N2N guide: the best peer to peer vpn on debian/unix

Hi! Have you ever found yourself having to set up vpn over vpn over yet another vpn, or ssh tunnels with vpn, vpn with ssh tunnels with vpn… just to be able to connect to your customers' servers and your own? I have, and I found a solution that works on unix, and above all on debian.

This package is called n2n, and it's a program made by Ntop, an Italian company http://www.ntop.org/about/locations/

It's already in the official debian ubuntu repositories, and to install it you just run

apt-get install n2n

Easy, right?

In our case the version we're going to use is V1; there's also V2, but since it isn't in the standard repositories you'd have to compile it yourself.

To work, n2n's architecture needs a machine acting as referee, called a "supernode".

So you need 3 machines in total to try it out (in production there will obviously be more machines)

We'll call one of the machines Supernode 1, and on it we'll run the "referee" program

sudo supernode -l 5000

Where 5000 is the port we picked for convenience, where our service will be listening.

After that, we need to choose a network name and a password that will be shared by all the machines we want in our virtual LAN. For example: network name: star network password: wars

On the first client, which we'll call Client 1, we'll run the following command:

sudo edge -a 172.16.0.1 -c star -k wars -l IPSERVERSUPERNODO:5000 -d n2n -b -m ae:e9:ee:22:78:5b -M 1200 -f

IPSERVERSUPERNODO will be an internet-reachable ip of the Supernode 1 machine, while the ip 172.16.0.1 will be the virtual ip we give to our new n2n network interface. We also set the mac address, in this case ae:e9:ee:22:78:5b, and the mtu with the -M 1200 parameter.

This parameter is really important because in some cases the default value of 1400 is too big, and doesn't get encapsulated correctly.

Then on the second client, which we'll call Client 2, we'll run

sudo edge -a 172.16.0.2 -c star -k wars -l IPSERVERSUPERNODO:5000 -d n2n -b -m ae:e9:ee:22:78:5c -M 1200 -f

Same command, but with a different ip and mac address, to uniquely identify this Client 2.

This way, if you try to ping or make any other kind of connection between the two Clients, they'll be reachable both ways! Try it and see! On top of that, this vpn creates direct UDP connections between the clients, so the connection speed is always the highest possible.

We can then add a client 3, 4 and so on, just changing the edge command we run!

🙂