Experiment – Mesh VPN setup with Tinc

This is super short post on my experiment with setting up a mesh VPN using tinc.


  • It’s used in creating a VPN out of many small networks that are geographically distributed
  • There is no concept of server or client in tinc, so nodes try to talk to each other directly or through other nodes

Actors in the mesh

<name> – name for each actor

  • Digital Ocean droplet <externalnyc> – to which all below actors connect to
  • Digital Ocean droplet <externalblr>
  • Laptop <fedora> (Home LAN)
  • RaspberryPi <pi> (Home LAN)

How Actors are connected ?

  • externalblr ===> externalnyc
  • fedora ===> externalnyc
  • pi ===> fedora

Assumption is that except externalnyc all others are behind a NAT/Firewall

IP for each actor in VPN

  • externalnyc –
  • externalblr –
  • fedora –
  • pi –


  • Every actor is able to talk to every other actor
  • Access services that are allowed in firewall




Freifunk Gluon – My experiments so far – Updates

In my last post I was talking about Freinfunk Gluon,  Freemesh and what I was doing about it. This post would be a follow up to that.

So for a quick recap,

  • I had setup a node with Freifunk Gluon firmware from the Freemesh Denkmark community
  • Started setting up the gateway node to which other routers connect to and form a mesh

What is the current status ?

Well, I have completed the gateway setup and this post I am writing along with other network traffic from my laptop is going through the gateway. It’s not a big deal, because communities are using tools like Ansible & Puppet to automate the entire setup. But hey, this is very important to me doing it the long way.

How did I achieve it ?

My single source of knowledge of this setup (most of it) was based on Generic Freemesh Gateway from Freemesh Ireland community. Here’s what I did with respect to Gateway and Firmware setup


  • Create a VPS (5$) with Debian Jessie from Digital Ocean
  • Setup the necessary users, disable remote login for root, disable password logins and only allow key based logins
  • Setup a basic firewall
  • Download the necessary software
  • Setup B.A.T.M.A.N (for routing) & Fastd VPN (for connecting nodes)
  • Setup network interfaces
  • Setup DHCP & DNS (for mesh nodes & clients)
  • Setup NAT to forward the traffic from mesh nodes & clients to the internet
  • Setup vnstat for network statistics from various network interfaces
  • Setup Hopglass (frontend) & Hopglass Server to collect info from the nodes & display them on the map
  • Setup Grafana & Prometheus that provides data visualisation & monitoring respectively
  • Setup Fail2Ban to ban IP’s by reading logs & dynamically add rules to iptables

Building Firmware

  • Clone the stable branch of Freifunk Gluon
  • Clone an existing site configuration (its mesh node configuration actually)
  • Update the site configuration with details like community name, IP’s for the node, WiFi & ad-hoc AP configuration, gateway information (so the nodes could connect to it via Fastd VPN), etc.,
  • Build the firmware
  • Flash it on to the router

Some hurdles faced

In any task there would be some hurdles and its up to us to solve them and proceed. The main hurdle I faced was lack of understanding in networks & its configurations. So, I didn’t solve or learn all of them, instead I took steps to learn and understand them better through simple setup.

I wanted to try out some of the software I mentioned above and see how the configurations would actually work. Since, I mostly use my laptop for development, I made a better use of Raspberry Pi by turning it into a test bed to hone my skills. So, for the initial part I tried setting up the following on my Pi and use them from my laptop,

  • DHCP
  • DNS
  • NTP
  • Fastd
  • Iptables & NAT

For most of the part, I used tcpdump and syslog to monitor the output. By playing with the configurations, I was able get a good grasp on what was happening. There is still a lot to learn, but its a start nonetheless.

Then I faced some issues where the map wasn’t updated anymore, DNS & NTP requests were denied. Then after checking the logs could see that firewall was blocking those packets and so I had to add rules to allow the following (all these rules apply only to the private subnet),

  • DNS
  • Multicast
  • NTP

Some Pics

This slideshow requires JavaScript.

You can check the map here.

What then ?

I will be continuing to experiment with the gateway and node, then see what else I can do to proceed. I am planning to look at the Ansible scripts to automate the gateway setup and further improve my knowledge on networks.

Note: If peers in my local community are interested in this concept, we could try it out.

Freifunk Gluon – My experiments so far…

This will be a post about what I have been doing with respect to Mesh Networks for the past couple of weeks and also my post after a long time.

