ZeroTier: Network Virtualization Everywhere

https://www.zerotier.com/index.html

by luu • 12 years ago

107 50 12 years ago

zerotier.com

sneak• 12 years ago

Ugh, yet another L2 VPN project that misuses non-rfc1918 (that is, assigned) address space for their pet project.

Just... don't.

api8• 12 years ago

Not an uncommon practice these days... Tell that to cellular networks and cable providers. We need IPv6.

http://www.dslreports.com/forum/r28371780-Why-is-my-internet...

http://android.stackexchange.com/questions/11388/are-tmobile...

KaiserPro2• 12 years ago

As someone who inherited a similar system, its a massive pain. Have world routable internal IP addresses is utterly utterly dull.

davidu• 12 years ago

RFC1918 will likely not work since NAT'd users will be using ZeroTier. But there is a solution to this EXACT problem. RFC6598! http://tools.ietf.org/html/rfc6598

I think they could safely use 100.64.0.0/10 -- It's arguably designed for this kind of thing.

abcd_f3• 12 years ago

Just... don't.

Let's hear the alternatives.

I'll give you 10 peers, each on its own RFC1918 subnet. You give me a flat addressing scheme that doesn't involve NAT and IP6, requires no manual configuration on peers' part and keeps them on a single connected (in routing terms) network, so that broadcasts and multicasts work. Go!

KaiserPro2• 12 years ago

MPLS from a big ISP....

roghummal• 12 years ago

ZT PR is in overdrive! Woooooooo. The ham-handed way they've done it has endeared me to them.

And maybe I thought the State of NAT posting was pretty good.

api8• 12 years ago

I'm the author and I'll take that as a complement... I think.

My take on really slick polished valley hipster corporate pr is if you've got the resources to pull that off, sure, do it.

But if you don't it's like a bad special effect in a movie, usually worse than no special effects at all. As they say in that field if you don't have the flash it's all gotta be in the script.

thinxer• 12 years ago

I tried this it's really really simple to set up (than openvpn tinc etc). However NAT traversing is still a hard problem and I cannot get online behind two NATs.

api8• 12 years ago

My guess would be that one is symmetric. Some symmetric-NAT-busting tricks are coming in future versions.

huhtenberg• 12 years ago

The exact same idea as Hamachi, but with different business model. It'd be interesting to see how this develops.

dmd2• 12 years ago

What is the business model (considering the use of supernodes)?

api8• 12 years ago

Right now it's charging for the convenience of setup and administration on zerotier.com. You can run your own "netconf master" and create your own networks, but it requires some system administration and Redis database wrangling.

Generally the people who will pay you are the people who want convenience, like business users, and the rest are people who won't ever pay you anyway.

The supernodes are not part of the business model. That architecture just exists to make the system fast and secure by providing managed anchor points. All traffic is end-to-end encrypted so the supernodes can't see traffic content.

api8• 12 years ago

It's more or less the same underlying approach as Hamachi: L2 virtualization. The execution is a bit different, and it's designed to be more sysadmin-friendly to enable its use as something like a cloud backplane network.

As far as the future goes, I have different and I think broader goals. VPN is just the first application. I have others in mind.

vmp• 12 years ago

There's a (slightly hidden) public network called "Earth" with ID 8056c2e21c000001, discovered a few interesting hosts already (by using non-intrusive avahi-browse):

28.204.184.27:6667 - IRC server identifying as "nagisa.yasashiisyndicate.org"

There's also a couple o' macbooks and, for a few minutes, someone advertised their EPSON L110 Series printer but it vanished as quickly as it emerged. :)

So far I love it, seems like a viable replacement for Hamachi/Tunngle, the Windows Client is rather ugly but functional, had no issues on Arch Linux (built from source). Kudos.

api8• 12 years ago

Earth is slightly hidden because it's an experimental feature, but way back when I started the project it was the point.

I found that most users wanted private networks, so I added network IDs and certificates of authorization. But I still wanted to maintain the original vision in there somewhere.

thesorrow• 12 years ago

I'm behind two NAT myself and it's impossible to traverse them :O

AlyssaRowan• 12 years ago

No forward security yet? Hold off on this until it has that.

Still uses supernodes, too. May be interesting once it's matured a bit and been redesigned, however.

