Difference between revisions of "Manual Configuration"

Jump to navigation Jump to search
(→‎Gateway Config: Moving to its own page)
Line 26: Line 26:
  
 
Once these steps are completed, your node will be capable of meshing with any other similarly configured node, as well as relaying encrypted mesh traffic to nodes over the internet if an internet connection is supplied to the node. Clients of the node will also be able to access in-mesh services using mesh IPs that the node assigns to connected devices. You can test this out by visiting the [http://[203:e0b0:ec08:4e1f:f004:19a9:577a:90ba]/wiki/index.php?title=Main_Page in-mesh wiki] while connected to a LAN port of the node.
 
Once these steps are completed, your node will be capable of meshing with any other similarly configured node, as well as relaying encrypted mesh traffic to nodes over the internet if an internet connection is supplied to the node. Clients of the node will also be able to access in-mesh services using mesh IPs that the node assigns to connected devices. You can test this out by visiting the [http://[203:e0b0:ec08:4e1f:f004:19a9:577a:90ba]/wiki/index.php?title=Main_Page in-mesh wiki] while connected to a LAN port of the node.
−
 
−
== Gateway Config ==
 
−
 
−
=== Diagnostics Commands ===
 
−
 
−
tcpdump -nqi any net 4.2.2.1
 
−
ip a | grep 200
 
−
# think metric as in "cost" -> higher is lower priority
 
−
ip route del default via 192.168.42.1 dev enp0s25
 
−
ip route del default via 192.168.42.1 dev enp0s25 metric 700
 
−
./build -d # build w/ debug flag
 
−
env PPROFLISTEN=localhost:6060 ./yggdrasil -useconffile /etc/yggdrasil/yggdrasil.conf
 
−
http://localhost:6060/debug/pprof/
 
−
./yggdrasilctl -v getself
 
−
 
−
=== Gateway Config ===
 
−
 
−
Add <code>0.0.0.0/0</code> to <code>IPv4LocalSubnets</code> and enable <code>TunnelRouting</code> in <code>/etc/yggdrasil.conf</code>
 
−
 
−
TunnelRouting:
 
−
{
 
−
  # Enable or disable tunnel routing.
 
−
  Enable: true
 
−
  # IPv4 subnets belonging to this node's end of the tunnels. Only traffic 
 
−
  # from these ranges will be tunnelled.
 
−
  IPv4LocalSubnets:
 
−
  [
 
−
    0.0.0.0/0
 
−
  ]
 
−
}
 
−
 
−
Restart yggdrasil with <code>systemctl restart yggdrasil.service</code> or <code>service yggdrasil restart</code>
 
−
 
−
Assign an IP/subnet to the yggdrasil interface (<code>tun0</code> or <code>ygg0</code>)
 
−
 
−
ip addr add 10.42.0.1/16 dev tun0
 
−
 
−
For every node using the gateway, pick an IP address in the previous subnet and inform yggdrasil of the public key of the node to be associated with the chosen IP
 
−
 
−
yggdrasilctl addremotesubnet subnet=10.42.0.10/32 box_pub_key=<client_public_key>
 
−
 
−
Finally, add iptables rules to route / forward traffic to the internet. Replace eth0 with the WAN interface of the gateway
 
−
 
−
iptables -A FORWARD -i eth0 -j ACCEPT
 
−
iptables -A FORWARD -o eth0 -j ACCEPT                                                     
 
−
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE                                     
 
−
echo 1 | tee /proc/sys/net/ipv4/ip_forward
 
−
 
−
=== Client Config ===
 
−
 
−
Add <code>0.0.0.0/0</code> to <code>IPv4LocalSubnets</code> and enable <code>TunnelRouting</code> in <code>/etc/yggdrasil.conf</code>
 
−
 
−
TunnelRouting:
 
−
{
 
−
  # Enable or disable tunnel routing.
 
−
  Enable: true
 
−
  # IPv4 subnets belonging to this node's end of the tunnels. Only traffic 
 
−
  # from these ranges will be tunnelled.
 
