vpn.rst 1.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657
  1. Mesh-VPN
  2. ========
  3. Gluon integrates several OSI-Layer 2 tunneling protocols to
  4. enable interconnects between local meshes and provide
  5. internetwork access. Available protocols currently are:
  6. - fastd
  7. - L2TPv3 (via tunneldigger)
  8. fastd is a lightweight userspace tunneling daemon, that
  9. implements cipher suites that are specifically designed
  10. to work well on embedded devices. It offers encryption
  11. and authentication. Its primary drawback are the necessary
  12. context-switches when forwarding packets.
  13. L2TPv3 is an in-kernel tunneling protocol that performs well,
  14. but offers no security properties by itself.
  15. The brokering of the tunnel happens through tunneldigger,
  16. its primary drawback being the lack of IPv6 support.
  17. fastd
  18. -----
  19. Configurable Cipher
  20. ^^^^^^^^^^^^^^^^^^^
  21. From the site configuration fastd can be allowed to offer
  22. toggleable encryption in the config mode with the intent to
  23. increase throughput, although in practice the gain is minimal.
  24. **Site configuration:**
  25. 1) Install ``gluon-web-mesh-vpn-fastd`` in ``site.mk``
  26. 2) Set ``mesh_vpn.fastd.configurable = true`` in ``site.conf``
  27. **Gateway configuration:**
  28. 1) Prepend the ``none`` cipher in fastds method list
  29. **Config Mode:**
  30. The resulting firmware will allow users to choose between secure (encrypted) and fast (unencrypted) transport.
  31. .. image:: fastd_mode.gif
  32. **Unix socket:**
  33. To confirm whether the correct cipher is being used, fastds unix
  34. socket can be interrogated, after installing for example `socat`.
  35. ::
  36. opkg update
  37. opkg install socat
  38. socat - UNIX-CONNECT:/var/run/fastd.mesh_vpn.socket