Dieses Wiki ist ein Archiv bis 2023. Das aktuelle Wiki findet sich unter https://wiki.hamburg.ccc.de/

Difference between revisions of "ChaosVPN"

From CCCHHWiki
Jump to: navigation, search
(ip ranges)
m (Services available on ChaosVPN: -Minetest - service no more exists)
 
(111 intermediate revisions by 24 users not shown)
Line 1: Line 1:
''' the big picture '''
+
{{Template:ChaosVPNBanner}}
  
What is this all about?
+
= Goals =
  
mc.fly will write some stuff about it. In case you have awesome ideas just add them.
+
ChaosVPN is a system to connect Hackers.  
  
 +
Design principals include that it should be without Single Point of Failure, make usage of full encryption, use RFC1918 ip ranges, scales well on >100 connected networks and is being able to run on a embedded hardware you will find in our todays router.
  
 +
It should be designed that noone sees other peoples traffic.
  
A view on the connected nodes inside the ChaosVPN. Refreshed every minute: http://comyn.ainex.net/chaosvpn.png
+
It should be mainly autoconfig as in that besides the joining node no administrator of the network should be in the need to acutally do something when a node joins or leaves.
  
= ChaosVPN 2.0 =
+
If you want to find a solution for a Network without Single Point of failure, has - due to Voice over IP - low latency and that noone will see other peoples traffic you end up pretty quick with a full mesh based network.
  
== redesign ==
+
Therefore we came up with the tinc solution. tinc does a fully meshed peer to peer network and it defines endpoints and not tunnels.
The Rebuild of the ChaosVPN became nessesary at some point, as the vermittlung is blackholed. Furthermore we would like to put live back to the ChaosVPN and use it to interconnect the hackerspaces.
 
  
So we thought its a good time to redesign stuff. We will climb up to tinc 1.0.10.
+
ChaosVPN connects hacker wherever they are. We connect roadwarriors with their notebook. Servers, even virtual ones in Datacenters, Hackerhouses and hackerspaces. To sum it up we connect networks - maybe down to a small /32.
  
== software ==
+
So there we are. ChaosVPN is working and it seems the usage increases, more nodes join in and more sevices pop up.
  
An unfinshed Howto for Debian systems is available at [[ChaosVPN::DebianHowto|Debian]] - users of other systems need to adapt it likewise, more documentation will hopefully follow in the future.
+
For now, an overview picture of the currently connected nodes:
 +
* http://vpnhub1.hack/chaosvpn.png (only from inside ChaosVPN; updated once per hour)
 +
* http://vpnhub1.hack/chaosvpn.svg
 +
and a simple display of node-uptimes:
 +
* http://vpnhub1.hack/chaosvpn.nodes.html.
  
 +
= Howto join ChaosVPN? =
  
=== Config builder ===
+
You want to join ChaosVPN and experience the awesomeness of it?
Currently we are porting haegars script from perl to c and strip off curl and openssl, so it fits in a OpenWRT box.
 
  
=== OpenWRT Packages ===
+
* Go to our [[ChaosVPN:Howto|Generic Howto]]
Blogic will build a special OpenWRT package, which is called chaosvpn at the moment and a recent tinc 1.0.10 for that.
+
* Go to our [[ChaosVPN:DebianHowto|Debian Howto]]
 +
* Go to our [[ChaosVPN:UbuntuHowto|Ubuntu Howto]]
 +
* Go to our [[ChaosVPN:OpenWRTHowto|OpenWRT Howto]]
 +
* Go to our [[ChaosVPN:FreeBSDHowto|FreeBSD Howto]]
 +
* Go to our [[ChaosVPN:NetBSDHowto|NetBSD Howto]]
 +
* Go to our [[ChaosVPN:Netbsd_NAT_VPN_router_using_chaosvpn_and_ipnat|NetBSD NAT VPN router using chaosvpn and ipnet Howto]]
 +
* Go to our [[ChaosVPN:MacOSXHowto‎|Apple Mac OSX Howto]]
 +
* Go to our [[ChaosVPN:RaspbianHowto|Raspbian Howto]]
 +
* If you own a Fonera 2.0n you may want to try [[ChaosVPN:Fonera|Fonera Howto]] (quite outdated)
  
