• Abstract and Figures
• Public Full-text

Netmaker Release 0.3.5 Alex Feiszli Jun 03, 2021 CONTENTS 1 About 3 1.1 About...................................................3 2 Architecture 5 2.1 Architecture...............................................5 3 Quick Start 11 3.1 Quick Start................................................ 11 4 Server Installation 17 4.1 Server Installation............................................ 17 5 Client Installation 29 5.1 Client Installation............................................ 29 6 External Clients 33 6.1 External Clients............................................. 33 7 Guides 35 7.1 Using Netmaker............................................. 35 8 API Reference 37 8.1 API Reference.............................................. 37 9 Troubleshooting 41 9.1 Troubleshooting............................................. 41 10 Support 43 10.1 Support.................................................. 43 11 Contributing 47 11.1 Contribute................................................ 47 12 Code of Conduct 49 12.1 Code of Conduct............................................. 49 13 Licensing 51 13.1 License.................................................. 51 i ii Netmaker, Release 0.3.5 Netmaker is a platform for creating and managing fast, secure, and dynamic virtual overlay networks using WireGuard. This documentation covers Netmaker’s installation, usage, troubleshooting, and customization, as well as reference documents for the API, UI and Agent configuration. All of the source code for Netmaker is on GitHub. CONTENTS 1 Netmaker, Release 0.3.5 2 CONTENTS CHAPTER ONE ABOUT A quick overview of Netmaker, explaining what it is, how it works, and why you should be using it. 1.1 About 1.1.1 What is Netmaker? Netmaker is a tool for creating and managing virtual overlay networks. If you have at least two machines with internet access which you need to connect with a secure tunnel, Netmaker is for you. If you have thousands of servers spread across multiple locations, data centers, or clouds, Netmaker is also for you. Netmaker connects machines securely, wherever they are. Netmaker takes those machines and creates a flat network so that they can all talk to each other easily and securely. If you’re familiar with AWS, it’s like a VPC but made up of arbitrary computers. From the machine’s perspective, all these other machines are in the same neighborhood, even if they’re spread all over the world. Netmaker has many similarities to Tailscale, ZeroTier, and Nebula. What makes Netmaker different is its speed and flexibility. Netmaker is faster because it uses kernel WireGuard. It is more dynamic because the server andagentsare fully configurable, which lets you handle all sorts of different use cases. 3 Netmaker, Release 0.3.5 1.1.2 How Does Netmaker Work? Netmaker relies on WireGuard to create tunnels between machines. At its core, Netmaker is managing WireGuard across machines to create sensible networks. Technically, Netmaker is two things: • the admin server, called Netmaker • the agent, called Netclient As the network manager, you interact with the server to create and manage networks and devices. The server holds configurations for these networks and devices, which are retrieved by the netclients (agent). The netclient is installed on any machine you would like to add to a given network, whether that machine is a VM, Server, or IoT device. The netclient reaches out to the server, and the server tells it how it should configure the network. By doing this across many machines simultaneously, we create a dynamic, fully configurable virtual networks. The Netmaker server does not typically route traffic. Otherwise, this would be a hub-and-spoke model, which isvery slow. Instead, Netmaker just tells the machines on the network how they can reach each other directly. This is called a full mesh network and is much faster. Even if the server goes down, as long as none of the existing machines change substantially, your network will still run just fine. 1.1.3 Use Cases for Netmaker There are many use cases for Netmaker. In fact, you could probably be using it right now. This list is not all- encompassing, but provides a sample of how you might want to use Netmaker. Guided setup for many of these use cases can be found in the Using Netmaker documentation. 0. Automate creation of a WireGuard mesh network 1. Create a flat, secure network between cloud environments and data centers 2. Provide secure access to IoT devices, remote servers, and client sites. 3. Secure a home or office network 4. Add a layer of encryption to an existing network 5. Secure site-to-site connections 6. Manage cryptocurrency proof-of-stake machines 7. Create a dynamic and secure Kubernetes underlay network 4 Chapter 1. About CHAPTER TWO ARCHITECTURE A technical overview of Netmaker, including design decisions and limitations. 2.1 Architecture Pictured Above: A diagram of Netmaker’s Architecture. 