Skip to content
Peer-to-peer VPN
C Java Roff Makefile Lua CMake Other
Branch: dev
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
android Updated instructions, dependencies and configurations for gradle 4.4. Jul 3, 2019
doc Fix typo Aug 16, 2019
legacy Code rework changes Apr 27, 2019
packages Update openwrt instructions with the toolchain setup Jul 7, 2019
win32 Windows compilation fixes Jul 8, 2019
wireshark Add dissector port note Aug 15, 2019
.gitignore Implemnent n2n-decode utility to decode and dump traffic to PCAP Sep 20, 2019
CHANGELOG.md Added changelog file Aug 17, 2018
CMakeLists.txt Unify n2n version Jul 6, 2019
COPYING Initial SVN import of n2n v2 Oct 23, 2016
INSTALL Initial SVN import of n2n v2 Oct 23, 2016
LICENSE Initial commit Oct 23, 2016
Makefile.in Implemnent n2n-decode utility to decode and dump traffic to PCAP Sep 20, 2019
README.md Fix wrong edge conf documentation Aug 8, 2019
autogen.sh Do not run configure in autogen.sh Jul 6, 2019
benchmark.c Code rework changes Apr 27, 2019
community.list Added the ability to specify (-c) on the supernode the list of allowe… Sep 28, 2018
config.guess Added configure and autogen.sh Oct 7, 2018
configure.seed Package fixes Jul 6, 2019
contributors.txt Refreshed copyright and added contributors list Jun 6, 2018
edge.8 Add the -i option to specify registration interval on edge nodes May 5, 2019
edge.c A newline Sep 20, 2019
edge_utils.c MTU changes to avoid connection stall on PMTU discovery failures Aug 16, 2019
example_edge_embed.c n2n.h cleanup Apr 14, 2019
lzoconf.h Initial SVN import of n2n v2 Oct 23, 2016
lzodefs.h Initial SVN import of n2n v2 Oct 23, 2016
minilzo.c Initial SVN import of n2n v2 Oct 23, 2016
minilzo.h Initial SVN import of n2n v2 Oct 23, 2016
n2n.7 Reworked debian/ubuntu packaging Jun 20, 2018
n2n.c Implemnent n2n-decode utility to decode and dump traffic to PCAP Sep 20, 2019
n2n.h Implemnent n2n-decode utility to decode and dump traffic to PCAP Sep 20, 2019
n2n_decode.c Implemnent n2n-decode utility to decode and dump traffic to PCAP Sep 20, 2019
n2n_transforms.h OpenWRT build files and instructions Jul 6, 2019
n2n_wire.h Implemnent n2n-decode utility to decode and dump traffic to PCAP Sep 20, 2019
sn.c Avoid community whitelist purging Aug 15, 2019
supernode.1 Initial SVN import of n2n v2 Oct 23, 2016
transform_aes.c Update openwrt readme Jul 6, 2019
transform_null.c Code rework changes Apr 27, 2019
transform_tf.c Code rework changes Apr 27, 2019
tuntap_freebsd.c Fix a few leftover instances which used the old function name Aug 18, 2018
tuntap_linux.c Remove calls to system() in tuntap_linux Sep 17, 2019
tuntap_netbsd.c Refreshed copyright and added contributors list Jun 6, 2018
tuntap_osx.c Added note to fix /dev/tap problems Dec 22, 2018
twofish.c Properly initialize AES IV and hash the AES key Apr 16, 2019
twofish.h Properly initialize AES IV and hash the AES key Apr 16, 2019
uthash.h Update uthash to version 2.1.0 Jun 9, 2019
wire.c Implement query peer to try p2p during send Jun 8, 2019

README.md

N2N

N2n is a light VPN software which make it easy to create virtual networks bypassing intermediate firewalls.

In order to start using N2N, two elements are required:

  • A supernode: it allows edge nodes to announce and discover other nodes. It must have a port publicly accessible on internet.

  • Edge nodes: the nodes which will be part of the virtual networks

A virtual network shared between multiple edge nodes in n2n is called a community. A single supernode can relay multiple communities and a single PC can be part of multiple communities at the same time. An encryption key can be used by the edge nodes to encrypt the packets within their community.

