QuickTun - Revision history

Admin: 13 revisions imported

2022-11-09T14:49:54Z

13 revisions imported

← Older revision	Revision as of 16:49, 9 November 2022
(No difference)

Admin: /* Support QuickTun */

2017-01-08T13:23:00Z

Support QuickTun

← Older revision		Revision as of 15:23, 8 January 2017
Line 164:		Line 164:

	== Support QuickTun ==		== Support QuickTun ==
	You can support QuickTun by spreading the word, reporting bugs, suggesting fixes, porting it to other platforms, packaging it for other distributions, and more. If you would like to make a financial donation, you may send some money to my PayPal account Ivo@UFO-Net.nl, via bitcoin to ~~14ZXbe1wFrXDHXbkhnu23ohqn8U6p2wXfu~~ or ask me for my address (cash) or bank account (IBAN, send me an e-mail).		You can support QuickTun by spreading the word, reporting bugs, suggesting fixes, porting it to other platforms, packaging it for other distributions, and more. If you would like to make a financial donation, you may send some money to my PayPal account Ivo@UFO-Net.nl, via bitcoin to [bitcoin:13LJt54w2VD9WZQgBG6hGdmny26wg4jqEH?message=QuickTun%20donation 13LJt54w2VD9WZQgBG6hGdmny26wg4jqEH] or ask me for my address (cash) or bank account (IBAN, send me an e-mail).

Admin: /* Protocol */

2017-01-07T21:29:17Z

Protocol

@@ Line 109: / Line 109: @@
 == Protocol ==
-QuickTun supports three different protocols:
+QuickTun supports four different protocols:
-* raw: the IP or ethernet packet as it was read from the device is sent directly in an UDP packet
+{| class="wikitable"
-* nacl0: the IP or ethernet packet is encrypted using the curve25519xsalsa20poly1305_box function, with the nonce set to all zero, the first 16 all-zero bytes of the result are stripped off, the rest is sent in an UDP packet (crypto adds 16 bytes of overhead)
+|-
-* nacltai: the IP or ethernet packet is encrypted using the curve25519xsalsa20poly1305_box function, with the nonce being <7bytes=0><1byte=local_pub_key>remote_pub_key?1:0><16bytes:tai64an_packed_timestamp>, the tai64an_packed_timestamp is copied to the beginning of the encrypted buffer (to the area that is normally all zero), the entire buffer is sent (crypto adds 32 bytes of overhead)
+! scope="col"| Protocol name
-* salty: the IP or ethernet packet is encrypted using the curve25519xsalsa20poly1305_box function, with temporary keys and nonces which are periodically regenerated and exchanged; this protocol provides Perfect Forward Secrecy and does not depend on clock synchronization for replay protection; the current implementation may not work well if both endpoints are floating.
+! scope="col"| Security
 == QuickTun Linux kernel module ==

Admin: /* Support QuickTun */

2014-11-16T21:05:12Z

Support QuickTun

← Older revision		Revision as of 23:05, 16 November 2014
Line 136:		Line 136:

	== Support QuickTun ==		== Support QuickTun ==
	You can support QuickTun by spreading the word, reporting bugs, suggesting fixes, porting it to other platforms, packaging it for other distributions, and more. If you would like to make a financial donation, you may send some money to my PayPal account Ivo@UFO-Net.nl, or ask me for my address (cash) or bank account (~~in NL~~, send me an e-mail).		You can support QuickTun by spreading the word, reporting bugs, suggesting fixes, porting it to other platforms, packaging it for other distributions, and more. If you would like to make a financial donation, you may send some money to my PayPal account Ivo@UFO-Net.nl, via bitcoin to 14ZXbe1wFrXDHXbkhnu23ohqn8U6p2wXfu or ask me for my address (cash) or bank account (IBAN, send me an e-mail).

Admin: /* Support QuickTun */

2014-11-16T20:54:01Z

Support QuickTun

← Older revision		Revision as of 22:54, 16 November 2014
Line 137:		Line 137:
	== Support QuickTun ==		== Support QuickTun ==
	You can support QuickTun by spreading the word, reporting bugs, suggesting fixes, porting it to other platforms, packaging it for other distributions, and more. If you would like to make a financial donation, you may send some money to my PayPal account Ivo@UFO-Net.nl, or ask me for my address (cash) or bank account (in NL, send me an e-mail).		You can support QuickTun by spreading the word, reporting bugs, suggesting fixes, porting it to other platforms, packaging it for other distributions, and more. If you would like to make a financial donation, you may send some money to my PayPal account Ivo@UFO-Net.nl, or ask me for my address (cash) or bank account (in NL, send me an e-mail).

