Decentralized VPN

Overview

Decentralized VPN

Build Status Go Report Card GoDoc

Alt text

The RadVPN doesn't need any central point as it connects to other nodes directly (full mesh) it has built-in router that helps packets to route to the approperate destinations. there are two options for configuration: yaml file and if you want to have central configuration management it supports etcd. for the time being it supports symmetric encryptions and Linux platform.

Build

Given that the Go Language compiler (version 1.11 or greater is required) is installed, you can build it with:

go get github.com/mehrdadrad/radvpn
cd $GOPATH/src/github.com/mehrdadrad/radvpn
go build .

Docker

docker pull mehrdadrad/radvpn:latest
docker run --privileged -d -p 8085:8085 -v $(pwd)/radvpn.yaml:/etc/radvpn.yaml -e RADVPN_NODE_NAME=node1 mehrdadrad/radvpn:latest

Basic Config

With the default it tries to load config.yaml file individually at each node, but it can be configured to use same configuration through etcd. Once the configuration is changed, it loads and applies new changes by itself. Below yaml is a sample configuration:

Alt text

revision: 1

crypto:
  type: gcm
  key: 6368616e676520746869732070617373776f726420746f206120736563726574

nodes:
  - node:
      name: node1
      address: 8.121.55.10
      privateAddresses:
        - 10.0.1.1/24
      privateSubnets:
        - 10.0.1.0/24
  - node:
      name: node2
      address: 84.12.92.45
      privateAddresses:
        - 10.0.2.1/24
      privateSubnets:
        - 10.0.2.0/24        

Run

radvpn -config radvpn.conf 

Configuration keys

  • revision - the watcher works based on the revision number; once it increased, the configuration will be loaded immediately
  • server
    • keepalive - frequency duration of radvpn-to-radvpn ping to check if a connection is alive (default is 10 seconds)
    • insecure - disable encryption (default is false)
    • mtu - sets the mtu of the tunnel interface
    • maxworkers - sets number of concurrent workers (read/write to/from tunnel concurrently)
    • address - sets ip address and ports (format : ip:port)
    • name - sets the name of the current node
  • crypto
    • type
      • gcm - galois/counter mode
      • cbc - cipher block chaining
    • key - secret key
  • etcd
    • endpoints - sets the etcd endpoints
    • timeout - sets etcd endpoints timeout
  • nodes
    • node
      • name - node's name
      • address - node's external ip address
      • privateAddresses - sets private address(es) on the tunnel interface
      • privateSubnets - sets reachable subnet(s) from currect node

Configuration with etcd

Alt text

sample configuration

Run with etcd

radvpn -config radvpn.conf -etcd

Update etcd from yaml file

radvpn -update etcd -config radvpn.yaml

License

This project is licensed under MIT license. Please read the LICENSE file.

Contribute

Welcomes any kind of contribution, please follow the next steps:

  • Fork the project on github.com.
  • Create a new branch.
  • Commit changes to the new branch.
  • Send a pull request.
Issues
  • FreeBSD Support?

    FreeBSD Support?

    Trying to compile on FreeBSD results in:

    [email protected]:~/radvpn # go build .
    go: downloading github.com/vishvananda/netlink v1.0.0
    go: downloading go.etcd.io/etcd v3.3.17+incompatible
    go: downloading github.com/songgao/water v0.0.0-20190725173103-fd331bda3f4b
    go: downloading golang.org/x/sys v0.0.0-20191104094858-e8c54fb511f6
    go: downloading gopkg.in/yaml.v2 v2.2.4
    go: extracting github.com/songgao/water v0.0.0-20190725173103-fd331bda3f4b
    go: extracting gopkg.in/yaml.v2 v2.2.4
    go: extracting golang.org/x/sys v0.0.0-20191104094858-e8c54fb511f6
    go: extracting github.com/vishvananda/netlink v1.0.0
    go: downloading github.com/vishvananda/netns v0.0.0-20190625233234-7109fa855b0f
    go: extracting github.com/vishvananda/netns v0.0.0-20190625233234-7109fa855b0f
    go: extracting go.etcd.io/etcd v3.3.17+incompatible
    go: downloading github.com/coreos/etcd v3.3.17+incompatible
    go: downloading github.com/google/uuid v1.1.1
    go: downloading go.uber.org/zap v1.12.0
    go: extracting go.uber.org/zap v1.12.0
    go: extracting github.com/google/uuid v1.1.1
    go: downloading google.golang.org/grpc v1.24.0
    go: extracting google.golang.org/grpc v1.24.0
    go: downloading go.uber.org/multierr v1.3.0
    go: extracting go.uber.org/multierr v1.3.0
    go: downloading golang.org/x/net v0.0.0-20190620200207-3b0461eec859
    go: extracting golang.org/x/net v0.0.0-20190620200207-3b0461eec859
    go: extracting github.com/coreos/etcd v3.3.17+incompatible
    go: downloading go.uber.org/atomic v1.5.0
    go: downloading github.com/golang/protobuf v1.3.2
    go: downloading google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8
    go: downloading github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
    go: downloading github.com/gogo/protobuf v1.3.1
    go: downloading github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f
    go: extracting github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
    go: downloading golang.org/x/text v0.3.0
    go: extracting github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f
    go: extracting golang.org/x/text v0.3.0
    go: extracting github.com/gogo/protobuf v1.3.1
    go: extracting go.uber.org/atomic v1.5.0
    go: extracting github.com/golang/protobuf v1.3.2
    go: extracting google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8
    go: finding github.com/songgao/water v0.0.0-20190725173103-fd331bda3f4b
    go: finding github.com/vishvananda/netlink v1.0.0
    go: finding go.etcd.io/etcd v3.3.17+incompatible
    go: finding gopkg.in/yaml.v2 v2.2.4
    go: finding golang.org/x/sys v0.0.0-20191104094858-e8c54fb511f6
    go: finding github.com/vishvananda/netns v0.0.0-20190625233234-7109fa855b0f
    go: finding github.com/coreos/etcd v3.3.17+incompatible
    go: finding google.golang.org/grpc v1.24.0
    go: finding github.com/gogo/protobuf v1.3.1
    go: finding github.com/google/uuid v1.1.1
    go: finding github.com/golang/protobuf v1.3.2
    go: finding go.uber.org/zap v1.12.0
    go: finding google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8
    go: finding github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
    go: finding go.uber.org/atomic v1.5.0
    go: finding github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f
    go: finding go.uber.org/multierr v1.3.0
    go: finding golang.org/x/net v0.0.0-20190620200207-3b0461eec859
    go: finding golang.org/x/text v0.3.0
    # github.com/mehrdadrad/radvpn/config
    config/config.go:178:40: undefined: netlink.FAMILY_ALL
    [email protected]:~/radvpn # 
    
