pcarroll

7 ms·

1.
by pcarroll 8mo ago
I wanted to use 11.0.0.0 and call the company "Eleven," but by that time the DOD had given up the block for general use... GCNAT is perfect.
2.
by pcarroll 8mo ago
We did. It's called IPv6. It's 20 years old and still not usable universally. At the high end, like enterprise or telcos, it's fantastic. But at the grass roots level of residential and small businesses, it's still a nig
3.
by pcarroll 8mo ago
The need is real. You are a service provider. You need to manage equipment at customer sites. You need to access them simultaneously. But all the customers are using the same subnet... If Bell gave out cellphones with the same phone number,
4.
by pcarroll 8mo ago
That does not happen here. The CGNAT addresses are in the VPN tunnel. And the tunnel connects private devices end-to-end. The LAN packets never see the Internet. They are inside the WireGuard packets.
5.
by pcarroll 8mo ago
The problem there is you still need to keep track of the subnets. It works for a while, but it's quite complex. NAT is actually easier when you get into hundreds of sites.
6.
by pcarroll 8mo ago
The way we did it, roting is not a problem. Any Netrinos client (Windows, Mac, or Linux, including the free version) can act as a gateway. It assigns a unique overlay IP to devices on the local network that can't run software themselve
7.
by pcarroll 8mo ago
Hole punching actually works most of the time. A lot more often than you might think. But enterprise firewalls usually don't allow it. And some home routers fail when you check all the anti-intrusion options. But it's the same for
8.
by pcarroll 8mo ago
Yes! Exactly this.
9.
by pcarroll 8mo ago
IPv6 is very badly supported at the low end of the market. Cheap webcams, doorbells, etc. And that not counting already old equipment... If we had a nuclear war, we could start over. But for now, we are stuck. Blame it on Cisco for inventin
10.
by pcarroll 8mo ago
We chose Go as the development language. Go produces statically compiled binaries that include all dependencies. The only external deps are wireguard, nftables, nmap, etc. All easy stuff. So we have no need for Docker. We publish binaries f
11.
by pcarroll 8mo ago
This works fine for your end. But the issue we are addressing is on the other end, when you don't control the network and need to reach devices. If all customer sites are running rfc-unroutable blocks, you eventually encounter conflict
12.
by pcarroll 8mo ago
I like to think this is what we did. It's a simple Linux software stack - Linux, nftables, WireGuard, Go... But the goal was also to make it automatic and easy to use. It's not for my Mom. But you don't need a CCNP either. Th
13.
by pcarroll 8mo ago
The initial idea started as a bunch of ssh tunnels. Been doing that for years. But WireGuard seemed a better solution at scale, and more efficient. When I first saw WiteGuard, it blew my mind how elegantly simple it was. I always hated VPNs
14.
by pcarroll 8mo ago
Support for IPv6 is notoriously bad in residential modems. They can barely run IPv4. In an enterprise, you can do it properly. But here we are stuck with the junk the ISP gave out. Customers don't care. You have to work with what you&#
15.
by pcarroll 8mo ago
How do you handle embedded devices that cannot install software?
16.
by pcarroll 8mo ago
I actually looked at using those before the CGNAT range, but many of those blocks have been returned to the public Internet.
17.
When Every Network is 192.168.1.x(netrinos.com)
155 points by pcarroll 8mo ago|117 comments
18.
by pcarroll 8mo ago
How overlay addressing and 1:1 NAT solve the conflicting subnet problem across hundreds of sites. A technical walkthrough with WireGuard. https://netrinos.com/blog/conflicting-subnets
19.
by pcarroll 9mo ago
We implement STUN and TURN functionality natively in WireGuard rather than using separate protocols. Netrinos uses a central rendezvous server that participates in WireGuard handshakes solely to collect your devices' public endpoints a
20.
by pcarroll 9mo ago
I have found that residential ISP routers are notoriously flaky. It doesn't take much to confuse them. A lot of edge cases could be just this.
21.
by pcarroll 9mo ago
Thanks to everybody who participated. This has been an excellent discussion and has resulted in some interesting ideas to pursue.
22.
by pcarroll 9mo ago
Maybe I should look into that... there are a few different ways to do it, and none of them are all that hard. - i just put it in the roadmap
23.
by pcarroll 9mo ago
Netrinos can be entirely cli on all 3 platforms. If you install the OpenSSH server on Windows, you can manage Netrinos in a terminal, just like on Linux or Mac. e.g. https://netrinos.com/cdn/images/screens/win
24.
by pcarroll 9mo ago
Could you please elaborate on what you found lacking? Always looking to improve.
25.
by pcarroll 9mo ago
Each device on your account gets a private static IP address in the network 100.x.x.x. The name is static as long as the device lives on your account. Each also gets a friendly DNS name in the form device.account.2ho.ca (try finding a short
26.
by pcarroll 9mo ago
We do have some comparisons on our site... https://netrinos.com/compare Thanks
27.
by pcarroll 9mo ago
To clarify, one of the big advantages of a Mesh VPN is that the traffic does not flow through the VPN provider at all. WireGuard encrypts the traffic from device interface to device interface. The connections are point-to-point and not hub-
28.
by pcarroll 9mo ago
Pro has that. We call it a Gateway. See: https://netrinos.com/help/gateways-routing You can also have multiple gateways and send traffic through different locations. e.g. You can access a NAS on one site and a website
29.
by pcarroll 9mo ago
WireGuard itself can be configured to work either way. Our target market is smaller teams and people with limited IT skills. So, we chose not to send all traffic through the vpn. The only traffic going through the VPN is traffic to and from
30.
by pcarroll 9mo ago
Thanks for that feedback. I share your feelings about Linux. It never occurred to us that it would be reminiscent of old MS days. We were going for "clean and uncluttered". If it makes you feel better, all core development for Net

More ›