Peer-to-peer VPN
Switch branches/tags
Clone or download
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
android Merge pull request #15 from switch-iot/pr2ntop Jun 26, 2018
doc Added instructions for using n2n on MacOS Jun 6, 2018
openwrt/kamikaze Initial SVN import of n2n v2 Oct 23, 2016
packages Use after network-online to avoid DNS resolve and multicast bind issues Dec 14, 2018
win32 Merge of #26 Aug 17, 2018
CHANGELOG.md Added changelog file Aug 17, 2018
CMakeLists.txt Merge of #26 Aug 17, 2018
COPYING Initial SVN import of n2n v2 Oct 23, 2016
INSTALL Initial SVN import of n2n v2 Oct 23, 2016
LICENSE Initial commit Oct 23, 2016
Makefile.in Fixes for OS X build with Macports Oct 9, 2018
README.md Added link to binary packages Oct 4, 2018
autogen.sh Autogen for generatic configure Oct 7, 2018
benchmark.c Merge of #26 Aug 17, 2018
community.list Added the ability to specify (-c) on the supernode the list of allowe… Sep 28, 2018
config.guess Added configure and autogen.sh Oct 7, 2018
configure.ac Added configure and autogen.sh Oct 7, 2018
contributors.txt Refreshed copyright and added contributors list Jun 6, 2018
edge.8 Initial SVN import of n2n v2 Oct 23, 2016
edge.c Added check for missing argument (-l) Dec 4, 2018
edge_utils.c Fix multicast self registration Dec 2, 2018
example_edge_embed.c Added termination variable to edge loop Jun 8, 2018
gen_keyfile.py Initial SVN import of n2n v2 Oct 23, 2016
lzoconf.h Initial SVN import of n2n v2 Oct 23, 2016
lzodefs.h Initial SVN import of n2n v2 Oct 23, 2016
minilzo.c Initial SVN import of n2n v2 Oct 23, 2016
minilzo.h Initial SVN import of n2n v2 Oct 23, 2016
n2n.7 Reworked debian/ubuntu packaging Jun 20, 2018
n2n.c Initial work for local multicast registering (work in progress) Sep 28, 2018
n2n.h Added configure and autogen.sh Oct 7, 2018
n2n.spec Moved to 2.3.x release Jun 8, 2018
n2n_keyfile.c Refreshed copyright and added contributors list Jun 6, 2018
n2n_keyfile.h Refreshed copyright and added contributors list Jun 6, 2018
n2n_transforms.h Code rework Jun 7, 2018
n2n_wire.h Initial work for local multicast registering (work in progress) Sep 28, 2018
sn.c Added the ability to specify (-c) on the supernode the list of allowe… Sep 28, 2018
supernode.1 Initial SVN import of n2n v2 Oct 23, 2016
test.c Refreshed copyright and added contributors list Jun 6, 2018
transform_aes.c Refreshed copyright and added contributors list Jun 6, 2018
transform_null.c Refreshed copyright and added contributors list Jun 6, 2018
transform_tf.c Trace lines are now shorter Jun 14, 2018
tuntap_freebsd.c Fix a few leftover instances which used the old function name Aug 18, 2018
tuntap_linux.c Minor code cleanup Jun 7, 2018
tuntap_netbsd.c Refreshed copyright and added contributors list Jun 6, 2018
tuntap_osx.c Refreshed copyright and added contributors list Jun 6, 2018
twofish.c Initial SVN import of n2n v2 Oct 23, 2016
twofish.h Initial SVN import of n2n v2 Oct 23, 2016
uthash.h Added the ability to specify (-c) on the supernode the list of allowe… Sep 28, 2018
version.c Added configure and autogen.sh Oct 7, 2018
wire.c Refreshed copyright and added contributors list Jun 6, 2018

README.md

N2N

Edge node

You need to start an edge node on each host you want to connect with the same community.

