Serial Links
Join a field-site node and a control machine over a serial cable with no IP network between them, and forward the site's device network over the cable.
- Needs
- Two Linux, macOS or BSD machines joined by a serial cable, each online once to enrol
- Uses
- conflux up --uplink
Before and After VeilNet
Use this setup when a field site has no IP network to the control room, but you can run a serial cable between them.
Today, a serial device reaches the control room through a serial-to-IP converter, a firewall, a cellular modem and a VPN gateway. The serial line carries Modbus RTU or DNP3 in clear text. The VPN tunnel negotiates its keys with RSA, which a quantum computer can break.
With VeilNet, conflux on each machine uses the serial line as its uplink. The cable carries the encrypted overlay instead of the host's network. Each end proves its identity and encrypts traffic exactly as it would on the internet.
Today these serial links carry Modbus RTU and DNP3 in clear text, and reaching the cloud takes a converter, a firewall, a modem and a VPN gateway, with IPsec over a quantum-vulnerable key exchange. With VeilNet, ML-DSA-87, ML-KEM-1024 and AES-256-GCM protect every link.
The drawing shows the remote end in the cloud. Over a cable, the remote end is the machine at the other end of the line, and the two machines reach only each other.
How a Serial Link Works
A serial link works as follows:
- One link, one peer. A cable joins two machines.
- Uplink or IP network. A machine uses either one uplink or its IP network.
- IP devices. With
--subnet, the node forwards a private IP network on the site. - Unix hosts. Uplinks work on Linux, macOS and the BSDs.
Setting Up the Link
Follow Installation on each machine. Each machine needs its serial adapter attached, and a network connection for the next two steps.
On a sovereign network, the guardian commissions each machine and issues its manifest. Install it with sudo conflux enrol --manifest FILE, then run conflux up without --taint, because the credential carries the taints. See Joining a sovereign network.
Verifying the Setup
On either machine, run sudo conflux status. You should see the link above the mode, with no host network under it:
uplink /dev/ttyUSB0:115200 — no host network under it mode tun — interface anchor0
From the control machine, ping the field node and a device behind it:
$ ping -c 3 10.128.0.2 $ ping -c 3 192.168.10.30
Both reply once the handshake has crossed the line, which takes about 2 seconds at 115200 baud. sudo conflux peers then lists the field node with DATA yes.
Slower lines take longer to complete the handshake:
| Line speed | Handshake | |
|---|---|---|
| 115200 baud | About 2 s | Comfortable |
| 57600 baud | About 4 s | Fine |
| 19200 baud | About 12 s | Usable |
| 9600 baud | About 25 s | Marginal against a 60-second idle timeout |
| LoRa and other duty-cycled radios | Hours | No |
Below 19200 baud, conflux warns but still accepts the speed:
conflux: 9600 baud carries a realm handshake in about 25s, against a 60s idle timeout. It is a full TLS 1.3 exchange with ML-DSA certificates both ways, so the floor is the identity model's rather than the link's: slower lines run out of time rather than merely take longer.