See also http://0x1.net/openwrt
+
There is a short HowTo [[ChaosVPN:MeshYourNodes|how to better mesh your own nodes]] using ChaosVPN.
Packages may be in flux for awhile, if you have trouble with any of the binaries, email [mailto:cjp@0x1.net cjp].
 
  
=== Debian Packages ===
+
= Mailinglist =
Haegar updated (backported) tinc 1.0.11 packages for debian. They are availible at:
 
* Debian Etch: http://debian.sdinet.de/etch/sdinet/tinc/
 
* Debian Lenny: http://debian.sdinet.de/lenny/sdinet/tinc/
 
  
I will also create Debian packages of the config builder once it is in a usable state.
+
We have a mailinglist, and invite all interested persons to join.
  
=== sources ===
+
https://www.hamburg.ccc.de/mailman/listinfo/chaosvpn
The source code repository is available at: http://github.com/ryd/chaosvpn
 
  
You can download the source with git
+
= ChaosVPN 2.0 =
git clone git://github.com/ryd/chaosvpn.git
 
  
 
== IP Ranges and Participants: ==
 
== IP Ranges and Participants: ==
  
We need to have non colliding ip ranges and therefore we need some coordination of the used ip ranges.
+
Please see [[ChaosVPN:IPRanges | IP Range ]] for more Infos.
 
 
First of all we would like to be compilant to the used ip ranges of [http://www.freifunk.net freifunk] and [http://dn42.net dn42].
 
 
 
The IP ranges overall are defined in the [http://wiki.freifunk.net/IP-Netze freifunk wiki ip-net] page as root source.
 
 
 
So we use 172.31.0.0/16 for the europeans and 10.100.0.0/13 for the americans. That should leave enough space for everone untill ipv6 is not the future but the present. (Real IPv6 ranges already in use can also be announced on the VPN, but there are no thoughts about private/internal adressing yet.)
 
 
 
However we will not support 192.168.0.0/16 ip ranges as they are used for various other reasons. This rfc1918 ip range will stay as private to use for internal use (and in fact its used in the dn42 for routing uses.)
 
 
 
'''Question''': reverse DNS?<br/>
 
"yes" ;) - but we don't know how to implement them for the VPN yet, delegating it with forward zones in local nameservers does not sound very good to me. --[[User:Haegar|Haegar]] 00:40, 29 October 2009 (UTC)
 
 
 
'''Question''': Are other ChaosVPN ranges which were already allocated on the Freifunk Wiki also supported (i.e. 10.4.0.0/14 & 10.32.0.0/12)? --[[User:Dennis|Dennis]] 23:32, 10 November 2009 (UTC)
 
 
 
'''Procedure:''' Add your subnet below and drop [[User:Haegar]] a message with the infos specified at [[ChaosVPN::DebianHowto#6._Mail_haegar.40ccc.de_the_info]] so he can add you to the official listing.
 
 
 
=== ip ranges ===
 
 
 
{| class="wikitable"
 
|- bgcolor="#efefef"
 
! IP-subnets
 
! Unique Name
 
! Node
 
! Remarks
 
|- bgcolor="#efefef"
 
| 172.31.0.0/16
 
| europe range
 
| europe range
 
| europe range
 
|-
 
| 172.31.0.0/23
 
| *reserved*
 
| *reserved*
 
| This range may be used for Single-IP-VPN nodes like servers which would participate directly but do not need a subnet.
 
