Freelan - an open-source, multi-platform, peer-to-peer VPN software

http://www.freelan.org/

by bowyakka • 13 years ago

157 68 13 years ago

icebraining3• 13 years ago

When comparing with OpenVPN, they say the latter "does not allow direct client-to-client communication." Can anyone explain it? I thought point-to-point mode was not only supported, but the default.

blhack• 13 years ago

it is the default... (for most practical definitions).

radiowave• 13 years ago

My reading of it is that they appear to be saying that freelan does transparent NAT traversal, whereas OpenVPN would require explicit port-forwarding.

jmomo2• 13 years ago

Scratch everything I said below. After reading what little documentation there is on FreeLAN, which isn't much, it looks like just another VPN solution like all the rest with nothing really special about it. The configuration looks different and it is interesting, but I don't see anything that makes it special, and the products claims of superiority over others seem unfounded.

I just happen to be here doing my first OpenVPN implementation this last few days.

It appears that FreeLAN is all about transparent bridging VPN, rather than routing VPN. Thus, the "LAN" part of the FreeLAN product name is particular apt.

It is noteworthy that the words "Ethernet" and "bridging" are absent from the product FAQ. This is most unfortunate.

Shish2k• 13 years ago

I think the key word there is "direct" -- AFAIK FreeLAN is P2P, where OpenVPN is "client -> server -> other client"

zanny• 13 years ago

But the semantics are silly if you can just host your own server.

JulianMorrison• 13 years ago

OpenVPN is client/server in cert authenticated mode and P2P in symmetric mode. What it doesn't do is routing, so for creation of darknets you need a proper routing daemon, and non colliding IPs. Nor does it tunnel NAT (but it can connect from in NAT to outside, so a group in NAT can be bridged by a hub node on the internet).

gooderlooking4• 13 years ago

With freelan, once the client has established a connection with any other known and accessible freelan client, a direct client-client connection can be made to anyone on the network, even if they are behind a NAT/firewall. I believe it's through a combination of tun/tap, UDP-punching, and proxying, but don't know for certain.

OpenVPN establishes a site-to-site or point-to-site VPN, but routing to the client still goes through the gateway server.

Freelan still requires a known "supernode" to broker the initial connection, but after that, they can either communicate directly or through peers.

jmomo2• 13 years ago

I can't figure out what they are talking about, and documentation on the main site is little to none. There are a few examples, but the actual binaries and config file locations are not documented on the website. I would have to download and install to read more. I suspect english may not be a first language here. I am also very suspect of anyone who uses real-word valid IP addresses in examples, rather than RFC1918 addresses.

kika9• 13 years ago

btw, anyone interested in something like this? I have an extensive codebase after trying to build a business around p2p vpn/filesync software. The business didn't go too well (various reasons) but the code is very high quality and still lying around collecting digital dust. We had (we think we had :-)) the best NAT traversal algorithms at that time. Multiplatform - Linux, Win, Mac. Written mostly in very readable old school die hard ANSI C :-)

In the wake of the recent NSA-related news I thought that this stuff may find a new use. If you have an idea and would like to devote some time and effort - you're welcome (I guess my contact info is visible in the profile).

I have no issues opensourcing it, it contains no close licensed and/or GPL-poisoned code. Everything we borrowed was BSD-type licensed. I just want to have some product to opensource instead of just dumping it on the Github and then waiting 4 billion years for life to conceive itself there :-)

Sorry for shameless plug.

Update for "Github ++" commenters: I'm all in to put it on Github (BitBucket is more natural in my case, because it's a Hg repo). But: the architecture was quite well thought out and internal APIs are quite clear, but they're not documented. We didn't have immediate open source plans. You wont be able to figure out how to use it, especially if you're going to use our "lower" layer - NAT traversal and friends. You need to know how it works to build a more universal API on top of it. Trust me, I know what I'm talking about - I did a few experiments with this code about a year ago and I spent a _lot_ of time figuring out how we did this and that. And it was _our_ code, we wrote it and discussed it daily for two years.

gooderlooking4• 13 years ago

I'd be very interested to check it out if it lands on GitHub. I don't think I'd be much of a contributor up front, I'm still getting my head around all the acronyms tossed around VPN networking, but I have a hobby project for which I've been researching how to build something like this.

elyase• 13 years ago

+1 for Github, I could think of some uses for this.

