{"id":115651,"date":"2024-05-09T13:52:14","date_gmt":"2024-05-09T11:52:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-nebula-1-9-sistemy-dlya-sozdaniya-overlejnyh-p2p-setej"},"modified":"2024-05-09T13:52:14","modified_gmt":"2024-05-09T11:52:14","slug":"vypusk-nebula-1-9-sistemy-dlya-sozdaniya-overlejnyh-p2p-setej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-nebula-1-9-sistemy-dlya-sozdaniya-overlejnyh-p2p-setej","title":{"rendered":"Release of Nebula 1.9, a system for creating overlay P2P networks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

The release of the Nebula 1.9 project has been published, offering tools for building secure overlay networks that allow geographically distributed hosts to be combined into a separate isolated network operating over the global network. The project is designed for creating your own overlay networks for various needs, such as uniting corporate computers in different offices, servers in various data centers, or virtual environments across different cloud providers. The code is written in Go and is distributed under the MIT license. The project is developed by Slack, the company behind the eponymous corporate messenger. It supports operation on Linux, FreeBSD, macOS, Windows, iOS, and Android. <\/p>\n

Nodes in the Nebula network communicate directly with each other in P2P mode \u2014 direct connections are dynamically established as needed for data transfer between nodes. VPN<\/a>The identity of each host in the network is verified by a digital certificate, and connecting to the network requires authentication \u2014 each user receives a certificate validating their IP address in the Nebula network, name, and membership in host groups. Certificates are signed by an internal certificate authority deployed by the creator of each individual network on their infrastructure, used to validate the credentials of hosts authorized to connect to a specific overlay network associated with the certificate authority. <\/p>\n

To create an authenticated secure communication channel in Nebula, a proprietary tunneling protocol is used, based on the Diffie-Hellman key exchange protocol and the AES-256-GCM cipher. The implementation of the protocol is based on ready and tested primitives provided by the Noise framework, which is also used in projects such as WireGuard, Lightning, and I2P. The project is claimed to have passed an independent security audit. <\/p>\n

To discover other nodes and coordinate connections to the network, special \"lighthouse\" nodes are created, whose global IP addresses are fixed and known to network participants. Participating nodes are not bound to external IP address<\/a>, they are identified by certificates. Host owners cannot independently modify signed certificates and, unlike traditional IP networks, cannot impersonate another host by simply changing the IP address. When creating a tunnel, the host's identity is confirmed by an individual private key. <\/p>\n

A specific range of intranet addresses is allocated to the created network (for example, 192.168.10.0\/24) and binds internal addresses to host certificates. Various mechanisms are provided to bypass address translators (NAT) and firewalls. It is possible to organize routing through an overlay network of third-party hosts not included in the Nebula network (unsafe route). Groups may be formed from the participants of the overlay network, for example, to separate servers and workstations, to which separate traffic filtering rules apply. <\/p>\n

The creation of firewalls is supported to separate access and filter traffic between nodes in the Nebula overlay network. ACLs with tag bindings are used for filtering. Each host in the network can define its own filtering rules based on hosts, groups, protocols, and network ports. In this case, hosts are filtered not by IP addresses, but by verified digitally signed host identifiers that cannot be forged without compromising the certificate authority coordinating the network's operations. <\/p>\n

In the new release: <\/p>\n