VeilNet

Servers and VMs

Join two sites, 10.1.0.0/24 and 10.2.0.0/24, with one conflux subnet router on each site, so that their machines reach each other at their own addresses.

Needs
One Linux host on each site, with root access and outbound internet access
Uses
conflux up --subnet

Before and After VeilNet

Use this setup when machines on two sites need to reach each other at their own addresses, without a VPN gateway between the sites.

Today, an IPsec tunnel between two VPN gateways joins the sites. IKEv2 negotiates the keys with RSA and Diffie-Hellman, and a quantum computer can break both.

With VeilNet, one host on each site runs conflux as a subnet router for its site. The host can be bare metal or a virtual machine. The machines behind it keep their addresses and need no new software.

Today and with VeilNetServers & VMs

Today, IPsec, IKEv2, RSA and DH protect these links. A quantum computer can break all of them. With VeilNet, ML-DSA-87, ML-KEM-1024 and AES-256-GCM protect every link.

The drawing leaves out one route. Each machine needs a route to the other site through its local subnet router, which step 4 adds.

Joining the Sites

0 of 4 done

  1. Follow Installation on one host on each site. Each host must be on its site's subnet and have outbound internet access. The two sites need no route between them.

    This guide uses Linux, where conflux sets up forwarding for you. On macOS, the BSDs and Windows, conflux changes nothing and prints the commands for you to run instead.

On a sovereign network, the guardian commissions each host and issues its manifest. Install it with sudo conflux enrol --manifest FILE, then follow the same steps without --taint, because the credential carries the taints. See Joining a sovereign network.

Verifying the Setup

From a machine on site A, ping a machine on site B at its own address. You should see every packet answered:

$ ping -c 3 10.2.0.20
PING 10.2.0.20 (10.2.0.20) 56(84) bytes of data.
…
--- 10.2.0.20 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms

On the subnet router, run sudo conflux routes. You should see your own subnet as served and the other site's subnet as accepted. Each IPv4 network also shows the IPv6 prefix it travels as on the overlay:

host on site A
$ sudo conflux routes
NETWORK                                    VIA                    STATE     WHY
10.1.0.0/24 (64:ff9b:1::a01:0/120)         -                      served    -
10.128.0.1/32 (64:ff9b:1::a80:1/128)       -                      served    -
10.2.0.0/24 (64:ff9b:1::a02:0/120)         ujzdegxdnc             accepted  -
10.128.0.2/32 (64:ff9b:1::a80:2/128)       ujzdegxdnc             accepted  -

When the host is ready to forward, the service log shows host set up to forward for the realm. To read the log, run journalctl -u conflux -n 50.

Reference

ConfluxSubnets, Exits and UplinkEvery form of --subnet, how to bind a subnet to taints, and what the host needs.Anchor protocolSubnet Routers and ExitsHow peers choose between subnet routers, how they share flows, and what an exit node refuses.Anchor protocolTaintsCompartments inside a realm, and the rule that decides who reaches whom.ConfluxProxy and TUN ModesWhat an interface gives a host, and how a router without one differs.