    opened by darkpixel 4
  • channel passed to Notify must be buffered, else signal may be lost

    channel passed to Notify must be buffered, else signal may be lost

    https://github.com/mehrdadrad/radvpn/blob/b5bb965fbc1a9782e50d0f2f8724d04323ba3bd7/main.go#L41

    see https://golang.org/pkg/os/signal/#Notify:

    Package signal will not block sending to c: the caller must ensure that c has sufficient buffer space to keep up with the expected signal rate. For a channel used for notification of just one signal value, a buffer of size 1 is sufficient.

    opened by djadala 3
  • Missing docker image

    Missing docker image

    Looks like the image radvp is not available in the dockerhub registry:

    # sudo docker run --privileged -d -p 8085:8085 -v $(pwd)/radvpn.yaml:/etc/radvpn.yaml -e RADVPN_NODE_NAME=node1 radvp
    Unable to find image 'radvp:latest' locally
    docker: Error response from daemon: pull access denied for radvp, repository does not exist or may require 'docker login'.
    

    The radvpn image also does not exist (assuming a typo there) :smile:

    opened by thomasrudin 2
  • Go get fail.

    Go get fail.

    [[email protected] ~]# go get https://github.com/mehrdadrad/radvpn package https:/github.com/mehrdadrad/radvpn: https:/github.com/mehrdadrad/radvpn: invalid import path: malformed import path "https:/github.com/mehrdadrad/radvpn": invalid char ':' [[email protected] ~]# go version go version go1.13.6 linux/amd64

    opened by cnkedao 1
  • Issue while trying to compile

    Issue while trying to compile

    Getting:

    dreadnought:~ david$ go get github.com/mehrdadrad/radvpn/
    # github.com/mehrdadrad/radvpn/config
    go/src/github.com/mehrdadrad/radvpn/config/config.go:178:40: undefined: netlink.FAMILY_ALL
    

    Under macOS.

    opened by Fastidious 1
  • Status of the project

    Status of the project

    What is the status of this project?

    It was not clear to me whether is it a spike or an already functioning code, maybe in production without any specific problems.

    I was wondering whether you would like to accept some code changes & bug fixes, or the project is abandoned?

    opened by smil2k 3
  • Possible Padding Oracle vulnerability

    Possible Padding Oracle vulnerability

    The unpadding function treats wrong and correct padding differently. Because the CBC mode is malleable an attacker can change the decrypted plaintext when modifying the IV (or the block before the targeted block). The order of blocks can be changed, too.

    If an attacker is able to distinguish these two cases (e.g. via timing channels or length of returned array) of valid and invalid padding it is possible to decrypt ciphertexts without knowing the key.

    For more information see TLS-Padding-Oracles from RUB or this question on crypto.stackexchange

    There are options to make the CBC mode more secure against this kind of POA, but to mitigate this an authenticated encryption scheme should be used.

    https://github.com/mehrdadrad/radvpn/blob/b5bb965fbc1a9782e50d0f2f8724d04323ba3bd7/crypto/cbc.go#L90-L96

    opened by mcgnus 0
Owner
Mehrdad Arshad Rad
Sr. Principal Software Engineer. Cloud, Automation, Network, Go and Open Source enthusiast.
Mehrdad Arshad Rad
⛵ EdgeVPN: the immutable, decentralized, statically built VPN. NO central server!