N2n tries to enstablish a direct P2P connection between the edge nodes when possible. When this is not possible (usually due to special NAT devices), the supernode is also used to relay the packets.

Quick Setup

Some linux distributions already provide n2n as a package so a simple sudo apt-get install n2n will do the work. Alternatively, up to date packages for most distributions are available on ntop repositories.

On host1 run:

$ sudo edge -c mynetwork -k mysecretpass -a 192.168.100.1 -f -l supernode.ntop.org:7777

On host2 run:

$ sudo edge -c mynetwork -k mysecretpass -a 192.168.100.2 -f -l supernode.ntop.org:7777

Now the two hosts can ping each other.

IMPORTANT It is strongly adviced to choose a custom community name (-c) and a secret encryption key (-k) in order to prevent other users to connect to your PC. For privacy and to reduce the above server load, it is also suggested to set up a custom supernode as exmplained below.

Setting up a custom Supernode

You can create your own infrastructure by setting up a supernode on a public server (e.g. a VPS). You just need to open a single port (1234 in the example below) on your firewall (usually iptables).

  1. Install the n2n package
  2. Edit /etc/n2n/supernode.conf and add the following:
-l=1234
  1. Start the supernode service with sudo systemctl start supernode
  2. Optionally enable supernode start on boot: sudo systemctl enable supernode

Now the supernode service should be up and running on port 1234. On your edge nodes you can now specify -l your_supernode_ip:1234 to use it. All the edge nodes must use the same supernode.

Routing the traffic

On linux, n2n provides a standard TAP interface, so routing works gracefully via the standard system utilities as follows.

In this example host1 is the edge router (with n2n IP 192.168.100.1), whereas host2 is the client.

Here is how to configure host1:

  1. Add the -r option to the edge options to enable routing
  2. Enable packet forwarding with sudo sysctl -w net.ipv4.ip_forward=1
  3. Possibly configure iptables to ACCEPT the packets on the FORWARD chain.

On host2, run the edge program as normal to join the host1 community.

In order to forward all the internet traffic via host2:

# Determine the current gateway (e.g. 192.168.1.1)
$ ip route show default

# Add a route to reach the supernode via such gateway
$ sudo ip route add supernode.ntop.org via 192.168.1.1

# Forward all the internet traffic via host1
$ sudo ip route del default
$ sudo ip route add default via 192.168.100.1

This process can be greatly simplified by using the n2n_gateway.sh script.

See Routing.md for other use cases and in depth explanation.

Manual Compilation

On linux, compilation from source is straight forward:

./autogen.sh
./configure
make

# optionally install
make install

For Windows, check out Windows.md for compilation and run instuctions.

For MacOS, check out n2n_on_MacOS.txt.

Running edge as a service

edge can also be run as a service instead of cli:

  1. Edit /etc/n2n/edge.conf with your custom options. See /etc/n2n/edge.conf.sample.
  2. Start the service: sudo systemctl start edge
  3. Optionally enable edge start on boot: sudo systemctl enable edge

You can run multiple edge service instances by creating /etc/n2n/edge-instance1.conf and starting it with sudo systemctl start edge@instance1.

IPv6 Support

N2n can tunnel IPv6 traffic into the virtual network but does not support IPv6 for edge-to-supernode communication yet.

Check out IPv6.md for more information.

Security considerations

n2n edge nodes use twofish encryption by default for compatibility reasons with existing versions.

IMPORTANT Encryption is only applied to the packet payload. Some metadata like the virtual MAC address of the edge nodes, their IP address and the community are sent in cleartext.

When encryption is enabled, the supernode will not be able to decrypt the traffic exchanged between two edge nodes, but it will now that edge A is talking with edge B.

Recently AES encryption support has been implemented, which increases both security and performance, so it is recommended to enable it on all the edge nodes by specifying the -A option.

A benchmark of the encryption methods is available when compiled from source with ./benchmark.

Contribution

You can contribute to n2n in variuos ways:

  • Update an open issue or create a new one with detailed information
  • Propose new features
  • Improve the documentation
  • Provide pull requests with enhancenents

For details about the internals of n2n check out Hacking guide.

Related Projects

Here is a list of third-party projects connected to this repository.


(C) 2007-2019 - ntop.org and contributors

You can’t perform that action at this time.