It isn't based on WireGuard, but is a true mesh network, unlike everything you've listed. No central coordination point, every node is equal.
Think of it as BitTorrent with a few initial peers you set up through a config file, and it learns of every other peer at runtime (like BitTorrent does through Peer Exchange).
It can forward traffic through other nodes (like Tailscale and unlike Nebula) and recomputes the most efficient route as peers become (un)available.
I use tinc myself and like it. I like that I only have to update a single node and all the other nodes will accept those peers from that node. I've been playing with wireguard, and having the other nodes discover and communicate with each other directly doesn't happen without you adding the other's public key to both peers.
I remember there was talk about switching the backend for Wireguard for security and speed, but it seems to be on the backburner: https://github.com/gsliepen/tinc/issues/179
I really like it for my use case but just assume it's not secure at all. I change the default Ubuntu install to not run the daemon as root (a major flaw in my view) and then just assume that network is as insecure as any other. It's really useful to have all my personal machines always connected between each other at the same IP independently of network config. Security comes from SSH/TLS on top of it.
Considering that the wireguard mesh solutions seem to require static IPs, I'm now wondering whether it might be a good idea to run a wireguard mesh on top of tinc, basically just using tinc as a way to get static IPs and routing connectivity between nodes. That still leaves the issue of updating the wireguard configuration, though.
It seems that the value-add magic sauce of TailScale is the work they've put into NAT traversal etc. There are some interesting blog posts from the team regarding work in this area.
I wonder if the work they put in can be extracted to some kind of tool the other projects can use as well. NAT traversal always seems like the limiting factor in projects like this.
NAT traversal is an impossible problem in practice in the general case (boo symmetric NATs), and the best-effort version is a solved problem since at least 2003 with the STUN protocol[1] which is part of WebRTC, and there are STUN implementations available in many languages[2].
I had enough problems that I had to stop using it, though when it worked it was fantastic.
Client intermittently had seizures (at least on Windows) and I couldn't join/unjoin networks properly. Would have to restart the service and close the program for it to begin to work again.
Sometimes the traffic just didn't flow ... at all. Randomly couldn't connect to other clients on the network.
I haven't had to use it much since covid started as I'm mostly at home these days and I used it to access my LAN when I was out.
I have tried to use it over mobile data and wasn't very lucky, and that's something that used to work great. I couldn't tell if it was due to ZT or the carrier. There's CGNAT on both ends, which could be getting in the way, although like I said it used to work great.
I have also noticed that it takes longer than I was used to get IP, find routes between nodes, etc but once those are up it works well.
I feel like my whole life got simpler with less headaches when I discovered ZT. I adore it. Maybe there are other things out there which do the same thing but ZT is the single 'it just works' thing that has made my life easier the most.
Not associated with them in any way other than being a user.
... and "public" VPNs, where all you need is the network ID to connect. Seems great for playing LAN games. It also has a userspace implementation, which I was able to use on bitbucket CI/CD where I couldn't bring up a tun/tap device, to connect via SSH to a private server. It also has Ad-Hoc networks that are public, IPv6 addressed, and based on port-range, so you can expose your SSH server to anyone with the IPv6 address, for example.
A major differentiator for the (many) mesh net projects is whether they are GPL (or similar) or BSD. The latter can be distributed in the iOS/iPadOS App Store, so have a lot more potential value for both hobbyist and business end users. Of course, if it's mostly a server-to-server mesh net with few end user devices, then it hardly matters.
is a building block that can be used to achieve something similar, minus TURN-like NAT traversal fallback. The peer discovery leverages DNS and UDP hole punching uses WireGuard itself.
I made this: https://github.com/naggie/dsnet/ -- a simple command to manage a wireguard VPN. Think wg-quick but quicker: key generation + address allocation.
https://codeberg.org/vula/vula aims to thwart surveillance adversaries by automatically building wireguard tunnels between LAN hosts with zero configuration using existing IP addresses and .local hostnames inside and outside the tunnels, and uses CSIDH to provide post-quantum protection. Unlike these other projects, it doesn't (yet?) do anything over the internet, and as a result doesn't require a server or any infrastructure. If it is installed on the router, internet-bound traffic is also protected on the LAN.
Everyone mentions tailscale but they want to charge you per user. Their client is open source, the thing the client connects to is not. I think there are better options.
https://github.com/juanfont/headscale replaces the tailscale control panel with something open source and self-hosted. However, it doesn't have all the features of the official tailscale control panel.
Wireguard based solutions get all the attention these days, but I really love working with Nebula. It's dead simple to set up and the mobile client works well.
That said, Nebula feels way less popular, and I don't know if it's had a third party security audit. WG's popularity means it should presumably have had a lot of attention given to both its architecture and its code. This is one area where using a "niche" solution feels somewhat risky.
However, the Android client does not allow for specifying a DNS server and breaks the Android system DNS over TLS. Google thinks the VPN app/client should handle DNS and Nebula app development seems very slow. This means you cannot use adblocking DNS while using Nebula.
The semi-official (worked on by folks involved with the core product from, as far as I can tell, early on, but not released by Slack like core Nebula is) mobile clients don't have a license associated with them, which is a bit of a blocker to further development or distribution on certain stores (FOSS-only ones, for instance, and really no-one else can distribute them at all right now without risk).
> Thankfully both Nebula and Wireguard are built on top of the Noise Framework.
> So neither is a compromise security-design wise.
Security involves much more than the crypto framework being used; just crypto requires much more than the framework. Noise could be implemented insecurely, as a basic example.
- https://tailscale.com/
- https://github.com/juanfont/headscale
- https://github.com/tonarino/innernet
- https://github.com/slackhq/nebula
Something I'm missing?