|-
 
| 172.31.2.0/23
 
| none
 
| free
 
| none
 
|-
 
| your subnet
 
| your unique name
 
| your url / description
 
| your remarks
 
|-
 
| 172.31.16.0/23
 
| ccchh
 
|[http://www.hamburg.ccc.de CCC Hamburg]
 
| Chaos Computer Club Hansestadt Hamburg
 
|-
 
| 172.31.18.0/23
 
| haegarhome
 
| haegar home
 
|
 
|-
 
| 172.31.20.0/23 *planned*
 
|
 
|[http://www.hamburg.ccc.de CCC Hamburg]
 
| Chaos Computer Club Hansestadt Hamburg Second Range
 
|-
 
| 172.31.22.0/24
 
| haegarvlad
 
| haegar hosted servers / vms
 
|
 
|-
 
| 172.31.23.0/24
 
| *reserved*
 
| *reserved*
 
| *reserved*
 
|-
 
| 172.31.24.0/23 *planned*
 
| London Hackspace
 
| http://london.hackspace.org.uk
 
|
 
|-
 
| 172.31.26.0/23 *planned*
 
| Leeds Hackspace
 
| http://leeds.hackspace.org.uk
 
|
 
|-
 
| 172.31.31.0/24 *requested*
 
| freitagsrunde
 
| http://freitagsrunde.org
 
|
 
|-
 
| 172.31.42.0/24
 
| *reserved*
 
| *reserved*
 
| *reserved*
 
|-
 
| your subnet
 
| your unique name
 
| your url / description
 
| your remarks
 
|-
 
| 172.31.51.0/23
 
| ccch
 
| [https://hannover.ccc.de CCC Hannover]
 
| Chaos Computer Club Hannover
 
|-
 
| 172.31.99.0/24
 
| hc
 
| [[User:HC]] (+4961546039923)
 
| HC's testnode
 
|-
 
| 172.31.100.0/24
 
| datensumpf
 
| http://www.datensumpf.de datensumpf
 
| mc.flys subnet at home
 
|-
 
| 172.31.101.0/24
 
| pesco
 
| [[User:Pesco]]
 
| pesco's home/test range
 
|-
 
| 172.31.102.0/24
 
| ryd
 
| [[User:Jensm]]
 
| jens's home/test range
 
|-
 
| 172.31.108.0/24
 
| atari
 
| [[User:Atari]]
 
| atari|wasteland
 
|-
 
| 172.31.142.0/23
 
| t42home
 
| http://T42.de
 
|
 
|-
 
| 172.31.251.0/24
 
| lotho
 
| [[User:Lotho]]
 
| lotho at home
 
|-
 
| 172.31.255.0/24
 
| *reserved*
 
| *reserved*
 
| *reserved*
 
|-
 
| your subnet
 
| your unique name
 
| your url / description
 
| your remarks
 
|- bgcolor="#efefef"
 
| 10.100.0.0/14
 
| us hackerspaces range
 
| us hackerspaces range
 
| us hackerspaces range
 
|-
 
| 10.100.0.0/23
 
| psone
 
| PS:one
 
|
 
|-
 
| 10.100.2.0/23
 
| ccckc
 
| CCCKC
 
|
 
|-
 
| 10.100.4.0/23
 
| noisebridge
 
| Noisebridge
 
|
 
|-
 
| 10.100.16.0/24
 
| royksopp
 
| 0x1.net
 
| Testing for OpenWrt packages, see http://0x1.net/openwrt for binaries
 
|-
 
| 10.100.68.0/23
 
| ResistorNET
 
| [http://wiki.nycresistor.com/wiki/ResistorNET ResistorNET Information]
 
| NYC Resistor Hackerspace 397 Bridge Street 5th Flr Brooklyn NY 11201
 
|-
 
| 10.100.100.0/23
 
| hhh
 
| [http://web.Ivy.NET/~carton/rant/hhh-network-diagram.pdf HHH network diagram]
 
| former site og HHH: 114 Forrest St Apt 3A / Brooklyn NYC
 
|-
 
| your subnet
 
| your unique name
 
| your url / description
 
| your remarks
 
|- bgcolor="#efefef"
 
| 10.104.0.0/14
 
| us hackerspaces range - reserved
 
| us hackerspaces range - reserved
 
| us hackerspaces range - reserved
 
|}
 
 
 
=== ccchh - Hamburg ===
 
* connector: [[User:Haegar]]
 
* url: http://hamburg.ccc.de
 
* added in Wiki
 
* subnet: 192.168.16.0/23 - renumbering needed.
 