Am I new to Mesh Networks?

No, and I am not an expert either. I was introduced to Mesh Networks on the month of April’2016 from my friends at Chennai and Pondicherry. Though I have been part of Mesh Networks for the past 10 months, I have not been very active in the last very few months due to personal reasons and its on me. So, that’s it and I am not going to give lecture about the sequence of events.

Alright, I am not new. What then?

Though I have been inactive, I was a silent observer in the community groups watching over what was going on. Many times I would be so eager to jump in, but the fear of going inactive (which I do a lot) again held me back. Recently, there was a sudden spike among the peers about Mesh and how to bring it back up. That’s when in one our Matrix groups we got into conversation with guys from Freifunk and they were talking about the the Gluon firmware that’s being widely used in the Freifunk communities. That’s when there was sudden spike inside me as well and brought my lazy ass back up.

What happened?

Here, our idea was to setup nodes that were running OpenWrt firmware and a routing protocol called B.A.T.M.A.N at our houses using the cheaply available router TP-Link WR841N. It went fine and people even hosted services on the node like wiki’s, social platform and so on.

But, over time there was a disturbance in the force and we found issues that the routing protocol wouldn’t scale, cheaper hardware doesn’t have enough range, memory footprint and other xyz issues.

What different happened now?

In the current scenario, if there aren’t enough nodes at a given location, all we would be having are lonely island of nodes waiting to call/to be called. In Freifunk, they try to create Mesh Network over VPN. I have looked into technical details of this in depth so I will say what I understood.

The idea is that, the island nodes connect to the gateway nodes via VPN tunnel and they are fully meshed. It might sound like a client (island nodes) – server (gateway node) connection, but its not. The prerequisite of this setup and don’t start bashing me already,  is having an Internet connection. This might be counter-intuitive, but in the current scenario its one of the better ways to connect much spread nodes IMHO.

The routers are flashed with Gluon Firmware (fork of OpenWrt) image developed by the respective communities, which has all the configurations ready and just had to be plugged in to your ADSL modem and all is set. One can even access the internet offered through the gateway and you can also choose to share your internet connection with the public.

Stories aside, what was I doing?

Since, I learned of the above stuffs I started looking around wiki’s of those communities and tried to understand how its being done. One thing that was unique among the communities were that they were continuously updating, since there is no one silver bullet to the issue. I gathered the links (useful or not) and noted them down in a Mozilla Etherpad. Then I wanted to setup a node (not my initial intention) to learn and since the Freifunk guys who were talking with us were from Denmark and Ireland, I decided to flash the Gluon Firmware from Freemesh Denmark community.

The setup was fairly straight forward as I said above and I was able to see my node in the Node map. Though its not a big deal it felt good. Then I started to look into setting up ones own gateway to which nodes can connect to. I spun up a Debian droplet on Digital Ocean and started with the setup. I even bought a domain similar to ones used by Freifunk communities.

We learn from making mistakes and mine was jumping right in without at least contemplating the architecture of the setup. It took time as well, because I was doing it like in trial and error. That is when I took a pause and looked back. The gateway wiki’s I looked had the common steps,

  • Having a server with a reasonable capacity and bandwidth with installing necessary software and users
  • Setting up network interface and bridges
  • Setting up a VPN and its configurations
  • Setting up a routing protocol and its configurations
  • Setting up DHCP, DNS and their configurations
  • Setting up network statistics

I tried experimenting with the above configurations (divide and conquer) one at a time. Only when diving into the above concepts, I came to know how I suck at networking and its high time I get to know it better. At the least, I got to know some basic definition of the networking stuff. Nevertheless, I became comfortable with the setup than I was earlier and yet I am not master of it now.

Where I am now?

I have configured many of the steps and to see if they are working I checked the following,

  • Added my gateway’s IP as one of the VPN (fastd) peers in my router
  • Observed the logs on server, could see my router and gateway in handshake
  • The firmware I have uses BATMAN and so tried to see a list of originators using batctl o and could see my gateways MAC listed and vice versa. I was able to ping either side using batctl ping . Also, the result showed that the VPN was the interface through which the data was going through
  • Then I checked if my router got an IP from the DHCP server and yes it was getting it s well
  • Then, I saw my gateway listed as one of the nameservers on my router by checking resolv.conf.auto file on it
  • I connected my laptop to the mesh router’s hotspot and tried to see which was the DNS server that was used. I issued dig duckduckgo.com and could see my gateway’s IP in the command’s result.

