Server and clients.

[Kesanov]

Hello. Thanks for this amazing project!

I would like to have the following network functionality:

• There is one server on AWS or Github.
• There are hundreds of clients behind NAT.
• Clients discover other clients through the server.
• Clients can then set up a 1-1 VPN between each other. (Without needing the server anymore.)

Is my understanding correct, that I should use beacons (shared by the server) to set up the VPN connections?

In that case, should I expect 2 minute delays before each connection? If yes, is there another solution without this overhead?

Finally, is it possible to use vpncloud as a Rust library, instead of a binary executable?

[dswd]

If you can you should prefer to run a "server" node instead of using beacons. A node with a public address is better than beacons as its information on the peers is more current than with beacons.
If all nodes are behind a NAT, you need one of them to become aware of a new node for that node to connect to the network. This is much faster if you use a node running on AWS than beacons.
You can run VpnCloud on AWS in the smallest instance which will not cost that much. The "server" node will not forward traffic for the peers, it will just sit there and help them to connect to each others. You don't even need to give it an IP address or so.

VpnCloud is a binary and you can't use it as a library. What would be your use case for a library? Do you want to embed it into another program?

[Kesanov]

Thanks for your reply. Yes, I wanted to embed it in another rust program, which makes 2-20 computers visible on LAN. I also intended to use free tier EC2 for starters.

However, I also want to have some form of user groups. That is, users could use the EC2 to join and leave distinct groups. Is it possible to create multiple VPN subnetworks in a small memory footprint? Alternatively, can I hide some members on the VPN from each other (so that they are not visible on LAN)?

[dswd]

VpnCloud just provides low-level network connectivity, nothing more. If you want to segment your network, you can do so on several levels:

• You can use VpnCloud trusted keys to only allow certain nodes to connect to each other.
• You can use Iptables rules to enforce ACLs in your network.
• You can configure routing according to your groups.

[ruihanjingying]

If you can you should prefer to run a "server" node instead of using beacons. A node with a public address is better than beacons as its information on the peers is more current than with beacons.
If all nodes are behind a NAT, you need one of them to become aware of a new node for that node to connect to the network. This is much faster if you use a node running on AWS than beacons.
You can run VpnCloud on AWS in the smallest instance which will not cost that much. The "server" node will not forward traffic for the peers, it will just sit there and help them to connect to each others. You don't even need to give it an IP address or so.

VpnCloud is a binary and you can't use it as a library. What would be your use case for a library? Do you want to embed it into another program?
If you can you should prefer to run a "server" node instead of using beacons. A node with a public address is better than beacons as its information on the peers is more current than with beacons.
If all nodes are behind a NAT, you need one of them to become aware of a new node for that node to connect to the network. This is much faster if you use a node running on AWS than beacons.
You can run VpnCloud on AWS in the smallest instance which will not cost that much. The "server" node will not forward traffic for the peers, it will just sit there and help them to connect to each others. You don't even need to give it an IP address or so.

VpnCloud is a binary and you can't use it as a library. What would be your use case for a library? Do you want to embed it into another program?

Hello，I've tryed your suggestion,but it works not well.

1. I use tap port and switch mode
2. There is a server with public IP
3. All clients behind NAT connect to the server. The clients can communicate with server smoothly,but can't communicate with other clients
4. In the client's vpncloud.stats,it learns the private address of other clients not public
5. my configure is like below:
   server(42.202.144.251):

---
device:
  type: tap
  name: vpncloud%d
  path: ~
  fix-rp-filter: false
ip: 10.0.0.1
ifup: ~
ifdown: ~
crypto:
  password: mytest123
  private-key: ~
  public-key: ~
  trusted-keys: []
  algorithms:
    - AES128
    - AES256
    - CHACHA20
listen: "3210"
peers: []
peer-timeout: 300
keepalive: 10
beacon:
  store: ~
  load: ~
  interval: ~
  password: ~
mode: switch
switch-timeout: 300
claims:
    - 10.0.0.0/24
auto-claim: true
port-forwarding: false
pid-file: ~
stats-file: ~
statsd:
  server: ~
  prefix: ~
user: root
group: root
hook: ~
hooks: {}

