Nebula

# On Secbox, issue a client certificate
tsh ssh root@secbox
cd nebula/
nebula-cert sign -duration 80658h -ip 10.133.15.X/24 -name mynodename

# On your node, install nebula dist
wget https://github.com/slackhq/nebula/releases/download/v1.9.5/nebula-linux-amd64.tar.gz
tar xf nebula-linux-amd64.tar.gz
mv nebula nebula-cert /usr/local/bin/
rm nebula-linux-amd64.tar.gz

# Copy ca.crt, host.crt, host.key to your node
mkdir /etc/nebula
cd /etc/nebula
nano ca.crt host.crt host.key
chmod 600 host.key

# Copy base configuration
nano config.yml

# Install service
systemctl edit --full --force nebula.service

# Go ahead!
systemctl enable --now nebula.service

# If your node is LXC container, you'll need to set up TUN permission
# Insert the lxc-config-tun contents to the end of your CT configuration
nano /etc/pve/lxc/1337.conf

lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net dev/net none bind,create=dir

# The firewall is default deny. There is no way to write a deny rule.
# Rules are comprised of a protocol, port, and one or more of host, group, or CIDR
# Logical evaluation is roughly: port AND proto AND (ca_sha OR ca_name) AND (host OR group OR groups OR cidr) AND (local cidr)
# - port: Takes `0` or `any` as any, a single number `80`, a range `200-901`, or `fragment` to match second and further fragments of fragmented packets (since there is no port available).
#   code: same as port but makes more sense when talking about ICMP, TODO: this is not currently implemented in a way that works, use `any`
#   proto: `any`, `tcp`, `udp`, or `icmp`
#   host: `any` or a literal hostname, ie `test-host`
#   group: `any` or a literal group name, ie `default-group`
#   groups: Same as group but accepts a list of values. Multiple values are AND'd together and a certificate would have to contain all groups to pass
#   cidr: a remote CIDR, `0.0.0.0/0` is any.
#   local_cidr: a local CIDR, `0.0.0.0/0` is any. This could be used to filter destinations when using unsafe_routes.
#      Default is `any` unless the certificate contains subnets and then the default is the ip issued in the certificate
#      if `default_local_cidr_any` is false, otherwise its `any`.
#   ca_name: An issuing CA name
#   ca_sha: An issuing CA shasum
firewall:
  # Allow all traffic from this node
  outbound:
    - port: any
      proto: any
      host: any

  inbound:
    # Allow ICMP from any nodes
    - port: any
      proto: icmp
      host: any

    # Allow 8888/tcp from ingress nodes
    - port: 8888
      proto: tcp
      groups:
        - ingress

# Certificates
pki:
  ca: /etc/nebula/ca.crt
  cert: /etc/nebula/host.crt
  key: /etc/nebula/host.key

# List of known hosts and their public IPs to bootstrap from
static_host_map:
  "10.133.15.13": ["mew.int.bksp.in:4242", "10.0.2.2:4242"]
  "10.133.15.6": ["beartic.int.bksp.in:4242", "10.0.2.99:4242"]
  "10.133.15.7": ["wailord.int.bksp.in:4242", "10.0.2.51:4242"]

# Lighthouses are used by hosts to discover each other.
lighthouse:
  # If this node is Lighthouse, set am_lighthouse to true AND remove the hosts list.
  am_lighthouse: false

  # If this node is a plain client, set am_lighthouse to false AND fill hosts with
  # internal IPs of other Lighthouses.
  hosts:
    - "10.133.15.6"
    - "10.133.15.7"
    - "10.133.15.13"

# Listen for Nebula connections on all interfaces
listen:
  host: "::"
  port: 4242

# Use ChaCha20-Poly1305
cipher: chachapoly

# Spawn "ennet0" TUN interface for Nebula traffic
tun:
  dev: ennet0

# List of local networks to speed up network bootstrap
preferred_ranges: ["10.0.2.0/23"]

# Only output errors
logging:
  level: error
  format: text

[Unit]
Description=Nebula overlay networking tool
Wants=basic.target network-online.target nss-lookup.target time-sync.target
After=basic.target network.target network-online.target
Before=sshd.service

[Service]
Type=notify
NotifyAccess=main
SyslogIdentifier=nebula
ExecReload=/bin/kill -HUP $MAINPID
ExecStart=/usr/local/bin/nebula -config /etc/nebula/config.yml
Restart=always

[Install]
WantedBy=multi-user.target