-
Notifications
You must be signed in to change notification settings - Fork 0
Design Project 1
In this design project, I'm going to find and document (testing wherever possible) various hardware and software solutions for BGP and VPN (plus generic routing and firewalling). This should begin with learning more about the requirements involved, such as studying BGP. Next, I'll compare the implementations on-paper to rule out any non-options. Finally, where feasible within this time period, I'll test any remaining options for ease of use and compatibility, documenting the results to help me make a decision on final hardware and software. This should not be a deep-dive into option, optimally ruling out options on paper as early possible and testing only the basic capabilities to ensure there aren't any strange quirks.
The end result of this design project should include tabled comparisons of various options, plus information about how well these options might work with the rest of the DN42 network (ensuring maximum compatibility). The initial documentation need not be deeply technical, that will come later.
- Project 1
- Documentation
- BGP
- VPNs
- Router Hardware
- Peers (In Progress)
During this ~3-week sprint, I did research and some hands-on testing to narrow down the tools and knowledge needed moving forward. I spent time studying the BGP protocol itself, which has helped enormously to understand how to properly set up BGP and how to deal with the quirks of a very complicated (honestly, overengineered) protocol. In addition, I tested several VPN solutions to determine what to use when I eventually connect to DN42, coming to the conclusion that plain GRE tunneling and Wireguard have the best balance between performance, simplicity, and widespread support on the network. I also began scraping data which I can use in the future to find potential peers. Lastly, I evaluated the various hardware options available for routing, ultimately deciding that virtualization provides the most flexibility and ease of integration into other services, but the Protectli Vault may be a viable option depending on VPN performance.
Moving forward, there are a few more research steps that are needed. First, I will continue reading the BGP texts, focusing now on the deployment of BGP rather than the complex protocol itself. I also still need to evaluate possible router operating systems, briefly working hands-on to identify whether they meet the minimum requirements needed for a high-uptime VPN+BGP router. Early research suggests that VyOS is a popular choice due to its powerful configuration interface and baked-in support for the necessary protocols (including Wireguard via a package or a dev build, BGP, and RPKI). Minimal testing is also required to see whether a Protectli Vault will meet the necessary performance thresholds and whether it has any advantage over a virtualized solution. My current plan for Design Project 2 will likely revolve around setting up and documenting a proper 2-peer BGP and VPN session (ideally including rudimentary RPKI), preparing for deployment on the real DN42 network. Following the second design project, all that should be required during the design phase is to register for address space and develop a step-by-step plan for joining the network.