the configure on client behind NAT:

device:
  type: tap
  name: vpncloud%d
  path: ~
  fix-rp-filter: false
ip: 10.0.0.10
ifup: ~
ifdown: ~
crypto:
  password: dljy518#
  private-key: ~
  public-key: ~
  trusted-keys: []
  algorithms:
    - AES128
    - AES256
    - CHACHA20
listen: "3210"
peers:
    - 42.202.144.251
peer-timeout: 300
keepalive: 10
beacon:
  store: ~
  load: ~
  interval: ~
  password: ~
mode: switch
switch-timeout: 300
claims:
    - 10.0.0.0/24
auto-claim: true
port-forwarding: true
pid-file: ~
stats-file: ~
statsd:
  server: ~
  prefix: ~
user: root
group: root
hook: ~
hooks: {}

6. the vpncloud.stats looks like below:

peers:
  - "42.202.144.251:3210": { ttl_secs: 299, crypto: AES128 }

forwarding_table:
  claims:
    - "10.0.0.0/24": { peer: "42.202.144.251:3210", timeout: 299 }
  cache:

peer_traffic:
  - peer: "192.168.75.161:3210"     // here shows the private address 
    in: { display: "0 B/s", bytes: 0, packets: 0 }
    out: { display: "80 B/s", bytes: 4805, packets: 31 }
  - peer: "42.202.144.251:3210"
    in: { display: "17 B/s", bytes: 1078, packets: 7 }
    out: { display: "11 B/s", bytes: 714, packets: 6 }

payload_traffic:
  - addrs: ["ff:ff:ff:ff:ff:ff", "ce:30:33:00:81:0b"]
    in: { display: "0 B/s", bytes: 0, packets: 0 }
    out: { display: "0 B/s", bytes: 0, packets: 0 }
  - addrs: ["ce:87:2e:1f:cc:e9", "33:33:00:00:00:02"]
    in: { display: "0 B/s", bytes: 0, packets: 0 }
    out: { display: "0 B/s", bytes: 0, packets: 0 }
  - addrs: ["ce:87:2e:1f:cc:e9", "33:33:ff:1f:cc:e9"]
    in: { display: "0 B/s", bytes: 0, packets: 0 }
    out: { display: "0 B/s", bytes: 0, packets: 0 }
  - addrs: ["ce:87:2e:1f:cc:e9", "ff:ff:ff:ff:ff:ff"]
    in: { display: "0 B/s", bytes: 0, packets: 0 }
    out: { display: "0 B/s", bytes: 0, packets: 0 }
  - addrs: ["ce:87:2e:1f:cc:e9", "33:33:00:00:00:16"]
    in: { display: "0 B/s", bytes: 0, packets: 0 }
    out: { display: "0 B/s", bytes: 0, packets: 0 }
  - addrs: ["33:33:00:00:00:16", "ce:30:33:00:81:0b"]
    in: { display: "0 B/s", bytes: 0, packets: 0 }
    out: { display: "0 B/s", bytes: 0, packets: 0 }
  - addrs: ["33:33:00:00:00:02", "ce:30:33:00:81:0b"]
    in: { display: "0 B/s", bytes: 0, packets: 0 }
    out: { display: "0 B/s", bytes: 0, packets: 0 }
  - addrs: ["ce:87:2e:1f:cc:e9", "ce:30:33:00:81:0b"]
    in: { display: "0 B/s", bytes: 0, packets: 0 }
    out: { display: "0 B/s", bytes: 0, packets: 0 }
  - addrs: ["33:33:ff:00:81:0b", "ce:30:33:00:81:0b"]
    in: { display: "0 B/s", bytes: 0, packets: 0 }
    out: { display: "0 B/s", bytes: 0, packets: 0 }

invalid_protocol_traffic: { display: "0 B/s", bytes: 0, packets: 0 }
dropped_payload_traffic: { display: "0 B/s", bytes: 0, packets: 0 }

8. I captured the packets and saw that packets between clients encapsulate with the private IP

Now,I can't find why it works like that.please help me , Thank you.

[dswd]

The problem seems to be that both nodes claim the whole 10.0.0.0/24 network. One of them will win and the other node can't be reached.