 
 
=== T42 - Hamburg ===
 
* connector: winni (at) ccc.de
 
* url: http://T42.de/
 
* subnets: 10.10.10.0/23 and 10.11.22.0/24 - renumbering needed.
 
 
 
=== nycresistor - New York ===
 
* connector: [[User:openfly]] ( matt [at] nycresistor.com )
 
* url: http://www.nycresistor.com
 
* network Wiki: http://wiki.nycresistor.com/wiki/ResistorNET
 
 
 
=== noisebridge - San Francisco ===
 
* connector: aestetix
 
* url: https://www.noisebridge.net
 
* network setup: https://www.noisebridge.net/wiki/Network
 
* subnet: 172.30.0.0/22 - renumbering needed due to collision with Freifunk Bornheim
 
 
 
=== PS:one - Chicago ===
 
* connector: tcrown
 
* url: http://pumpingstationone.org/
 
 
 
  
=== Hive76 - Philadelphia ===
+
== Other related software ==
* connector: FarMcKon
 
* url: http://Hive76.org
 
  
=== ccc hannover ===
+
=== DNS ===
* (in chaosvpn 1.0)
+
See [[ChaosVPN:DNS | DNS]]
* connector: [[User:Lotho]] ( lotho [at] hannover.ccc.de )
 
* url: http://hannover.ccc.de
 
* subnet: 10.23.42.0/24 - renumbering needed due to collision with Freifunk Brandenburg.
 
  
=== ccckc ===
+
=== IRC ===
* Kansas City
 
* connector: [[User:rixon]]
 
* url: http://cowtowncomputercongress.org
 
  
=== hhh ===
+
irc.hackint.hack (172.31.0.30) or irc.hackint.net - join us in #chaosvpn
* (in chaosvpn 1.0, at least for a while)
 
* connector: [[User:Carton]] (carton@Ivy.NET)
 
* node name: lucette
 
* url: (diagram somewhat outdated) http://web.Ivy.NET/~carton/rant/hhh-network-diagram.pdf
 
  
what about:
+
=== VoIP ===
=== ccc berlin  ===
 
* (in chaosvpn 1.0)
 
  
=== ccc cologne ===
+
Asterisk servers allowing incoming and outgoing calls to POTS in [[ChaosVPN:IPRanges#ccc_hannover|Hannover]] and [[ChaosVPN:IPRanges#ccchh_-_Hamburg|Hamburg]] hackerspaces. <br>
* (in chaosvpn 1.0)
+
Ask the admins for more information.
  
== wanted changes ==
+
=== Requested applications ===
=== short term ===
 
* The config file itself is not validated. We need a signing and validating structure. (.sig)
 
* clients don't have to authentificate themself - everybody can see the config.
 
* if admins are lazy and don't rebuild the config file properly we will have old routes in the network that don't dissapear (at least until the tinc is reconfigured and restarted)
 
  
 +
During Chaos Communication Camp 2011, participants of the ChaosVPN workshop suggested various applications:
  