The above gave me some incentive to proceed with the setup and learn along the way.

So, what’s the point of all this?

Whatever I have been doing is to try and explore the different possibilities and see if it could fit our needs. Will people show in interest this? honestly, I have no idea and this post is not some campaigning for Freifunk. But, I feel that this can be one of the ways we can unite people even though it is using the existing internet. As the technology is improving day by day, one day we might see full fledged implementation of mesh or at least better than what it is now.

Some links

Most of the links that I was looking at is recorded in this etherpad.

Note: Most of the sites are in German and suggest you have some translator plugin or Chromium to convert the page. That’s how I read it.

WebTorrent and my experience with it

     This is my experience from using WebTorrents platform to share media and files across. This is not a tutorial and I will point to the standard one.

What is WebTorrent?

     WebTorrent is a torrent client written in Javascript and build on top of WebRTC protocol which brings torrents to the browser. What? Did you just say to the browser? Yes, that’s right. First, lets see what torrents are in general and how we use them currently.

What is a torrent?

When we hear the word torrent we think of download movies, music, documents and games illegally. But, it is much more than that and its one of the best protocols out there.

     BitTorrent is a peer-to-peer file sharing protocol, were we share files to & from people (peers) around the world in a decentralized way. As opposed to downloading files from a FTP server which sends out the same copy to everyone, we share it with each other.

How torrent works?

To understand how this happens, lets take the example of downloading an ISO file of any GNU/Linux distribution and see what happens,

Torrent creation

The torrent uploader creates the torrent file with the some metadata like,

  • Name of the file
  • How many pieces the torrent has
  • Cryptographic hash of the torrent file and those individual pieces
  • Tracker address and so on
  • Starts uploading it
  • The uploader can stop seeding after the complete file with at least one other peer

Torrent download

  • You download the torrent file or magnet uri from the website
  • You open it with your favorite torrent client program like Transmission, Deluge, uTorrent, Vuze, etc.,
  • The client reads the metadata from the torrent and contacts the trackers (computers that have details about what files are being shared and the peers that share them) to find out which peers (seeders) have the file you are downloading
  • Once the tracker gives the information, the client then directly contacts that peer and asks for piece(s) of the file
  • Once, the client software has all the pieces it reassembles them like a jigsaw puzzle to produce the original file

The beauty of torrents is that,

  • Its decentralized
  • No need to wait for the entire file to download, you can pause/resume whenever you like
  • Ease the bandwidth of the server and use it for other purpose
  • When there are more people sharing it the bandwidth is increased, because every new peer need not ask the same person for the file
  • It brings about the feeling of a community where people give and take what they need

WebRTC protocol

WebRTC is a Real Time Communication (RTC) by the W3C , which aims at enabling voice, video and p2p applications between browsers through simple API’s. The highlight of this protocol is that everything is built into the browser and you don’t need any specific plugins or softwares to be installed to use it.

Checkout the FAQ‘s of WebRTC.

How WebTorrent is different from BitTorrent?

  • WebTorrent is built on top of WebRTC implementation that is aimed at having a true open and free p2p platform for applications like video/voice calling and file sharing
  • You do not need any special software or plugin to use it. Any WebRTC compliant browser with WebTorrent client would be enough (there is beta version of WebTorrent Desktop client software available here)
  •  WebTorrent is much more similar to BitTorrent and differs only in the way peers connect and data transport
  • Apart from the above point, WebTorrent works the same as BitTorrent does
  • So, the existing BitTorrent client software could make a change to accommodate WebTorrent clients too

Checkout the FAQ‘s of WebTorrent.

Getting Started with WebTorrents

Checkout the official blog to get started with WebTorrent here.

Using WebTorrent

I used the  follow the setup to test WebTorrent,

  • TP-Link WR841N router flashed with OpenWrt 15.05.1 and opentracker installed which is the torrent tracker
  • PC and Laptop running a GNU/Linux distro with WebTorrent-Desktop installed
  • I initially tried the following configurations,
    • Streaming between two WebTorrent-Desktop clients
    • Stream between BitTorrent client and WebTorrent-Desktop clients
  • Both configurations gave amazing results and helped me get a picture of what the concept is all about

Definitely looking forward to more from WebTorrent and WebRTC.