Documentation: add instructions for running as non-root user on Linux?

[odhnera]

I have done a bit of testing on my Arch Linux install, and by granting the stunmesh-go binary the CAP_NET_ADMIN and CAP_NET_RAW capabilities, it works when running as an unprivileged user. You may want to consider adding instructions for running as non-root to the README file.

# setcap cap_net_admin,cap_net_raw+ep stunmesh-linux-amd64-v1.13.2

[tjjh89017]

Thanks @odhnera
I will put it in the docs!

It works fine in Arch right?
I only tested it in VyOS, Ubuntu, OpenWRT.
I cannot test everything LOL

[tjjh89017]

Nice!
If you are using Android phone, and if willing, please help me to test https://github.com/tjjh89017/stunmesh-android as well.
Thanks!

[odhnera]

I was using the Android app as one of the peers during my testing, and it seemed to work pretty well. I only tested the 'opendht' plugin and not the 'cloudflare' one, and I also only tested IPv4, as my home ISP still doesn't have IPv6 connectivity.

Slightly off-topic, but I also did a bit of testing and discovered that the stunmesh-linux-arm64-ca-v1.13.2 binary will actually run and work in Termux on Android, assuming you have root and are running the official Wireguard app with the kernel backend in use. The CA version is necessary, as without it, TLS errors will be a problem when connecting to the opendht relay. The first major caveat is that Android doesn't have an /etc/resolv.conf file, so stunmesh falls back to connecting to [::1]:53. You can work around this by running a DNS resolver, such as unbound, on localhost:53. The second major caveat is that Linux capabilities don't seem to be respected on Android, so running unbound and stunmesh-go as root is necessary. However, it works, and the arm64 Linux CA stunmesh-go binary can successfully configures the tunnel created by the official Wireguard Android app. Since the WireGuard kernel module is used, this is undoubtedly faster.

[tjjh89017]

that is a cool testing.
I thought Wiregurd android APP still used wg-go backend.
That may not work in every android phone or android device.
But it's worth to remember this.

Thanks for the cool test!!

[odhnera]

I thought Wiregurd android APP still used wg-go backend. That may not work in every android phone or android device. But it's worth to remember this.

The WireGuard Android app will use the kernel module if it's granted root access and the kernel has the WireGuard module (Linux kernel 5.6 and above). If root isn't granted or the kernel is too old, wireguard-go is used as a fallback.

[tjjh89017]

wow, ok
thanks for sharing!