{"id":102274,"date":"2021-11-12T21:36:38","date_gmt":"2021-11-12T19:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-nebula-1-5-sistemy-dlya-sozdaniya-overlejnyh-p2p-setej"},"modified":"2021-11-12T21:36:38","modified_gmt":"2021-11-12T19:36:38","slug":"vypusk-nebula-1-5-sistemy-dlya-sozdaniya-overlejnyh-p2p-setej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-nebula-1-5-sistemy-dlya-sozdaniya-overlejnyh-p2p-setej","title":{"rendered":"Release of Nebula 1.5, a system for creating overlay P2P networks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

The release of the Nebula 1.5 project is now available, offering a toolkit for building secure overlay networks. The network can connect anywhere from a few to tens of thousands of geographically distributed hosts hosted by different providers, creating a separate isolated network over the global network. The project is written in Go and is distributed under the MIT license. It is developed by Slack, the company behind the namesake corporate messenger. It supports operation on Linux, FreeBSD, macOS, Windows, iOS, and Android. <\/p>\n

Nodes in the Nebula network communicate directly with each other in P2P mode \u2014 direct connections are dynamically established as needed for data transfer between nodes. VPN<\/a>-connections. The identity of each host in the network is confirmed by a digital certificate, and connecting to the network requires authentication \u2014 each user receives a certificate that verifies the IP address in the Nebula network, name, and membership in host groups. Certificates are signed by an internal certificate authority deployed by the network creator on their own infrastructure and used to validate the credentials of hosts authorized to connect to the overlay network. <\/p>\n

To create an authenticated secure communication channel in Nebula, a proprietary tunneling protocol is used, based on the Diffie-Hellman key exchange protocol and the AES-256-GCM cipher. The implementation of the protocol is based on ready and tested primitives provided by the Noise framework, which is also used in projects such as WireGuard, Lightning, and I2P. The project is claimed to have passed an independent security audit. <\/p>\n

To discover other nodes and coordinate connections to the network, special \"lighthouse\" nodes are created, whose global IP addresses are fixed and known to network participants. Participating nodes are not bound to external IP address<\/a>, they are identified by certificates. Host owners cannot independently modify signed certificates and, unlike traditional IP networks, cannot impersonate another host by simply changing the IP address. When creating a tunnel, the host's identity is confirmed by an individual private key. <\/p>\n

The created network is assigned a specific range of intranet addresses (for example, 192.168.10.0\/24), and internal addresses are linked to the certificates of the hosts. Groups can be formed from the participants of the overlay network, for example, to separate servers and workstations, to which specific traffic filtering rules apply. Various mechanisms are provided to bypass address translators (NAT) and firewalls. Routing of traffic from external hosts not in the Nebula network (unsafe route) can be organized through the overlay network. <\/p>\n

The creation of firewalls is supported for segregating access and filtering traffic between nodes in the Nebula overlay network. ACLs with tag binding are used for filtering. Each host in the network can define its own filtering rules based on hosts, groups, protocols, and network ports. Hosts are filtered not by IP addresses but by verified digital signature identifiers, which cannot be forged without compromising the coordinating network's certificate authority. <\/p>\n

In the new release: <\/p>\n