「Yggdrasil」の版間の差分
(英語版から転載) |
(一部翻訳) |
||
| 2行目: | 2行目: | ||
[[Category:ピアツーピア]] |
[[Category:ピアツーピア]] |
||
[[en:Yggdrasil]] |
[[en:Yggdrasil]] |
||
| + | [https://yggdrasil-network.github.io/ Yggdrasil] は、完全なエンドツーエンド暗号化 IPv6 ネットワークの初期段階での実装です。軽量で、自己組織化され、複数のプラットフォームでサポートされており、IPv6 対応のほぼ全てのアプリケーションで他の Yggdrasil ノードと安全に通信することができます。 |
||
| − | [https://yggdrasil-network.github.io/ Yggdrasil] is an early-stage implementation of a fully end-to-end encrypted IPv6 network. It is lightweight, self-arranging, supported on multiple platforms, and allows pretty much any IPv6-capable application to communicate securely with other Yggdrasil nodes. |
||
| + | この記事では、Yggdrasil のセットアップと使用方法について説明します。 |
||
| − | This article describes how to set up and use Yggdrasil. |
||
| − | == |
+ | == インストール == |
| + | {{Pkg|yggdrasil}} パッケージを [[インストール]] して下さい。 |
||
| − | [[Install]] the {{Pkg|yggdrasil}} package. |
||
== Running == |
== Running == |
||
2022年2月21日 (月) 01:07時点における版
Yggdrasil は、完全なエンドツーエンド暗号化 IPv6 ネットワークの初期段階での実装です。軽量で、自己組織化され、複数のプラットフォームでサポートされており、IPv6 対応のほぼ全てのアプリケーションで他の Yggdrasil ノードと安全に通信することができます。
この記事では、Yggdrasil のセットアップと使用方法について説明します。
インストール
yggdrasil パッケージを インストール して下さい。
Running
Start/enable yggdrasil.service.
This will create a tun network interface and make available two new IPv6 network interfaces. The important one starts with 200: which is what your machine will be known as in the Yggdrasil network. This IP address is using a reserved part of the IPv6 standard. This avoids any conflicts with the wider Internet.
To test this works you can run:
# yggdrasilctl getself
Configuration
By default your Yggdrasil instance will not have any peers and thus you are running a standalone service. Editing the /etc/yggdrasil.conf file, which uses the JSON format, allows one to add peers and after restarting the service your node can both reach the wider network, as well as others can find your node.
More details about the configuration is available in the upstream documenation. The main configuration file is located at /etc/yggdrasil.conf.
To peer with the wider network, start with the public-peers documentation.
Local firewall
In todays networking practices a common Linux installation is not exposed directly to the Internet. Only servers will typically have a public IP address. As a result our ssh or similar services are not able to be attacked by anyone and everyone.
It is important to realize that running Yggdrasil and peering it to the wider Yggdrasil network changes this. Services that listen on all network connections will become reachable by anyone that connects to this network. You might want configure them to not listen on the Yggdrasil network or quickly hide running services with a couple of firewall rules.
/etc/iptables/ip6tables.rules
#yggdrasil *filter :INPUT ACCEPT [8:757] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [5:463] -A INPUT -i tun0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -i tun0 -m conntrack --ctstate INVALID -j DROP -A INPUT -i tun0 -j DROP COMMIT
Start/enable ip6tables.service to make this take effect.