Experiment – Mesh VPN setup with Tinc

This is super short post on my experiment with setting up a mesh VPN using tinc.


  • It’s used in creating a VPN out of many small networks that are geographically distributed
  • There is no concept of server or client in tinc, so nodes try to talk to each other directly or through other nodes

Actors in the mesh

<name> – name for each actor

  • Digital Ocean droplet <externalnyc> – to which all below actors connect to
  • Digital Ocean droplet <externalblr>
  • Laptop <fedora> (Home LAN)
  • RaspberryPi <pi> (Home LAN)

How Actors are connected ?

  • externalblr ===> externalnyc
  • fedora ===> externalnyc
  • pi ===> fedora

Assumption is that except externalnyc all others are behind a NAT/Firewall

IP for each actor in VPN

  • externalnyc –
  • externalblr –
  • fedora –
  • pi –


  • Every actor is able to talk to every other actor
  • Access services that are allowed in firewall



Freifunk Gluon – My experiments so far – Updates

In my last post I was talking about Freinfunk Gluon,  Freemesh and what I was doing about it. This post would be a follow up to that.

So for a quick recap,

  • I had setup a node with Freifunk Gluon firmware from the Freemesh Denkmark community
  • Started setting up the gateway node to which other routers connect to and form a mesh

What is the current status ?

Well, I have completed the gateway setup and this post I am writing along with other network traffic from my laptop is going through the gateway. It’s not a big deal, because communities are using tools like Ansible & Puppet to automate the entire setup. But hey, this is very important to me doing it the long way.

How did I achieve it ?

My single source of knowledge of this setup (most of it) was based on Generic Freemesh Gateway from Freemesh Ireland community. Here’s what I did with respect to Gateway and Firmware setup


  • Create a VPS (5$) with Debian Jessie from Digital Ocean
  • Setup the necessary users, disable remote login for root, disable password logins and only allow key based logins
  • Setup a basic firewall
  • Download the necessary software
  • Setup B.A.T.M.A.N (for routing) & Fastd VPN (for connecting nodes)
  • Setup network interfaces
  • Setup DHCP & DNS (for mesh nodes & clients)
  • Setup NAT to forward the traffic from mesh nodes & clients to the internet
  • Setup vnstat for network statistics from various network interfaces
  • Setup Hopglass (frontend) & Hopglass Server to collect info from the nodes & display them on the map
  • Setup Grafana & Prometheus that provides data visualisation & monitoring respectively
  • Setup Fail2Ban to ban IP’s by reading logs & dynamically add rules to iptables

Building Firmware

  • Clone the stable branch of Freifunk Gluon
  • Clone an existing site configuration (its mesh node configuration actually)
  • Update the site configuration with details like community name, IP’s for the node, WiFi & ad-hoc AP configuration, gateway information (so the nodes could connect to it via Fastd VPN), etc.,
  • Build the firmware
  • Flash it on to the router

Some hurdles faced

In any task there would be some hurdles and its up to us to solve them and proceed. The main hurdle I faced was lack of understanding in networks & its configurations. So, I didn’t solve or learn all of them, instead I took steps to learn and understand them better through simple setup.

I wanted to try out some of the software I mentioned above and see how the configurations would actually work. Since, I mostly use my laptop for development, I made a better use of Raspberry Pi by turning it into a test bed to hone my skills. So, for the initial part I tried setting up the following on my Pi and use them from my laptop,

  • DHCP
  • DNS
  • NTP
  • Fastd
  • Iptables & NAT

For most of the part, I used tcpdump and syslog to monitor the output. By playing with the configurations, I was able get a good grasp on what was happening. There is still a lot to learn, but its a start nonetheless.

Then I faced some issues where the map wasn’t updated anymore, DNS & NTP requests were denied. Then after checking the logs could see that firewall was blocking those packets and so I had to add rules to allow the following (all these rules apply only to the private subnet),

  • DNS
  • Multicast
  • NTP

Some Pics

This slideshow requires JavaScript.

You can check the map here.

What then ?

I will be continuing to experiment with the gateway and node, then see what else I can do to proceed. I am planning to look at the Ansible scripts to automate the gateway setup and further improve my knowledge on networks.

Note: If peers in my local community are interested in this concept, we could try it out.