StavrosK• 13 years ago

Hey, the shameless plug would have been a lot better with a link to a Github repo. I'd advise you to put it up on Github and keep advertising it, good NAT traversal algorithms are probably worth something for open source projects.

balu• 13 years ago

Not an expert, but TeleHash [1] might be a more lightweight alternative than freelan for a lot of applications.

[1] https://github.com/quartzjer/TeleHash/blob/master/org/v2.md

kika9• 13 years ago

wow, I didn't follow this field for a while. Seems to be a great thing, but it's not an alternative, it's a higher layer. Telehash may provide naming, addressing, etc, while the stack I'm talking about basically provides UDP connectivity between parties.

hobs• 13 years ago

Very interested to see something like this.

belorn3• 13 years ago

For a otherwise very interesting and up-vote worthy comment, I really don't know what to do with comments that also include derogatory terms.

The project sound interesting, the comment is very much relevant in today's post-NSA world. So should I downvote, upvote, or not vote at all? If the comment had used a neutral word, rather than a derogatory term, it would not be a question about it.

kika9• 13 years ago

I'd admit a wrongdoing if you can explain how to poison a project with BSD. For me (not an expert in OSS licenses in any way) it sounds like "the victim was poisoned with glass of pure water".

You can vote whatever you feel like, but I'm not selling my opinion for a vote on HN. My opinion is what it is and I can change it if you either provide sufficient argument or threaten my life, health, family or some other factor of my life, more important than my opinion on OSS licensing :-)

I can provide argument why I think GPL is what I think it is, but I seriously doubt this thread is the right place for it.

pnathan3• 13 years ago

I would like to see your project take off - but I would prefer to see such projects as AGPL3.

kika9• 13 years ago

why (AGPL3) ?

AnthonyMouse3• 13 years ago

Specifically what NAT traversal methods did you use? I'm always interested to hear about new ones I may not know about.

carterschonwald2• 13 years ago

throw it on bitbucket with some sort of bsd/mit style license and share it with the world.

or at least do it and get enough folks excited that some volunteers help add docs :)

do it!

autodidakto• 13 years ago

So this can be an open-source replacement for Himachi/Log-me-in?

gooderlooking4• 13 years ago

It's similar in that it's peer-to-peer, but doesn't require an auth/directory server to establish connections. If any known peer is accessible, the two can authenticate directly.

kika9• 13 years ago

To successfully traverse many NATs you need a third party, which is already accessible from two parties trying to handshake.

darklajid• 13 years ago

For that I'd recommend tinc [1].

1: http://www.tinc-vpn.org

spindritf• 13 years ago

After skimming the website and the FAQ[1] it seems to be a safer tinc[2]. It's a very cool piece of software and I always wanted to set something like that up between my servers and routers but never found a need convincing enough to go through the trouble.

[1] http://www.freelan.org/page/faq

[2] http://www.tinc-vpn.org/

makefu• 13 years ago

The points why freelan is better regarding security are no real issues, but tradeoffs in terms of performance which just copy-pasted from the tinc-vpn security faq[1].

I have been using tinc for quite a long time and it feels pretty stable, but the configuration of new nodes is quite a PITA. For that reason a lot of bootstrapping scripts have been built around this [2]. Also, i love the possibility to easily dump the whole (known) network graph and create great graphs from this info [3].

I am using it mostly for reaching hosts behind NAT and creating a secure environment for these hosts.I never have tried the 'connect whole network' feature.