⛵ EdgeVPN Fully Decentralized. Immutable. Portable. Easy to use Statically compiled VPN Usage Generate a config: ./edgevpn -g > config.yaml Run it on

Ettore Di Giacinto 111 Jun 17, 2022
SonicWall VPN-SSL Exploit* using Golang

goshock SonicWall VPN-SSL Exploit* using Golang ( * and other targets vulnerable to shellshock ).

Gustavo Roberto Rodrigues Gonçalves 18 Nov 18, 2021
A fork of the simple WireGuard VPN server GUI community maintained

Subspace - A simple WireGuard VPN server GUI Subspace - A simple WireGuard VPN server GUI Slack Screenshots Features Contributing Setup 1. Get a serve

null 1.6k Jun 24, 2022
Smart VPN client

Smart VPN client Performs all the standard functions of a VPN client, i.e. manages a connection to a VPN headend. The "smart" functionality includes:

Michael Kashin 20 May 18, 2022
Standalone client for proxies of Opera VPN

opera-proxy Standalone Opera VPN client. Younger brother of hola-proxy. Just run it and it'll start a plain HTTP proxy server forwarding traffic throu

null 293 Jun 22, 2022
SplitVPN - Split Internet and VPN routing

SplitVPN - Split Internet and VPN routing

null 7 Jun 6, 2022
A Lightweight VPN Built on top of Libp2p for Truly Distributed Networks.

Hyprspace A Lightweight VPN Built on top of Libp2p for Truly Distributed Networks. demo.mp4 Table of Contents A Bit of Backstory Use Cases A Digital N

Hyprspace 274 Jun 20, 2022
A Wireguard VPN Server Manager and API to add and remove clients

Wireguard Manager And API A manager and API to add, remove clients as well as other features such as an auto reapplier which deletes and adds back a c

null 124 Jun 15, 2022
Terraform Provider for Pritunl VPN Server

Terraform Provider for Pritunl VPN Server Website: https://www.terraform.io Pritunl VPN Server: https://pritunl.com/ Provider: disc/pritunl Requiremen

Alexandr Hacicheant 21 Jun 14, 2022
CLI to drive SAML based auth for Global Protect VPN

GlobalProtect VPN Helper This tool is a CLI friendly tool used to perform POST based SAML authentication for GlobalProtect VPN. It displays a browser

Clement JACOB 6 Jan 28, 2022
A VPN Proxy Helper

VPN Proxy Helper Sometimes, VPN clients do not change the routing table of the computer but it still exists the VPN interface. Sometimes, you don't wa

null 0 Dec 30, 2021
IP2Proxy Go package allows users to query an IP address to determine if it was being used as open proxy, web proxy, VPN anonymizer and TOR exits.

IP2Proxy Go Package This package allows user to query an IP address if it was being used as VPN anonymizer, open proxies, web proxies, Tor exits, data

IP2Location 13 Apr 16, 2022
A memory-safe SSH server, focused on listening only on VPN networks such as Tailscale

Features Is tested to work with SCP Integrates well with systemd Quickstart Download binary for your architecture. We only support Linux. If you don't

function61.com 2 Jun 10, 2022
KeeneticRouteToVpn is simple app updating Keenetic Router rules for some hosts to go through VPN interface.

KeeneticRouteToVpn KeeneticRouteToVpn is simple app updating Keenetic Router rules for some hosts to go through VPN interface. It has defaults values

Vasilii Blazhnov 6 May 5, 2022
Hummingbard is an experimental client for building decentralized communities on top of Matrix.

Hummingbard is an experimental client for building decentralized communities on top of Matrix.

null 80 Jun 21, 2022
A decentralized P2P networking stack written in Go.

noise noise is an opinionated, easy-to-use P2P network stack for decentralized applications, and cryptographic protocols written in Go. noise is made

Perlin Network 1.7k Jun 22, 2022
Decentralized Chat ( 去中心化的聊天系统 )

dchat Introduce dchat (Decentralized Chat) 一款去中心化的聊天系统。 Features 轻量级 Unix指令交互 去中心化 断线重连 支持集群 分布式ID Start Install go get -u github.com/awesome-cmd/dcha

null 13 Apr 13, 2022
A modular is an opinionated, easy-to-use P2P network stack for decentralized applications written in Go.

xlibp2p xlibp2p is an opinionated, easy-to-use P2P network stack for decentralized applications written in Go. xlibp2p is made to be minimal, robust,

XFS Network 62 Jun 7, 2022
Node of the decentralized oracle network, bridging on and off-chain computation

Chainlink is middleware to simplify communication with blockchains. Here you'll find the Chainlink Golang node, currently in alpha. This initial imple

SmartContract 3.5k Jun 22, 2022