	~~[http://flattr.com/thing/1396303/QuickTun Flattr QuickTun!]~~

Admin: Added salty protocol doc

2014-10-18T19:31:32Z

Added salty protocol doc

Admin at 09:33, 18 August 2014

2014-08-18T09:33:31Z

← Older revision		Revision as of 11:33, 18 August 2014
Line 66:		Line 66:
	* INTERFACE - interface name (non-debian systems only)		* INTERFACE - interface name (non-debian systems only)
	* TUN_MODE - set to 1 to operate in tun (IP), unset or 0 (recent versions only) for tap (Ethernet) mode		* TUN_MODE - set to 1 to operate in tun (IP), unset or 0 (recent versions only) for tap (Ethernet) mode
	* USE_PI - set to 1 to include packet information header in wire packets, must be set on both sides if used; set to 2 to automatically add the packet information header ~~automatically~~ for cross-platform compatibility (also compatible with USE_PI=0), some (BSD) kernels need USE_PI to be enabled for IPv6 support		* USE_PI - set to 1 to include packet information header in wire packets, must be set on both sides if used; set to 2 to automatically add the packet information header for cross-platform compatibility (also compatible with USE_PI=0), some (BSD) kernels need USE_PI to be enabled for IPv6 support
	* REMOTE_ADDRESS - IP address or hostname of the remote end (use 0.0.0.0 for a floating/dynamic remote endpoint)		* REMOTE_ADDRESS - IP address or hostname of the remote end (use 0.0.0.0 for a floating/dynamic remote endpoint)
	* LOCAL_ADDRESS - IP address or hostname of the local end, optional		* LOCAL_ADDRESS - IP address or hostname of the local end, optional

Admin at 14:19, 1 June 2013

2013-06-01T14:19:26Z

← Older revision		Revision as of 16:19, 1 June 2013
Line 7:		Line 7:
	== Installing QuickTun on Debian/Ubuntu Linux ==		== Installing QuickTun on Debian/Ubuntu Linux ==
	A precompiled package is available in the UCIS.nl apt repository:		A precompiled package is available in the UCIS.nl apt repository:
			wget -q http://apt.ucis.nl/IvoSmits.asc -O- \| apt-key add -
	echo "deb http://apt.ucis.nl/ current ucis" >> /etc/apt/sources.list		echo "deb http://apt.ucis.nl/ current ucis" >> /etc/apt/sources.list
	apt-get update		apt-get update

Admin: /* Support QuickTun */

2013-05-30T12:33:16Z

Support QuickTun

← Older revision		Revision as of 14:33, 30 May 2013
Line 135:		Line 135:
	== Support QuickTun ==		== Support QuickTun ==
	You can support QuickTun by spreading the word, reporting bugs, suggesting fixes, porting it to other platforms, packaging it for other distributions, and more. If you would like to make a financial donation, you may send some money to my PayPal account Ivo@UFO-Net.nl, or ask me for my address (cash) or bank account (in NL, send me an e-mail).		You can support QuickTun by spreading the word, reporting bugs, suggesting fixes, porting it to other platforms, packaging it for other distributions, and more. If you would like to make a financial donation, you may send some money to my PayPal account Ivo@UFO-Net.nl, or ask me for my address (cash) or bank account (in NL, send me an e-mail).

			[http://flattr.com/thing/1396303/QuickTun Flattr QuickTun!]

Admin at 13:00, 7 May 2013

2013-05-07T13:00:49Z

← Older revision		Revision as of 15:00, 7 May 2013
Line 20:		Line 20:
	netmask 255.255.255.255		netmask 255.255.255.255
	qt_tun_mode 1		qt_tun_mode 1
			qt_protocol nacltai
	qt_remote_address 1.2.3.4		qt_remote_address 1.2.3.4
	qt_local_address 9.8.7.6		qt_local_address 9.8.7.6
	~~qt_private_key~~ <LOCAL-SECRET-KEY>		qt_private_key_file <LOCAL-SECRET-KEY-FILE>
	qt_public_key <REMOTE-PUBLIC-KEY>		qt_public_key <REMOTE-PUBLIC-KEY>
	See below for supported configuration options. Please note that all options are written in lower case and are prefixed with qt_. The interface name is taken from the 'iface' entry.		See below for supported configuration options. Please note that all options are written in lower case and are prefixed with qt_. The interface name is taken from the 'iface' entry.

