nebula - A scalable overlay networking tool with a focus on

项目说明

What is Nebula?

Nebula is a scalable o networking 工具 with a focus on performance, simplicity and security.
It lets you seamlessly connect computers anywhere in the world. Nebula is portable, and runs on Linux, OSX, Windows, iOS, and Android.
It can be used to connect a small number of computers, but is also able to connect tens of thousands of computers.

Nebula incorporates a number of existing concepts like encryption, security groups, certificates,
and tunneling.
What makes Nebula different to existing offerings is that it brings all of these ideas together,
resulting in a sum that is greater than its indi parts.

Further documentation can be found here.

You can read more about Nebula here.

You can also join the NebulaOSS Slack group here.

Supported Platforms

#### Desktop and Server

Check the releases page for downloads or see the Distribution Packages section.

Linux - 64 and 32 bit, arm, and others

Windows

MacOS

Freebsd

#### Distribution Packages

Arch Linux

Fedora Linux

Debian Linux

Alpine Linux

macOS Homebrew

Docker

#### Mobile (source code)

iOS

Android

Technical O

Nebula is a mutually authenticated peer-to-peer software-defined 网络 based on the Noise 协议 框架.
Nebula uses certificates to assert a node's IP address, name, and membership within user-defined groups.
Nebula's user-defined groups allow for provider agnostic traffic filtering between nodes.
Discovery nodes (aka lighthouses) allow indi peers to find each other and optionally use UDP hole punching to establish connections from behind most firewalls or NATs.
Users can move data between nodes in any number of cloud service pro, datacenters, and endpoints, without needing to maintain a particular addressing scheme.

Nebula uses Elliptic-cur (ECDH) key exchange and AES-256-GCM in its default configuration.

Nebula was created to provide a mechanism for groups of hosts to communicate securely, e the internet, while enabling expressi definitions similar in style to cloud security groups.

Getting started (quickly)

Don't want to manage your own PKI and lighthouses? Managed Nebula from Defined Networking handles all of this for you.

To set up a Nebula 网络, you'll need:

#### 1. The Nebula binaries or Distribution Packages for your specific platform. Specifically you'll need nebula-cert and the specific nebula binary for each platform you use.

#### 2. (Optional, but you really should..) At least one discovery node with a routable IP address, which we call a lighthouse.

Nebula lighthouses allow nodes to find each other, anywhere in the world. A lighthouse is the only node in a Nebula 网络 whose IP should not change. Running a lighthouse requires very few compute resources, and you can easily use the least expensi from a cloud hosting provider. If you're not sure which provider to use, a number of us have used $6/mo DigitalOcean droplets as lighthouses.

Once you ha an instance, ensure that Nebula udp traffic (default port udp/4242) can reach it over the internet.

#### 3. A Nebula certificate authority, which will be the root of trust for a particular Nebula 网络.

This will create files named ca.key and ca.cert in the current directory. The ca.key file is the most sensitive file you'll create, because it is the key used to sign the certificates for indi nebula nodes/hosts. Please store this file somewhere safe, preferably with strong encryption.

Be aware! By default, certificate authorities have a 1-year lifetime before expiration. See this guide for details on rotating a CA.

#### 4. Nebula host keys and certificates generated from that certificate authority

This assumes you have four nodes, named lighthouse1, laptop, server1, host3. You can name the nodes any way you'd like, including FQDN. You'll also need to choose IP addresses and the associated subnet. In this example, we are creating a nebula 网络 that will use 192.168.100.x/24 as its 网络 range. This example also demonstrates nebula groups, which can later be used to define traffic rules in a nebula 网络.

By default, host certificates will expire 1 second before the CA expires. Use the -duration flag to specify a shorter lifetime.

#### 5. Configuration files for each host

Download a copy of the nebula example configuration.

* On the lighthouse node, you'll need to ensure am_lighthouse: true is set.

* On the indi hosts, ensure the lighthouse is defined properly in the static_host_map section, and is added to the lighthouse hosts section.

#### 6. Copy nebula credentials, configuration, and binaries to each host

For each host, copy the nebula binary to the host, along with config.yml from step 5, and the files ca.crt, {host}.crt, and {host}.key from step 4.

DO NOT COPY ca.key TO INDI NODES.

#### 7. Run nebula on each host

For more detailed instructions, find the full documentation here.

Building Nebula from source

Make sure you have go installed and clone this repo. Change to the nebula directory.

To build nebula for all platforms:
make all

To build nebula for a specific platform (ex, Windows):
make bin-windows

See the Makefile for more details on build targets

Curve P256 and FIPS 140-3 mode

The default curve used for cryptographic handshakes and signatures is Cur. This is the recommended setting for most users. If your deployment has certain compliance requirements, you have the option of creating your CA using nebula-cert ca -curve P256 to use NIST Curve P256. The CA will then sign certificates using ECDSA P256, and any hosts using these certificates will use P256 for ECDH handshakes.

Nebula can be built to support the FIPS 140-3 mode of Go by running either of the following make targets. (This sets GOFIPS140=v1.0.0, which must be done at compile time so that the correct AES-GCM can be used for FIPS 140-3 enforcement mode).

Nebula can also be built using the BoringCrypto GOEXPERIMENT by running either of the following make targets.

NOTE: boringcrypto support is deprecated and will be removed in the next release. Users should migrate to the native FIPS 140-3 mode described above.

This is not the recommended default deployment, but may be useful based on your compliance requirements.

Credits

Nebula was created at Slack Technologies, Inc by Nate Brown and Ryan Huber, with contributions from Oli, Alan Lam, Wade Simmons, and Lining Wang.

项目信息

开发语言：Go

Star 数：18413

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A scalable overlay networking 工具 with a focus on performance, simplicity and security展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。