extern/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2024-11-21 23:53:14 +01:00
Code Issues Packages Projects Releases Wiki Activity
Connect your devices into a single secure private WireGuard®-based mesh network with SSO/MFA and simple access controls.
14 Commits 138 Branches 195 Tags 200 MiB
Go 98.1%
Shell 1.7%
C 0.1%
06ca0853b6
Go to file
braginini 06ca0853b6 docs: add readme
2021-05-06 13:53:58 +02:00
.github/workflows project init 2021-05-01 12:45:37 +02:00
cmd chore: add a bit more logs to the init command 2021-05-05 12:15:55 +02:00
connection fix: signal message encryption 2021-05-05 10:40:53 +02:00
iface project init 2021-05-01 12:45:37 +02:00
release_files project init 2021-05-01 12:45:37 +02:00
signal feat: add signal Docker 2021-05-05 15:48:29 +02:00
util project init 2021-05-01 12:45:37 +02:00
.gitignore project init 2021-05-01 12:45:37 +02:00
.goreleaser.yaml project init 2021-05-01 12:45:37 +02:00
Dockerfile feat: add signal Docker 2021-05-05 15:48:29 +02:00
go.mod feat: add wiretrustee init cmd to initialize config 2021-05-01 15:47:24 +02:00
go.sum fix: go mod tidy 2021-05-05 10:59:37 +02:00
main.go project init 2021-05-01 12:45:37 +02:00
README.md docs: add readme 2021-05-06 13:53:58 +02:00

README.md

Wiretrustee

A WireGuard®-based mesh network that connects your devices into a single private network.

Why using Wiretrustee?

  1. Connect multiple devices at home, office or anywhere else to each other via a secure peer-to-peer Wireguard VPN tunnel.
  2. No need to open ports and expose public IPs on the device.
  3. Automatic reconnects in case of network failures or switches.
  4. Automatic NAT traversal.
  5. Relay server fallback in case of an unsuccessful peer-to-peer connection.
  6. Private key never leaves your device.
  7. Works on ARM devices (e.g. Raspberry Pi).

A bit on Wiretrustee internals

  • Wiretrustee uses WebRTC ICE implemented in pion/ice library to discover connection candidates when establishing a peer-to-peer connection between devices.
  • A connection session negotiation between peers is achieved with Wiretrustee Signalling server signal
  • Contents of the messages sent between peers through the signalling server are encrypted with Wireguard keys making it impossible to inspect them. The routing of the messages on a Signalling server is based on public Wireguard keys.
  • Sometimes NAT-traversal is unsuccessful due to strict NATs (e.g. mobile carrier grade NAT).
    For that matter there is a support for a relay server fallback (TURN). In this case a secure Wireguard tunnel is established via a TURN server. Coturn is the one that has been successfully used for STUN and TURN in Wiretrustee setups.

What Wiretrustee is not doing (yet):

  • Wireguard key management. For that reason you need to generate peer keys and specify them on Wiretrustee initialization step. However, the support for the key management feature is in our roadmap.
  • Peer address assignment. You have to specify a unique peer local address (e.g. 10.30.30.1/24) when configuring Wiretrustee Same as for the key management it is in our roadmap.

Installation

  1. Checkout Wiretrustee releases https://github.com/wiretrustee/wiretrustee/releases
  2. Download the latest release:
wget https://github.com/wiretrustee/wiretrustee/releases/download/v0.0.4/wiretrustee_0.0.4_linux_amd64.rpm
  1. Install the package
sudo dpkg -i wiretrustee_0.0.4_linux_amd64.rpm
  1. Initialize Wiretrustee:
sudo wiretrustee init \
 --stunURLs stun:stun.wiretrustee.com:3468,stun:stun.l.google.com:19302 \
 --turnURLs <TURN User>:<TURN password>@turn:stun.wiretrustee.com:3468  \
 --signalAddr signal.wiretrustee.com:10000  \
 --wgLocalAddr 10.30.30.1/24  \
 --log-level info

It is important to mention that wgLocalAddr parameter has to be unique across your network E.g. if you have a Peer A with wgLocalAddr=10.30.30.1/24 then another Peer B can have a wgLocalAddr=10.30.30.2/24

If for some reason you already have a generated Wireguard key you can specify it with --wgKey parameter. If not specified then a new one will be generated, and it's corresponding public key will be output in the log.

A new config will be generated and stored under /etc/wiretrustee/config.json

  1. Add a peer to connect to.
sudo wiretrustee add-peer --allowedIPs 10.30.30.2/32 --key '<REMOTE PEER WIREUARD PUBLIC KEY>'

#Roadmap

  • Android app
  • Key and address management service with SSO