Freifunk Gluon – My experiments so far…

This will be a post about what I have been doing with respect to Mesh Networks for the past couple of weeks and also my post after a long time.

Am I new to Mesh Networks?

No, and I am not an expert either. I was introduced to Mesh Networks on the month of April’2016 from my friends at Chennai and Pondicherry. Though I have been part of Mesh Networks for the past 10 months, I have not been very active in the last very few months due to personal reasons and its on me. So, that’s it and I am not going to give lecture about the sequence of events.

Alright, I am not new. What then?

Though I have been inactive, I was a silent observer in the community groups watching over what was going on. Many times I would be so eager to jump in, but the fear of going inactive (which I do a lot) again held me back. Recently, there was a sudden spike among the peers about Mesh and how to bring it back up. That’s when in one our Matrix groups we got into conversation with guys from Freifunk and they were talking about the the Gluon firmware that’s being widely used in the Freifunk communities. That’s when there was sudden spike inside me as well and brought my lazy ass back up.

What happened?

Here, our idea was to setup nodes that were running OpenWrt firmware and a routing protocol called B.A.T.M.A.N at our houses using the cheaply available router TP-Link WR841N. It went fine and people even hosted services on the node like wiki’s, social platform and so on.

But, over time there was a disturbance in the force and we found issues that the routing protocol wouldn’t scale, cheaper hardware doesn’t have enough range, memory footprint and other xyz issues.

What different happened now?

In the current scenario, if there aren’t enough nodes at a given location, all we would be having are lonely island of nodes waiting to call/to be called. In Freifunk, they try to create Mesh Network over VPN. I have looked into technical details of this in depth so I will say what I understood.

The idea is that, the island nodes connect to the gateway nodes via VPN tunnel and they are fully meshed. It might sound like a client (island nodes) – server (gateway node) connection, but its not. The prerequisite of this setup and don’t start bashing me already,  is having an Internet connection. This might be counter-intuitive, but in the current scenario its one of the better ways to connect much spread nodes IMHO.

The routers are flashed with Gluon Firmware (fork of OpenWrt) image developed by the respective communities, which has all the configurations ready and just had to be plugged in to your ADSL modem and all is set. One can even access the internet offered through the gateway and you can also choose to share your internet connection with the public.

Stories aside, what was I doing?

Since, I learned of the above stuffs I started looking around wiki’s of those communities and tried to understand how its being done. One thing that was unique among the communities were that they were continuously updating, since there is no one silver bullet to the issue. I gathered the links (useful or not) and noted them down in a Mozilla Etherpad. Then I wanted to setup a node (not my initial intention) to learn and since the Freifunk guys who were talking with us were from Denmark and Ireland, I decided to flash the Gluon Firmware from Freemesh Denmark community.

The setup was fairly straight forward as I said above and I was able to see my node in the Node map. Though its not a big deal it felt good. Then I started to look into setting up ones own gateway to which nodes can connect to. I spun up a Debian droplet on Digital Ocean and started with the setup. I even bought a domain similar to ones used by Freifunk communities.

We learn from making mistakes and mine was jumping right in without at least contemplating the architecture of the setup. It took time as well, because I was doing it like in trial and error. That is when I took a pause and looked back. The gateway wiki’s I looked had the common steps,

  • Having a server with a reasonable capacity and bandwidth with installing necessary software and users
  • Setting up network interface and bridges
  • Setting up a VPN and its configurations
  • Setting up a routing protocol and its configurations
  • Setting up DHCP, DNS and their configurations
  • Setting up network statistics

I tried experimenting with the above configurations (divide and conquer) one at a time. Only when diving into the above concepts, I came to know how I suck at networking and its high time I get to know it better. At the least, I got to know some basic definition of the networking stuff. Nevertheless, I became comfortable with the setup than I was earlier and yet I am not master of it now.

Where I am now?

