13
Decentralized VPN with hole punching?(Tailscale with decentralized control server) (realbitcoin.cash)
submitted 1 month ago by to c/linux@programming.dev
11 comments fedilink hide all child comments
 

Hey. I'm currently using Tailscale with a self hosted control server(headscale). The problem's that when the control server goes down for several days(Internet outage, here, in Iran), the clients get lost. And I have to come up with a new control server.

So I'm looking for a solution similar to Tailscale+Headscale, but with decentralized control server and relay.

Note that raw wireguard is not a solution. As some clients are(or might be) behind NATs. And then they will either need hole punching or a relay.

all 11 comments

sorted by: hot top controversial new old
[–] 5 points 1 month ago (6 children)

yggdrasil

https://yggdrasil-network.github.io/

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 3 points 1 month ago (3 children)

    I'm not sure it is censorship resistant

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 4 points 1 month ago

    What's your threat model? No matter what, hole-punching will require some sort of relay. Yggdrasil's likelier than Iroh to have available community servers if you need a hole punched in an adversarial context.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 1 month ago* (1 child)

    It's not, but it doesn't look like they need hardcore censorship resistance if they are able to host and use headscale. It looks like their main problem is internet outages.

    I have been in environmenrs where any usage of wireguard is automatically fingerprinted and blocked.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] [S] 1 point 1 month ago

    During the Internet outages in Iran, most of the nodes inside the country are still accessible through most ISPs. The advertised self healing of yggdrasil sounds promising.

    But just for anyone else's information reading this, we also have censorship on servers inside the country. TLDR, the law has completely vanished in here. You just have to fight, or hide to not get censored or otherwise caught.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 1 month ago

    Yggdrasil is a fun one - I used to have it installed on all my boxes and would use it to ssh into everything. It saved my bacon a few times when internet connectivity for one device went out but because it meshed locally with other devices on the lan that still had internet, traffic got rerouted automatically. LAN peering uses broadcast discovery using ipv6 link local addresses, so it works even if the router dies and you don't have dhcp handing out addresses.

    I just set up a couple instances in the cloud and put a list of their connection details along with a few publicly run nodes as backups into the configs of each. As long as enough stays up for a path to exist you can reach it.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 3 points 1 month ago (1 child)

    Whenever I heard about Iran my mind immediately goes to Tor. (You can run TCP over it) I'm sure there are better options but Tor is certainly the most robust.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 2 points 1 month ago (1 child)

    I recently started using rayfish:

    https://rayfish.xyz/

    Its new and very active, but also the dev uses AI. Its hard to tell where it might go but its de-centralized, it doesn't need a control server and simply works device to device.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •