Related, here's a surprisingly balanced comparison of Nebula and Tailscale, on tailscale.com: https://tailscale.com/kb/1148/tailscale-vs-nebula/.

> If you’re a system administrator or technical person looking for a completely open source, free peer-to-peer mesh VPN, and you’re willing to run a certificate authority and the control plane yourself, try out Nebula.

> If you’re looking for a polished, user-friendly peer-to-peer mesh VPN with a hosted control plane and integration with existing identity providers, give Tailscale a try.

Hm — there’s a middle ground here that’s missing. I’d like to see a managed mesh allow for disabling its key distribution for certain nodes. They don’t create wireguard peers for any but a predefined shortlist of public keys, but still accept route updates from those peers.

The threat model is someone adding peers to the control plane, including as a result of control plane takeover or the identity provider failing. These special nodes can’t then be made to talk to anybody they can’t authenticate, no matter what you do on the control plane. It assumes private keys are safe. Obviously this is a client side setting, which shouldn’t have any control plane API, just like the current Tailscale options to eg accept no incoming traffic. This comes from my experience with ZeroTier, which I wrote about here: https://news.ycombinator.com/item?id=28426664

Then you can run your own Wireguard key distribution if you like, but ideally you just distribute manually for a few nodes and leave it at that.

Tiny usability improvement for small networks: “freeze” mode where the current set of peer public keys is frozen and no new peers can be added. Tie this to a (G)UI on each node to accept new peers anyway with user interaction using Signal style key visualisation, and you’re cooking with gas. Probably not worth it though, virtually nobody with three devices total and the time to do this manually really needs it.

Nebula is great - super simple to set up and get started if you have a VM to use as a lighthouse. Lots of cloud providers free tiers are have enough resources to host a lighthouse as well.

Certificate management is its one weakness at the moment. There are a growing number of projects floating around attempting to solve that though:

- https://github.com/unreality/nebula-mesh-admin

- https://github.com/b177y/starship

- https://github.com/symkat/MeshMage

Plus im sure defined networks has their own solution in the works as well.

Nebula creators also started their own organization called Defined Networking to focus more on this networking: https://www.defined.net/

I've really liked nebula and have been working on a web frontend. Basically define a network and nodes and it uses nebula to generate certificates and has scripts for installing.

https://github.com/symkat/MeshMage

I've been using Nebula for personal use and it's really great. I have a free Oracle Cloud vm as my "lighthouse."

The advantage of Nebula is that it's dead simple. Generate a keypair, copy it over, copy the config file, and go. It can do mesh routing for the vpn and traverse nat magically. You can delegate dns to the lighthouse and name resolution just works too.

That simplicity is awesome for personal use, and maybe it's good enough for a small operation, but I'm guessing it doesn't have all the bells and whistles you'd want for medium or larger companies.

Nebula transits every EC2-to-EC2 packet at Slack, across lots of AWS regions and tens of thousands of hosts. It’s probably doing petabits of traffic per second. And it’s a safer, more expressive firewall than EC2 security groups.

So, yes, it works for personal use-cases but it works for truly gigantic applications, too.

The big thing I see missing is the management piece, which is what makes Tailscale compelling. If you're just running Nebula as an individual user, or for a small org, there wouldn't be much overhead. Otherwise, for larger deployments, you need to "roll your own" solution to manage configs outside of Nebula itself.

You'd also want this to be self-service in some way - so road warriors can rotate their own certs, with auth backed by some kind of central SSO system. The last I looked, Nebula didn't offer this stuff.

How well does it handle public WiFi? Some hotspots may block any non-HTTP traffic, or traffic on nonstandard ports. IIRC ZeroTier will use relays when UDP traffic is blocked.

innernet[1] is another similar one

[1]: https://github.com/tonarino/innernet

Also:

WireTrustee: https://news.ycombinator.com/item?id=27672715

Netmaker: https://github.com/gravitl/netmaker

Defined.net (from makers of Slack Nebula): https://www.defined.net/

One thing I can't figure out with Nebula is - how do you join multiple different networks?

For example, I have a personal laptop - I want to join two different networks, that are for two different purposes, and be able to talk to hosts in each? (But hosts in each should not be able to talk to hosts in the other)

It doesn't do that, you get one CA per instance.

You can run multiple instances though.

Actually it does do that, you can trust multiple CAs in a single instance and even write firewalls scoped to CAs.

Tinc is also pretty good and predates both by about a decade :)

Ps if we're listing alternatives zerotier is also one

Yggdrasil is not the same as either of these, but it can do similar things.

https://yggdrasil-network.github.io/

Doesn’t Yggdrasil use WireGuard these days?

Interesting, what are you using for cert management?