @@
 <li>Run <code>opkg update && opkg install kmod-tun nano</code> to prepare the node for Yggdrasil</li>
 <li>Run <code>opkg install /tmp/yggdrasil_0.3.5-4_aarch64_cortex-a53.ipk</code> to install Yggdrasil</li>
-<li>Use the command <code>nano /etc/yggdrasil.conf</code> to edit the Yggdrasil configuration. Change peers section to include a public node:</li>
+<li>Use the command <code>nano /etc/yggdrasil.conf</code> to edit the Yggdrasil configuration. Change peers section to include a few public nodes:</li>
-<pre>{ "Peers": [ "tcp://50.236.201.218:56088" ],...</pre>
+<pre>{ "Peers": [ "tcp://50.236.201.218:56088", "tcp://45.76.166.128:12345", "tcp://45.77.107.150:34660", "tcp://108.175.10.127:61216", "tcp://198.58.100.240:44478" ],...</pre>
 <li>Press <code>Ctrl + O, Enter, Ctrl + X</code> to edit the text editor</li>
 <li>Run <code>yggdrasilctl getSelf</code> and take note of the "IPv6 subnet", for example <code>IPv6 subnet: 300:f86f:fcf9:8479::/64</code></li>