According to djb (author of these algorithms) you shouldn't really be persisting keys for longer than minutes, let alone indefinitely.

tptacek6• 12 years ago

I'm not clear what you're trying to say with that last sentence. I didn't look carefully (beyond the reference to NaCL) but I assume this is using Salsa20 keyed by Curve25519. Neither of those algorithms are any more "exhaustible" (to coin a term) than AES or static DH, both of which are obviously capable of providing security in normal situations more or less indefinitely.

I assume you must be referring to something other than the security longevity of a Salsa20 key.

zrail6• 12 years ago

Curve25519, ed25519, and Salsa20 in 12-round mode: https://github.com/zerotier/ZeroTierOne/wiki/ZeroTier-One-Se...

pbsd3• 12 years ago

That last sentence is paraphrasing a recent djb cfrg post: http://www.ietf.org/mail-archive/web/cfrg/current/msg04880.h...

rmrfrmrf• 12 years ago

What is the alternative to using supernodes in a P2P system?

rsync• 12 years ago

"No forward security yet? Hold off on this until it has that."

Ok, but presumably if the only services I "route" through ZT are encrypted (like ssh, or forward-secure HTTPS) then I don't care, right ?

rwinn• 12 years ago

The uninstaller is awesome! The service detects when you trash the app and uninstalls itself. Well done

zrail6• 12 years ago

I can see two immediate uses for this:

* Private backhaul network for my VPSs, useful for things like ssh, deploys, monitoring, metrics, and log aggregation

* Private network that I can set up between my laptop and my parents' desktop and fix things via VNC without having to pay for a dedicated service.

The lack of perfect forward secrecy is sort of a bummer, but for my purposes it should be fine.

nickthemagicman• 12 years ago

Is there a centralized server on their end that all my data goes through?

zrail6• 12 years ago

Most of the time, no. The first packet of a given connection will hit a supernode (one of four machines run by ZeroTier) to open up the NAT ports, but after that everything is point to point.

Except in the case of an overly restrictive firewall that doesn't allow outgoing UDP on port 9993, in which case every packet is tunneled over port 443 through one of the supernodes.

That said, every packet is encrypted with NaCL so that situation is less concerning. Just slower.

Rhapso4• 12 years ago

This is painfully close to something that could be much better. Sadly this "p2p" system is strongly centralized. I cannot make a private network without zero-tier's authorization. I cannot add nodes to a private network without zero-tier's authorization. If zero-tier servers fail or the company dies, the network goes with it. Because the strong centralization, future viability of the network hinges on a single small companies continued existence. I cannot use this to build anything meaningful. It could only serve as a competitor to other vpn providers, not an improvement over the status quo.

zrail6• 12 years ago

It's almost completely open source[1]. The only component that isn't open is the web interface itself, but there's complete documentation on the internal data structures, how to run a super node, and how to reconfigure the clients to serve up those super nodes instead of the ZT-provided ones.

[1] https://github.com/zerotier/ZeroTierOne

Rhapso4• 12 years ago

I rather happy about that, it saves me a lot of work. I've already cloned the repo on github (and a few local machines). Essentially I currently plan on unwrapping their administration system and switching to a shared secret model.

catern• 12 years ago

If you're interested in a more open system that can be used as a VPN, I recommend cjdns: https://github.com/cjdelisle/cjdns

It was a breeze to set up. I've been using it as a VPN to connect all my boxes and ssh to my machines that are behind NAT, and it's been very reliable. And, if I want, I can connect my boxes to the big cjdns mesh network "Hyperboria" and do my part for promoting a decentralized internet.

Rhapso4• 12 years ago

I really like CJDNS, but it is more suitable to run on real routers than to use for virtual networking. Its overlay network and routing does not take into account real latency or congestion of the rest of the internet.

api8• 12 years ago

Look at the netconf-master/ subfolder -- you can make private networks without using the web UI. But it's hard right now. It'll probably be made easier in the future.

As far as pure decentralization goes: that's very hard, much harder than NAT-t and cryptography. I've prioritized zero-configuration instant-on and performance because that's what 95% of users want.

Here's a personal post I wrote on the difficulty:

http://adamierymenko.com/decentralization-i-want-to-believe/

Rhapso4• 12 years ago

by netconf-master do you mean

https://github.com/zerotier/ZeroTierOne/tree/master/netconf-...

ZeroTier: Network Virtualization Everywhere

Related Stories