I've made a new WireGuard based VPN implementation called unetd. My goal was to make it as easy as possible to link up multiple OpenWrt based routers (or Linux servers) and provide a fully-meshed VPN (all peers talk directly to each other) that can properly deal with NAT inbetween. It also supports automatically creating a VXLAN tunnel (if requested) and properly deals with issues from reduced MTU.
You can find an overview and documentation here: https://openwrt.org/docs/techref/unetd
It also provides some example commands which show that it's possible to create a new VPN two routers in 5 commands securely without having to worry about generating and distributing keys.
It automatically exchanges endpoint information and distributes VPN config updates between all member nodes.
Since it uses WireGuard, you can expect it to have really good performance.
At the moment it needs at least one of the hosts to be reachable via public IP, but I'm working on removing that limitation by using a DHT for node discovery.
It's still fairly new and only in OpenWrt master so far, but it should be easy to backport to 22.03.
If you're already using WireGuard, OpenVPN or some other VPN implementation, I'd be very interested to hear if unetd would cover your use cases as well, or if there is something missing that should be added.
Yes, I’ve studied both when designing unetd. NAT traversal, including double NAT is working fine with unetd, as long as one node in the network is publicly reachable. I’ve decided against implementing DERP, because I wanted to avoid relying on any centralized service.
One suggestion:
Could the unet-cli have a selective dependency for unetd?
That would enable the user to just define unet-cli in his .config recipe (or menuconfig) and the underlying unetd would get also selected.
publicly reachable nodes are becoming ever more scarce, and derp a decent fallback. openwrt could run their own derp servers much like y'all run your own ntp servers.
As I said earlier, I'm already looking into getting rid of the need for nodes with public addresses by implementing DHT support. This would still allow direct connections over double NAT without going through another tunnel server and without introducing a dependency on a centralized (or self-hosted) service.
Amazing work !! Theres a huge need for this. First prize would be optionally being able to layer a GRE/EOIP implementation over the wireguard tunnel natively as well, so fully transparent 1500mtu bridge can be obtained over <1500 mtu WAN-to-wan links (eg PPPoE where it's typically 1492 or lower), without needing to configure separate IP address for wg tunnel and eoip peers/interface
Just a quick update: I pushed a new version of unetd, which now supports DHT based peer discovery, even through double-NAT. The DHT code is in an extra package 'unet-dht', and I've extended the documentation with some notes on how to use it.
