Recently I've been reading a lot about the topic of mesh VPNs (tinc, Nebula, Tailscale, ZeroTier, Netmaker, Netbird, etc) and find them pretty interesting. Is anyone here using these in some capacity at home or maybe at work?

My problem so far is that many of the options seem to be aimed at corporate use, understandably, so the developers can earn enough to keep doing it. This means the focus is on a centralized control plane, one server which knows everything about the entire network and manages firewall rules for all of it.

This is why I'm leaning towards Nebula, since I think the decentralized design just makes more sense. There is some centralization for issuing certs though. How do I go about setting up PKI? Is there some open source solution for managing certificates and automatically renewing them?

There's also the option of using vanilla WireGuard. This is my current setup, but I really like the idea of meshing, since it means I don't need to care if my devices are physically on the same network or not, the best connection will be used. Basically the layer of abstraction is a nice convenience that lets me think about hosts or services independently of the physical network topology.

I'm interested to hear your thoughts on this topic! What's your setup like and what do you use it for?

  • drinkinglakewater [he/him]
    ·
    8 months ago

    What's your use case? I can't really think of what I'd do with a mesh VPN at home

    For PKI I think you can automate it using certbot and Let's Encrypt

    • wheresmysurplusvalue [comrade/them]
      ·
      8 months ago

      Just wrote up my use case here

      These certificates are custom certificates generated for Nebula clients, I don't think Let's Encrypt can issue them. In this case I have a trusted machine at home which acts as a CA and signs certificates for all other hosts on the network. The certificate is used to authenticate the host, and also can include custom attributes to be used in firewall rules. So the problem I'd need to solve is keeping track of certificate expiry and renewing the certificates, or issuing new certificates when I add new attributes to a set of hosts.

      • drinkinglakewater [he/him]
        ·
        8 months ago

        Their docs don't mention anything unique for their pki certs so it seems like Let's Encrypt should work. They also mention rotating certs in this guide so you can definitely automate some part of that

        • wheresmysurplusvalue [comrade/them]
          ·
          8 months ago

          Ah, yeah I recognize the cert rotation page. That docs page doesn't say it, but they do use a custom certificate, described a little bit here:

          Nebula have implemented their own certificate structure. It’s similar to an x509 “TLS Certificate” (like you’d use to access an HTTPS website, or to establish an OpenVPN connection), but has a few custom fields.

          Show

          I think Let's Encrypt issues certs for validating that you own a (public) domain name, but for my use, these certs aren't associated to a domain name, just a machine not accessible to the public internet. I'll do some research to see if I can self host something that would allow other hosts to request a renewed cert automatically.