=== long term ===
+
* Mirrors of interesting public FTP/WWW sites
tinc does have some problems. That is the reason why we want to replace that in the forseable future.
+
* Bittorrent trackers
That will be [http://wiki.hamburg.ccc.de/index.php/ChaosVPN#ChaosVPN_3.0 ChaosVPN 3.0]
+
* Email (either transparently route email from public domains via ChaosVPN, or have .hack email addresses)
 +
* Censorship detection: service to request a public webpage from proxies at several nodes at once, compare the differences
 +
* GeoIP avoidance?
 +
* Social networking things
 +
* Varnish cache
 +
* LDAP (maybe to allow authenticating hackers against their own hackerspace's LDAP server, like Eduroam)
 +
* Multicast services (limited support in tinc, not automatically forwarded to the LANs)
 +
* TOR entry nodes in ChaosVPN
 +
* NNTP (already available on dn42)
 +
* More games!
 +
* Distributed computing (BOINC, GRID stuff)
  
* Participants can fake network ranges my intention or mistake. (control informations inside tinc are not proper authentificated)
+
== Wanted changes ==
* http://www.cs.auckland.ac.nz/~pgut001/pubs/linux_vpn.txt
 
  
= ChaosVPN 3.0 =
+
Ideas?
  
 +
[[ChaosVPN:todo|A collection of short term changes]]
  
= ChaosVPN 1.0 (historic) =
+
= Chaosvpn Geekends =
  
ChaosVPN 1.0 is obsolete, please see above for the next implementation.
+
* [[ChaosVPN:geekend0|geekend 0 at Hamburg]]
 +
* [[ChaosVPN:geekend1|geekend 1 at Hamburg]]
 +
* [[ChaosVPN:geekend10|geekend 10 at Hamburg]]
  
== <strike>TINC SETUP</strike> ==
+
= Services available on ChaosVPN =
<strike>At the moment the Hamburg ccc Erfa uses [http://www.tinc-vpn.org TINC] together with some dirty perl-scripts, which are used to read the routes and peers.</strike>
 
  
<strike>For this Setup we have howtos for
+
Update:
[[ChaosVPN::DebianHowto|Debian]] and [[ChaosVPN::GentooHowto|Gentoo]] (in german).</strike>
 
  
=== <strike>Beginninig in 2003</strike> ===
+
If you have services you wish to be accessible to the whole of the Chaosvpn, please add your services to the online list available (within Chaosvpn) at:
<strike>(haegar:)
 
For me the whole setup with Openvpn was to complicated. It would take some time till its done and the scaling problems were forseable.
 
  
Therefore i took time today to get a working mini-solution with tinc running real quick.
+
http://list.weird.hack - Service list - 10.100.44.1 (but seems to be death currently)
  
The bigger issues with ip-submission and database are able to be added later without any big effort.
 
  
Most importand design goals were:
 
* data traffic between participants must not rely on the ccc infrastructure.
 
* failure of any parts of the infrastructure must not shut down the network completely
 
* no work needed for participants just because a new participant is joining or a old one quitting.
 
  
system requirements
+
* [[ChaosVPN:Proxy|Proxy]]
* linux only first
+
* [[ChaosVPN:CTF|OpenArena CTF]]
** tinc is availible for nearly all unix variants and windows, but my perl script is only working on linux so far.
+
* [[VoIP| Vermittlung Chaosphone]]
* perl with LWP and https support
+
* [[ChaosVPN:VoIP|VoIP]]
* working dyndns hostname that conains the actual router-ip or static ip
+
* [[ChaosVPN:IRC|IRC]]
</strike>
+
* [[ChaosVPN:Minecraft|Minecraft]]
 +
* [[ChaosVPN:Bitlbee|Bitlbee]]
 +
* [[ChaosVPN:ZNC|ZNC]]
 +
* [[ChaosVPN:Jabber|Jabber]]
 +
* [[ChaosVPN:FTP|FTP]]
 +
* [[ChaosVPN:BBS|BBS]]
 +
* [[ChaosVPN:Cracking|HashCracking]]
 +
* [[ChaosVPN:Monitoring|Monitoring]]
 +
* [[ChaosVPN:News|Usenet]]
 +
* [[ChaosVPN:NZB|Usenet indexer (newznab)]]
 +
* [http://brmlab.cz/project/chaosvpn#brmlab_warzone Brmlab WarZone challenges]
 +
* [http://brmlab.cz/project/chaosvpn#tor_socks4_proxy Brmlab Tor SOCKS4 proxy]
 +
* [[ChaosVPN:whatsmyip|ifconfig.hack info, a whats my ip page]]
  
=== <strike>Update 2006</strike> ===
+
[[Category:ChaosVPN]]
<strike>Today (2006) i would implement things different than i did before, but when this happens is completely up in the stars.
 