Enable the edge process

$ sudo ./edge -d n2n0 -c mynetwork -k encryptme -u 99 -g 99 -m 3C:A0:12:34:56:78 -a 1.2.3.4 -l a.b.c.d:xyw

or

$ N2N_KEY=encryptme sudo ./edge -d n2n0 -c mynetwork -u 99 -g 99 -m 3C:A0:12:34:56:78 -a 1.2.3.4 -l a.b.c.d:xyw

By defaul the edge will run in background but you can use the -f option to keep it in foreground.

Note that -d, -u, -g and -f options are not available for Windows.

Supernode

You need to start the supernode once (no need to be root unless you want to use a privileged port)

  1. ./supernode -l 1234 -v

Dropping Root Privileges and SUID-Root Executables (UNIX)

The edge node uses superuser privileges to create a TAP network interface device. Once this is created root privileges are not required and can constitute a security hazard if there is some way for an attacker to take control of an edge process while it is running. Edge will drop to a non-privileged user if you specify the -u <uid> and -g <gid> options. These are numeric IDs. Consult /etc/passwd.

You may choose to install edge SUID-root to do this:

  1. Become root
  2. chown root:root edge
  3. chmod +s edge
  4. done

Any user can now run edge. You may not want this, but it may be convenient and safe if your host has only one login user.

Running As a Daemon (UNIX)

Unless given -f as a command line option, edge will call daemon(3) after successful setup. This causes the process to fork a child which closes stdin, stdout and stderr then sets itself as process group leader. When this is done, the edge command returns immediately and you will only see the edge process in the process listings, eg. from ps or top.

If the edge command returns 0 then the daemon started successfully. If it returns non-zero then edge failed to start up for some reason. When edge starts running as a daemon, all logging goes to syslog daemon.info facility.

IPv6 Support

n2n supports the carriage of IPv6 packets within the n2n tunnel. N2n does not yet use IPv6 for transport between edges and supernodes.

To make IPv6 carriage work you need to manually add IPv6 addresses to the TAP interfaces at each end. There is currently no way to specify an IPv6 address on the edge command line.

eg. under linux:

on hostA: [hostA] $ /sbin/ip -6 addr add fc00:abcd:1234::7/48 dev n2n0

on hostB: [hostB] $ /sbin/ip -6 addr add fc00​:abcd:​1234::6/48 dev n2n0

You may find it useful to make use of tunctl from the uml-utilities package. Tunctl allow you to bring up a TAP interface and configure addressing prior to starting edge. It also allows edge to be restarted without the interface closing (which would normally affect routing tables).

Once the IPv6 addresses are configured and edge started, IPv6 neighbor discovery packets flow (get broadcast) and IPv6 entities self arrange. Test your IPv6 setup with ping6 - the IPv6 ping command.

Performance Notes

The time taken to perform a ping test for various ciphers is given below:

Test: ping -f -l 8 -s 800 -c 10000 <far_edge>

AES (-O0) 11820 TF (-O0) 25761

TF (-O2) 20554

AES (-O3) 12532 TF (-O3) 14046 NULL (-O3) 10659

N2N Builder (Supernode Docker Image based on Debian)

Running the supernode image

$ docker run --rm -d -p 5645:5645/udp -p 7654:7654/udp supermock/supernode:[TAGNAME]

Binary packages

If you don't like to compile from source, we build stable and nightly builds that you can find at packages.ntop.org.

Docker registry

Documentation

1. Build image and binaries

Use make command to build the images. Before starting the arm32v7 platform build, you need to run this registry, so you can perform a cross-build. Just follow the documentation: https://github.com/multiarch/qemu-user-static/blob/master/README.md

$ TARGET_ARCHITECTURE=[arm32v7, x86_64, (nothing to build all architectures)] make

2. Push it

Use make push command to push the image, TARGET_ARCHITECTURE is necessary.

$ TARGET_ARCHITECTURE=[arm32v7, x86_64] make push

3. Test it

Once the image is built, it's ready to run:

$ docker run --rm -d -p 5645:5645/udp -p 7654:7654/udp supermock/supernode:[TAGNAME]

(C) 2007-2018 - ntop.org and contributors