I have configured many of the steps and to see if they are working I checked the following,

  • Added my gateway’s IP as one of the VPN (fastd) peers in my router
  • Observed the logs on server, could see my router and gateway in handshake
  • The firmware I have uses BATMAN and so tried to see a list of originators using batctl o and could see my gateways MAC listed and vice versa. I was able to ping either side using batctl ping . Also, the result showed that the VPN was the interface through which the data was going through
  • Then I checked if my router got an IP from the DHCP server and yes it was getting it s well
  • Then, I saw my gateway listed as one of the nameservers on my router by checking resolv.conf.auto file on it
  • I connected my laptop to the mesh router’s hotspot and tried to see which was the DNS server that was used. I issued dig duckduckgo.com and could see my gateway’s IP in the command’s result.

The above gave me some incentive to proceed with the setup and learn along the way.

So, what’s the point of all this?

Whatever I have been doing is to try and explore the different possibilities and see if it could fit our needs. Will people show in interest this? honestly, I have no idea and this post is not some campaigning for Freifunk. But, I feel that this can be one of the ways we can unite people even though it is using the existing internet. As the technology is improving day by day, one day we might see full fledged implementation of mesh or at least better than what it is now.

Some links

Most of the links that I was looking at is recorded in this etherpad.

Note: Most of the sites are in German and suggest you have some translator plugin or Chromium to convert the page. That’s how I read it.

My experience with Mediagoblin application

     This blog is about my experience on installing and using Mediagoblin, which is a free software media sharing application.

Note: This is not a step by step tutorial and for that I would point you to the well written ones

What is Mediagoblin?

Quoting the official site,

MediaGoblin is a free software media publishing platform that anyone can run. You can think of it as a decentralized alternative to Flickr, YouTube, SoundCloud, etc.

Mediagoblin is,

  • free software – anyone can use, share, modify the software to suit their needs
  • decentralized – you can host your own instance of Mediagoblin or connect to other instances running around the world

Issues faced during installation

    I was always wondering if there was free software alternative to YouTube, Vimeo, etc., to share media. When I heard about Mediagoblin I got so much excited like a kid and wanted to get it up and running on my machine ASAP. That was my issue – need something so fast but without patience is not good and I messed up the installation the first time.

     But, after taking my time to get through the code, configurations and understanding how things came by was a real eye opener. I was able to fix them and got an up and running instance of Mediagoblin. So, I would suggest people who would like to install be patient while going through the installation instructions and don’t let the excitement ruin it.

     While installation I faced  issues ranging from dependencies to permissions and I have listed them out below,

Virtual environment issues

     The mediagoblin installation comes with an in-house virtualenv were a local python environment (directory named “bin”) is created in the root of mediagoblin directory to install all the dependencies. This might seem useful at first but once you want to remove mediagoblin and reinstall again, you would have to install those dependencies again. So, I would suggest using virtualenv or virtualenvwrapper to handle the environments.

Python dependency issues

     Mediagoblin uses easy_install for installing all the python dependencies into the virtual environment. While doing so, I ran into the error

raise DistributionNotFound(req)
pkg_resources.DistributionNotFound: sqlalchemy

Here “sqlalchemy” is the dependency that couldn’t be found by installer. So, after looking at the trace I found out that while trying to install “sqlalchemy_migrate”, it was dependent on “sqlalchemy”. So, I was wondering what could go wrong with that, since we used to install them all the time like “pip install some_package”. But, it looked like the format in the requirements given in the egg package was incorrect.  For example, you have to edit the requires.txt from the “sqlalchemy_migrate” egg package,


Media type dependency issues

For audio and video media types, you need to have all the necessary libraries installed. During installation you won’t find any issue and when you start adding media exceptions will be thrown. This is briefly mentioned in the official blog here.

Issues running MedigaGoblin with Nginx

     Initially, I had the mediagoblin directory in /var/www or /srv/ directories which didn’t give any issues when accessing it from nginx. But, I usually have the projects in my home directory and I thought of doing the setup there and giving a symbolic link to the above directories. But, I failed to have the necessary permission to the directories and got permission denied errors while launching. So, make sure necessary folder & file permissions are set.

These are some of the issues I faced during installation.

Experience using MedidaGoblin

     I used mediagoblin for sometime and I should say that it is something different. It provides the ability to upload media types like Video, Audio, Raw image, Ascii art, STL/3d models, PDF and Document.

     I would say I like it just because of the fact that it is free software. We have the choice to improve the way it looks and way it operates. Though mediagoblin doesn’t attract me much because I am so much used YouTube, but in terms of philosophy it definitely got me thinking otherwise. Hope people would use it  and try to contribute and making it better.

