The release of the Nebula 1.5 project is now available, offering a toolkit for building secure overlay networks. The network can connect anywhere from a few to tens of thousands of geographically distributed hosts hosted by different providers, creating a separate isolated network over the global network. The project is written in Go and is distributed under the MIT license. It is developed by Slack, the company behind the namesake corporate messenger. It supports operation on Linux, FreeBSD, macOS, Windows, iOS, and Android.
Nodes in the Nebula network communicate directly with each other in P2P mode — as the need to transfer data between nodes arises, direct connections are dynamically created. VPNConnectivity. The identity of each host in the network is verified by a digital certificate, and connecting to the network requires authentication — each user receives a certificate that confirms their IP address in the Nebula network, their name, and group membership. Certificates are signed by an internal certificate authority deployed by the network creator on their premises and used to validate the permissions of hosts that are allowed to connect to the overlay network.
To create an authenticated secure communication channel in Nebula, a proprietary tunneling protocol is used, based on the Diffie-Hellman key exchange protocol and the AES-256-GCM cipher. The implementation of the protocol is based on ready-made and tested primitives provided by the Noise framework, which is also used in projects such as WireGuard, Lightning, and I2P. It is claimed that the project has undergone an independent security audit.
To discover other nodes and coordinate connections to the network, special 'lighthouse' nodes are created, whose global IP addresses are fixed and known to members of the network. Participant nodes have no binding to external IP address, they are identified by certificates. Host owners cannot independently modify signed certificates and, unlike traditional IP networks, cannot impersonate another host by simply changing the IP address. When creating a tunnel, the host's identity is confirmed by an individual private key.
The created network is assigned a specific range of intranet addresses (for example, 192.168.10.0/24), and internal addresses are linked to the certificates of the hosts. Groups can be formed from the participants of the overlay network, for example, to separate servers and workstations, to which specific traffic filtering rules apply. Various mechanisms are provided to bypass address translators (NAT) and firewalls. Routing of traffic from external hosts not in the Nebula network (unsafe route) can be organized through the overlay network.
The creation of firewalls is supported for segregating access and filtering traffic between nodes in the Nebula overlay network. ACLs with tag binding are used for filtering. Each host in the network can define its own filtering rules based on hosts, groups, protocols, and network ports. Hosts are filtered not by IP addresses but by verified digital signature identifiers, which cannot be forged without compromising the coordinating network's certificate authority.
In the new release:
- A '-raw' flag has been added to the print-cert command to output the PEM representation of the certificate.
- Support for the new Linux riscv64 architecture has been added.
- An experimental remote_allow_ranges setting has been added to bind allowed host lists to specific subnets.
- A pki.disconnect_invalid option has been added to reset tunnels after trust is revoked or the certificate's lifetime expires.
- An unsafe_routes..metric option has been added to assign weight to a specific external route.
Source: opennet.ru