Until there is a better setup we will use the old setup.
 
</strike>
 

Latest revision as of 19:24, 6 June 2019

Note:
ChaosVPN is a VPN to connect Hackers and Hackerspaces - it does NOT provide anonymous internet access!
For this look at tor or other similar services.

It will also not help you to reach domains like .rdos, .lll, .clos or any other strange things supposed to be available on the "dark web".

Alternative: If you prefer BGP, you can also connect via https://dn42.net/, we are interconnected.

Goals

ChaosVPN is a system to connect Hackers.

Design principals include that it should be without Single Point of Failure, make usage of full encryption, use RFC1918 ip ranges, scales well on >100 connected networks and is being able to run on a embedded hardware you will find in our todays router.

It should be designed that noone sees other peoples traffic.

It should be mainly autoconfig as in that besides the joining node no administrator of the network should be in the need to acutally do something when a node joins or leaves.

If you want to find a solution for a Network without Single Point of failure, has - due to Voice over IP - low latency and that noone will see other peoples traffic you end up pretty quick with a full mesh based network.

Therefore we came up with the tinc solution. tinc does a fully meshed peer to peer network and it defines endpoints and not tunnels.

ChaosVPN connects hacker wherever they are. We connect roadwarriors with their notebook. Servers, even virtual ones in Datacenters, Hackerhouses and hackerspaces. To sum it up we connect networks - maybe down to a small /32.

So there we are. ChaosVPN is working and it seems the usage increases, more nodes join in and more sevices pop up.

For now, an overview picture of the currently connected nodes:

and a simple display of node-uptimes:

Howto join ChaosVPN?

You want to join ChaosVPN and experience the awesomeness of it?

There is a short HowTo how to better mesh your own nodes using ChaosVPN.

Mailinglist

We have a mailinglist, and invite all interested persons to join.

https://www.hamburg.ccc.de/mailman/listinfo/chaosvpn

ChaosVPN 2.0

IP Ranges and Participants:

Please see IP Range for more Infos.

Other related software

DNS

See DNS

IRC

irc.hackint.hack (172.31.0.30) or irc.hackint.net - join us in #chaosvpn

VoIP

Asterisk servers allowing incoming and outgoing calls to POTS in Hannover and Hamburg hackerspaces.
Ask the admins for more information.

Requested applications

During Chaos Communication Camp 2011, participants of the ChaosVPN workshop suggested various applications:

  • Mirrors of interesting public FTP/WWW sites
  • Bittorrent trackers
  • Email (either transparently route email from public domains via ChaosVPN, or have .hack email addresses)
  • Censorship detection: service to request a public webpage from proxies at several nodes at once, compare the differences
  • GeoIP avoidance?
  • Social networking things
  • Varnish cache
  • LDAP (maybe to allow authenticating hackers against their own hackerspace's LDAP server, like Eduroam)
  • Multicast services (limited support in tinc, not automatically forwarded to the LANs)
  • TOR entry nodes in ChaosVPN
  • NNTP (already available on dn42)
  • More games!
  • Distributed computing (BOINC, GRID stuff)

Wanted changes

Ideas?

A collection of short term changes

Chaosvpn Geekends

Services available on ChaosVPN

Update:

If you have services you wish to be accessible to the whole of the Chaosvpn, please add your services to the online list available (within Chaosvpn) at:

http://list.weird.hack - Service list - 10.100.44.1 (but seems to be death currently)