−
  IPv4LocalSubnets:
 
−
  [
 
−
    0.0.0.0/0
 
−
  ]
 
−
}
 
−
 
−
Restart yggdrasil with <code>systemctl restart yggdrasil.service</code> or <code>service yggdrasil restart</code>
 
−
 
−
Add the IP address allocated on the gateway for this node to the yggdrasil interface
 
−
 
−
ip addr add 10.42.0.10/16 dev ygg0
 
−
 
−
Inform yggdrasil of the gateway node's public key
 
−
 
−
yggdrasilctl addremotesubnet subnet=0.0.0.0/0 box_pub_key=<gateway_public_key>
 
−
 
−
If the client device is connected to WAN, add routes to each yggdrasil peer's IP address to override the default route. Replace <code><peer_ip></code> with the IP address of the yggdrasil peer (likely found in yggdrasil.conf), replace <code><wan_gw></code> with the IP address of the router or gateway the client device is connected to (likely 192.168.1.1), and replace <code><wan_dev></code> with the interface name of the WAN port on the client device. Do this for every peer yggdrasil is configured to use.
 
−
 
−
ip ro add <peer_ip> via <wan_gw> dev <wan_dev>
 
−
 
−
Finally, replace the default route with one pointing to the gateway node's tunnel IP
 
−
 
−
ip ro replace default via 10.42.0.1
 

Revision as of 23:00, 16 January 2020

Configuring your Mesh Node

Once your device has been flashed, the meshing software needs to be set up. Follow these steps to complete the set-up:

  1. Plug your node's WAN port into a network that provides internet access. If your device has multiple ports, check the device page for which one to use.
  2. Navigate to the openwrt configuration page at http://192.168.1.1/
  3. Log in with an empty password and press "Go to password configuration..." to set an administrator password
  4. Optional: Add an ssh key to the SSH-Keys section to allow secure access to the node via ssh.
  5. Enter a new password, uncheck "Password authentication" and "Allow root logins with password". Press "Save & Apply".
  6. Navigate to Network > DHCP and DNS and add 2 values for DNS Forwardings: 200:c493:950a:d576:a413:faef:990b:fb76 and 1.1.1.1, click "Save & Apply" at the bottom
  7. Use scp to send the Yggdrasil package to the node, eg. scp -o StrictHostKeyChecking=no ~/Downloads/yggdrasil_0.3.5-4_aarch64_cortex-a53.ipk root@192.168.1.1:/tmp
  8. Use ssh and your node's password to access the node's command line, eg. ssh root@192.168.1.1
  9. Run opkg update && opkg install kmod-tun nano to prepare the node for Yggdrasil
  10. Run opkg install /tmp/yggdrasil_0.3.5-4_aarch64_cortex-a53.ipk to install Yggdrasil
  11. Use the command nano /etc/yggdrasil.conf to edit the Yggdrasil configuration. Change peers section to include a few public nodes:
    12. { "Peers": [ "tcp://50.236.201.218:56088", "tcp://45.76.166.128:12345", "tcp://45.77.107.150:34660", "tcp://108.175.10.127:61216", "tcp://198.58.100.240:44478" ],...
  12. Press Ctrl + O, Enter, Ctrl + X to edit the text editor
  13. Run yggdrasilctl getSelf and take note of the "IPv6 subnet", for example IPv6 subnet: 300:f86f:fcf9:8479::/64
  14. Run reboot to fully initialize Yggdrasil
  15. Navigate to Network > Interfaces in the Openwrt web configuration and find "ULA Prefix" near the bottom. Replace the value with the IPv6 subnet value from before (starting from 3xx and ending with /64) and click "Save & Apply"
  16. On the same page, click "Edit" next to "LAN" and set "IPv6 assignment length" to 64. Under the DHCP Server section in the "IPv6 Settings" tab, check "Always announce default router". Click Save & Apply
  17. Navigate to Network > Firewall, and find "LAN" in the "Zones" section. Press the Edit button for this zone.
  18. Under the "Inter-Zone Forwarding" section, add "yggdrasil" to both "Allow forward to destination zones:" and "Allow forward from source zones:". Press "Save & Apply".
  19. Optional: To disallow unencrypted usage of the shared internet connection, remove "WAN" from "Allow forward to destination zones:"
  20. Optional: Under Network > Firewall > Traffic Rules, check enable on "Allow-SSH-yggdrasil" to allow ssh access using the node's mesh IP. Click "Save & Apply".

Once these steps are completed, your node will be capable of meshing with any other similarly configured node, as well as relaying encrypted mesh traffic to nodes over the internet if an internet connection is supplied to the node. Clients of the node will also be able to access in-mesh services using mesh IPs that the node assigns to connected devices. You can test this out by visiting the in-mesh wiki while connected to a LAN port of the node.

Retrieved from "https://massmesh.org/wiki/index.php?title=Manual_Configuration&oldid=1585"