Autostart scripts for MediaGoblin

    Joar Wandborg has written excellent init scripts to automate the task of starting or stopping mediagoblin here.

     The default scripts assumes that the python environment is in the directory where mediagoblin is installed and will be used as the python path. So, I modified the script to add a new variable that would point to the path where you can specify the python environment location. The script would use it if its present or fallback to the default configuration. You can find the github repo here.

Installation links

  • For the official installation for MediaGoblin 0.9 check here
  • There is another well written blog for step by step installation here

A day at Chennai Mesh Community – building the Yagi-Uda antenna

In this post I will briefing on the events that happened on Sunday (01/05/2016), were Free Software activists and hardware hackers from the Chennai Mesh Community joined hands together in creating a Yagi-Uda antenna.

First things first, Who we are?

I will keep things short in this section.

We are group of activists from Tamil Nadu, India who have a lot of interest and passion about Free Software and Open Hardware. Recently, we were introduced to Mesh Networks (which we later knew had existed for a long time) and understood that the Internet needs a serious change. We wanted to be a part of this because, Internet was something that was created for people, but now big corporations control one’s access to the internet. So, we created the Chennai Mesh Community with the goal of making Internet the way it should be.

We are a community of the people, by the people and for the people

You can find out more about us from our Facebook page here

Now to the actual post…

Why build it in the first place?

Prior to the having this activity on Sunday, during our regular meetups in person and through messenger, we usually discuss on what had happened in the previous meet and what is the activity for the next meet. So, we thought like why not build an antenna the coming week, because its the basic thing that makes wireless communication possible. If we are going to create a mesh network with routers, we have to bear in mind that the stock antenna isn’t that much powerful to achieve a sufficient range. That being one side of the reason, the other is, if we don’t know what an antenna is and how it operates then we can’t make a rationale decision in choosing a wise router or customizing one to achieve better results.

What we needed to build it?

In order to build the antenna we made use of this instructable as our guide. The reason we chose this guide is that, the materials that were needed in the construction were common household items like Popsicle sticks and paper clips or ones that could be procured easily. The only uncommon household items were coaxial cables and solders (common for Electrical and Electronic students though). So, we spent a fine evening (Saturday) shopping, to procure the parts we needed to build the antenna.

How we built it?

We assembled at 10 A.M in the morning to begin the work. We started out by creating the boom (mechanical support) with Popsicle sticks and gluing them together to form a sturdy base. Then we went on straightening out the paper clips and cutting them to precise length based on the antenna design. The hard part of the construction was interfacing the router’s radio unit with the antenna’s driven element through a coaxial cable. It was hard because, we couldn’t find the perfect cable for the job and improvised with using what we could easily get, which was a cable used for TV’s. Finally, we soldered the leads driven element to that the cable, then to the radio unit.


Fig (1) – The actual design for the antenna


Fig (2) – The elements that will form the actual antenna


Fig(3) – Elements glued to the boom

What were the results?

Initially, we were little skeptical if the antenna would even work, but we had a lot of faith it would. The antenna was working fine despite the hiccups procuring the right materials and doing a perfect build. We had two identical routers in the room, one with a stock antenna and other with the Yagi-Uda antenna. The latter one had a very strong signal than the former. Voila! we created our very first antenna which we have only seen from distance and in text books.


Fig (4) – Result “The signal was strong with this one”


Fig (5) – The team

What we learned?

People might think this to be a trivial task and though it might be, we mainly undertook this activity to understand what was happening under the hood of an antenna and how this simple mechanical structure actually transmits a signal over a long range.

Whats up after this?

Now that we built it using Popsicle sticks and paper clips and understood how the antenna works, we are planning on a building an efficient one with copper and taking into account the lesson learned and TODO’s from this activity.

Special mention

Our friends and fellow activists at  PYMeshnet made a Yagi-Uda antenna, which was one of the inspiration for us. The link to the post is here. I would also like to thank the entire Chennai Mesh community members and who were present in the activity which includes myself(Meenakshi Sundaram), Anand, Venkatesh and Ganesh, of whom Ganesh provided with a lots of insights and guidance on the technical part.