[1] http://www.tinc-vpn.org/security/

[2] https://github.com/krebscode/painload/blob/master/retiolum/s...

[3] http://euer.krebsco.de/graphs/retiolum/retiolum_1.svg

bincat• 13 years ago

Tinc's problematic protocol (security wise) killed it for me before. For example, it didn't have pfs.

It seems that with 1.1pre3 or 4 they have gotten a new, experimental protocol. Hopefully it is an improvement.

Nanzikambe2• 13 years ago

A little pet peeve, why do people always overlook the most ubiquitous VPN solution of them all?

OpenSSH

Can create a full spectrum VPN & supports a stronger and a broader range of ciphers than virtually all competing software, is entirely open source, runs on every platform I can think of, the list goes on. Heck via pointopoint it can even mimic freelan and be peer to peer :)

pault• 13 years ago

It takes longer to read the man page than to spin up an AMI with openVPN. That's my only excuse. :)

rwg• 13 years ago

Because...

• TCP-in-TCP (or ${ANY_RELIABLE_STREAM}-in-${ANY_RELIABLE_STREAM}) performs very poorly in the face of packet loss.

• SSH itself becomes a bottleneck on networks with a large bandwidth-delay product because of statically sized buffers in the client and server. (Though there's been some work done in OpenSSH to mitigate that.)

• "Real" VPN software generally has niceties like MSS mangling TCP connections inside the tunnel to help prevent fragmentation of the encapsulated packets due to VPN overhead.

SSH is great when you need a quick and dirty tunnel (I use it in SOCKS mode a fair bit), but it's not something I'd want to use for long-lived tunnels that will see a lot of data.

gaadd332• 13 years ago

Its not trivial (afaik) to route all traffic over an OpenSSH connection on most platforms is it? I mean you can have it act as a SOCKS proxy without much trouble but there's no easy way to route DNS lookups over it is there?

icebraining3• 13 years ago

There's sshuttle: https://github.com/apenwarr/sshuttle

jebblue• 13 years ago

Firefox can be made set to do its DNS lookups over SOCKS:

http://support.vpnsecure.me/articles/ssh-tunnelling-proxy-tr...

Nanzikambe2• 13 years ago

It is trivial, I use this simple script to open an SSH tunnel to a remote host, assign me and the remote host private IP on tunnel interfaces (/dev/tun0), setup a pointopoint route between them, nuke my regular routing table & and fix it so my default route points down the newly created tunnel.

http://pastebin.com/CxaH6z49

dingaling• 13 years ago

SSH is quenched by many firewalls in corporate and hotel networks. Not just blocking port 22 but also dropping the packets based on protocol inspection.

There are hacks to tunnel SSH over HTTPS ( really ) but at that point you've abandoned the simplicity of SSH and might as well go with OpenVPN.

simgidacav• 13 years ago

Oh yeah, Corkscrew! I used that many times! :)

huhtenberg• 13 years ago

It's not P2P unless at least one of the P's is directly accessible.

devx• 13 years ago

Could this take advantage of Google's new QUIC protocol, or get any benefits from it?

http://en.wikipedia.org/wiki/QUIC

kolev• 13 years ago

Pretty good idea, indeed!

AtlasLion• 13 years ago

How does this compare to Openswan for building multi lan tunnels?

Nesim• 13 years ago

anyone tried to install on windows 2003 server? no service creates on installation. Also I tried to install service manually "freelan --install" but getting an error. Error: An invalid argument was supplied.

Any idea how to run on Windows 2003 32bit server.

scott_karana• 13 years ago

I'm not sure you'll get an answer here. :-) These are a better bet: http://www.freelan.org/page/contact

fabware• 13 years ago

I'm sure there are major typos in the configuration wiki( https://github.com/freelan-developers/freelan-all/wiki/Two-h... ), which prevent me setup two nodes within the same LAN.

Freelan - an open-source, multi-platform, peer-to-peer VPN software

Related Stories