ChaosVPN

the big picture

What is this all about?

mc.fly will write some stuff about it. In case you have awesome ideas just add them.

ChaosVPN 1.0

TINC SETUP

At the moment the Hamburg ccc Erfa uses TINC together with some dirty perl-scripts, which are used to read the routes and peers.

For this Setup we have howtos for Debian and Gentoo (in german).

Beginninig in 2003

(haegar:) For me the whole setup with Openvpn was to complicated. It would take some time till its done and the scaling problems were forseable.

Therefore i took time today to get a working mini-solution with tinc running real quick.

The bigger issues with ip-submission and database are able to be added later without any big effort.

Most importand design goals were:

• data traffic between participants must not rely on the ccc infrastructure.
• failure of any parts of the infrastructure must not shut down the network completely
• no work needed for participants just because a new participant is joining or a old one quitting.

system requirements

• linux only first
  • tinc is availible for nearly all unix variants and windows, but my perl script is only working on linux so far.
• perl with LWP and https support
• working dyndns hostname that conains the actual router-ip or static ip

Update 2006

Today (2006) i would implement things different than i did before, but when this happens is completely up in the stars. Until there is a better setup we will use the old setup.

ChaosVPN 2.0

redesign

The Rebuild of the ChaosVPN became nessesary at some point, as the vermittlung is blackholed. Furthermore we would like to put live back to the ChaosVPN and use it to interconnect the hackerspaces.

So we thought its a good time to redesign stuff. We will climb up to tinc 1.0.10.

software

Config builder

Currently we are porting haegars script from perl to c and strip off curl and openssl, so it fits in a OpenWRT box.

OpenWRT Packages

Blogic will build a special OpenWRT package, which is called chaosvpn at the moment and a recent tinc 1.0.10 for that.

Debian Packages

Haegar updated (backported) tinc 1.0.10 packages for debian. They are availible at:

• Debian Etch: http://debian.sdinet.de/etch/sdinet/tinc/
• Debian Lenny: http://debian.sdinet.de/lenny/sdinet/tinc/

I will also create Debian packages of the config builder once it is in a usable state.

sources

The scripts are availible at: http://github.com/ryd/chaosvpn

IP Ranges and Participants:

We need to have non colliding ip ranges and therefore we need some coordination of the used ip ranges.

First of all we would like to be compilant to the used ip ranges of freifunk and dn42.

The IP ranges overall are defined in the freifunk wiki ip-net page as root source.

So we use 172.31.0.0/16 for the europeans and 10.100.0.0/13 for the americans. That should leave enough space for everone untill ipv6 is not the future but the present.

However we will not support 192.168.0.0/16 ip ranges as they are used for various other reasons. This rfc1918 ip range will stay as private to use for internal use (and in fact its used in the dn42 for routing uses.)

question: reverse DNS?

ip ranges

IP-subnets	Node	unique name	Remarks
172.31.0.0/16	europa range	europa range	europa range
172.31.0.0/23	*reserved*	*reserved*	*reserved*
172.31.2.0/23	free	none	none
your subnet	your url / description	your unique name	your remarks
your subnet	your url / description	your unique name	your remarks
172.31.16.0/23 *planned*	CCC Hamburg		Chaos Computer Club Hansestadt Hamburg
172.31.18.0/23	haegar home	haegarhome
172.31.20.0/23 *planned*	CCC Hamburg		Chaos Computer Club Hansestadt Hamburg Second Range
172.31.22.0/24	haegar hosted servers / vms	haegarvlad
172.31.23.0/24	*reserved*	*reserved*	*reserved*
172.31.42.0/24	*reserved*	*reserved*	*reserved*
your subnet	your url / description	your unique name	your remarks
172.31.100.0/24	[http://www.datensumpf.de datensumpf	datensumpf	mc.flys subnet at home
172.31.255.0/24	*reserved*	*reserved*	*reserved*
your subnet	your url / description	your unique name	your remarks
10.100.0.0/14	us hackerspaces range	us hackerspaces range	us hackerspaces range
10.100.0.0/23	PS:one	PS:one
10.100.100.0/23	HHH network diagram	hhh	former site og HHH: 114 Forrest St Apt 3A / Brooklyn NYC
10.104.0.0/14	us hackerspaces range - reserved	us hackerspaces range - reserved	us hackerspaces range - reserved

ccchh - Hamburg

• connector: User:Haegar
• url: http://hamburg.ccc.de
• added in Wiki
• subnet: 192.168.16.0/23 - renumbering needed.

nycresistor - New York

• connector: User:openfly ( matt [at] nycresistor.com )
• url: http://www.nycresistor.com
• network Wiki: http://wiki.nycresistor.com/wiki/ResistorNET

noisebridge - San Francisco

• connector: aestetix
• url: https://www.noisebridge.net
• network setup: https://www.noisebridge.net/wiki/Network
• subnet: 172.30.0.0/22 - renumbering needed due to collision with Freifunk Bornheim

PS:one - Chicago

• connector: tcrown
• url: http://pumpingstationone.org/

ccc hannover

• (in chaosvpn 1.0)
• connector: User:Lotho ( lotho [at] hannover.ccc.de )
• url: http://hannover.ccc.de

ccckc

• Kansas City
• connector:
• url:

what about:

ccc berlin

• (in chaosvpn 1.0)

ccc cologne

• (in chaosvpn 1.0)

hhh

• (in chaosvpn 1.0, at least for a while)
• connector: User:Carton (carton@Ivy.NET)
• node name: lucette
• url: (diagram somewhat outdated) http://web.Ivy.NET/~carton/rant/hhh-network-diagram.pdf

wanted changes

short term

• The config file itself is not validated. We need a signing and validating structure. (.sig)
• clients don't have to authentificate themself - everybody can see the config.
• if admins are lazy and don't rebuild the config file properly we will have old routes in the network that don't dissapear (at least until the tinc is reconfigured and restarted)

long term

tinc does have some problems. That is the reason why we want to replace that in the forseable future. That will be ChaosVPN 3.0

• Participants can fake network ranges my intention or mistake. (control informations inside tinc are not proper authentificated)
• http://www.cs.auckland.ac.nz/~pgut001/pubs/linux_vpn.txt