2.1.1 Core Concepts Familiarity with several core concepts will help when you encounter them later on in the documentation. WireGuard WireGuard is a relatively new but very important technology which was recently added to the Linux kernel. WireGuard creates very fast but simple encrypted tunnels between devices. From the WireGuard website, “it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry.” Previous solutions like OpenVPN and IPSec are considerably more heavy and complex, while being less performant. All existing VPN tunnelling solutions will cause a significant increase in your network latency. WireGuard is thefirst to achieve near over-the-line network speeds, meaning you see no signigifant performance impact. With the release of WireGuard, there is little reason to use any other existing tunnel encryption technology. 5 Netmaker, Release 0.3.5 Mesh Network When we refer to a mesh network in these documents we are typically referring to a “full mesh.” A full mesh network exists where each machine is able to directly talk to every other machine on the network. For example, on your home network, behind your router, all the computers are likely given private addresses and can reach each other directly. This is in contrast to a hub-and-spoke network, where each machine must first pass its traffic through a relay server before it can reach other machines. In certain situations you may either want or need a partial mesh network, where only some devices can reach each other directly, and other devices must route their traffic through a relay/gateway. Netmaker can use this model insome use cases where it makes sense. In the diagram at the top of this page, the setup is a partial mesh, because the servers (nodes A-D) are meshed, but then external clients come in via a gateway, and are not meshed. Mesh networks are generally faster than other topologies, but are also more complicated to set up. WireGuard on its own gives you the means to create encrypted tunnels between devices, but it does not provide a method for setting up a full network. This is where Netmaker comes in. Netmaker Netmaker is a platform built off of WireGuard which enables users to create mesh networks between their devices. Netmaker can create both full and partial mesh networks depending on the use case. When we refer to Netmaker in aggregate, we are typically referring to Netmaker and the netclient, as well as other supporting services such as CoreDNS, MongoDB, and UI webserver. From an end user perspective, they typically interact with the Netmaker UI, or even just run the install script for the netclient on their devices. The other components run in the background invisibly. Netmaker does a lot of work to set configurations for you, so that you don’t have to. This includes things like WireGuard ports, endpoints, public IPs, keys, and peers. Netmaker works to abstract away as much of the network management as possible, so that you can just click to create a network, and click to add a machine to a network. That said, every machine (node) is different, and may require special configuration. That is why, while Netmaker sets practical default settings, everything within Netmaker is fully configurable. 6 Chapter 2. Architecture Netmaker, Release 0.3.5 Node A machine in a Netmaker network, which is managed by the Netclient, is referred to as a Node, as you will see in the UI. A Node can be a VM, a bare metal server, a desktop computer, an IoT device, or any other number of internet-connected machines on which the netclient is installed. A node is simply an endpoint in the network, which can send traffic to all the other nodes, and recieve traffic from all of the other nodes. SystemD SystemD is a system service manager for a wide array of Linux operating systems. Not all Linux distributions have adopted systemd, but, for better or worse, it has become a fairly common standard in the Linux world. That said, any non-Linux operating system will not have systemd, and many Linux/Unix distributionshave alternative system service managers. Netmaker’s netclient, the agent which controls networking on all nodes, relies heavily on systemd as of version 0.3. This reliance is being reduced but is currently a core dependency, causing most of the limitations and incompatibilities. As Netmaker evolves, systemd will become just one of the possible service management options, allowing the netclient to be run on a wider array of devices. 2.1.2 Components Netmaker consists of several core components, which are explained in high-level technical detail below. Netmaker Server The Netmaker server is, at its core, a golang binary. Source code can be found on GitHub. The binary, by itself can be compiled for most systems. If you need to run the Netmaker server on a particular system, it likely can be made to work. In typical deployments, it is run as a Docker container. It can also be run as a systemd service as outlined in the non-docker install guide.

Load more

  55

Copy Link