	== Installing QuickTun on Linux ==		== Installing QuickTun on Linux or BSD ==
	Building QuickTun is very simple. Just run the following commands:		Building QuickTun is very simple. Just run the following commands:
	wget http://oss.ucis.nl/quicktun/src/quicktun.tgz -O- \| tar -xvz		wget http://oss.ucis.nl/quicktun/src/quicktun.tgz -O- \| tar -xvz
Line 48:		Line 49:
	QuickTun configuration is usually stored in a shell script like this:		QuickTun configuration is usually stored in a shell script like this:
	#!/bin/sh		#!/bin/sh
			export TUN_MODE=1
			export PROTOCOL=nacltai
	export REMOTE_ADDRESS=ipaddress-of-remote-end		export REMOTE_ADDRESS=ipaddress-of-remote-end
	export LOCAL_ADDRESS=ipaddress-of-local-end		export LOCAL_ADDRESS=ipaddress-of-local-end
Line 54:		Line 57:
	/usr/sbin/quicktun		/usr/sbin/quicktun

	Make sure that the script is not publicly readable: chmod 700 will do! To start the VPN tunnel, simply run the shellscript. You can also run the script using some service supervisor.		Make sure that the script is not publicly readable because it contains the secret key: chmod 700 will do! To start the VPN tunnel, simply run the shellscript. You can also run the script using some service supervisor (daemon tools, supervisord).

			Alternatively all configuration can be specified on the command line like this:
			/usr/sbin/quicktun -c PROTOCOL nacltai -c TUN_MODE 1 -c PRIVATE_KEY_FILE secret.key -c PUBLIC_KEY public-key-of-remote-end

	== QuickTun configuration options ==		== QuickTun configuration options ==
	* INTERFACE - interface name (non-debian systems only)		* INTERFACE - interface name (non-debian systems only)
	* TUN_MODE - set to 1 to operate in tun (IP), unset or 0 (recent versions only) for tap (Ethernet) mode		* TUN_MODE - set to 1 to operate in tun (IP), unset or 0 (recent versions only) for tap (Ethernet) mode
	* USE_PI - set to 1 to include packet information header in packets, must be set on both sides if used, some (BSD) kernels need it for IPv6 support		* USE_PI - set to 1 to include packet information header in wire packets, must be set on both sides if used; set to 2 to automatically add the packet information header automatically for cross-platform compatibility (also compatible with USE_PI=0), some (BSD) kernels need USE_PI to be enabled for IPv6 support
	* REMOTE_ADDRESS - IP address or hostname of the remote end (use 0.0.0.0 for a floating/dynamic remote endpoint)		* REMOTE_ADDRESS - IP address or hostname of the remote end (use 0.0.0.0 for a floating/dynamic remote endpoint)
	* LOCAL_ADDRESS - IP address or hostname of the local end, optional		* LOCAL_ADDRESS - IP address or hostname of the local end, optional
Line 65:		Line 71:
	* REMOTE_PORT - remote UDP port, optional, defaults to LOCAL_PORT		* REMOTE_PORT - remote UDP port, optional, defaults to LOCAL_PORT
	* REMOTE_FLOAT - allows the remote address and port to change when properly encrypted packets are received		* REMOTE_FLOAT - allows the remote address and port to change when properly encrypted packets are received
			* TUN_UP_SCRIPT - run specified command or script after the tunnel device has been opened
			* SETUID - drop privileges and change user and group IDs to specified username after setting up the tunnel
	* nacl0 and nacltai (encrypted) protocols only:		* nacl0 and nacltai (encrypted) protocols only:
	** PRIVATE_KEY - local secret key in hexadecimal form (not needed for raw protocol)		** PRIVATE_KEY - local secret key in hexadecimal form (not needed for raw protocol)
	** PUBLIC_KEY - remote public key in hexadecimal form (not needed for raw protocol)		** PUBLIC_KEY - remote public key in hexadecimal form (not needed for raw protocol)
			** PRIVATE_KEY_FILE - file containing local secret key in binary or hexadecimal form (not needed for raw protocol)
	* nacltai (encrypted) protocol only:		* nacltai (encrypted) protocol only:
	** TIME_WINDOW - allowed time window for first received packet in seconds (positive number allows packets from history)		** TIME_WINDOW - allowed time window for first received packet in seconds (positive number allows packets from history)
Line 110:		Line 119:
	* Mercurial repository: http://oss.ucis.nl/hg/quicktun/		* Mercurial repository: http://oss.ucis.nl/hg/quicktun/
	* GitHub project: https://github.com/UCIS/QuickTun (git repository: https://github.com/UCIS/QuickTun.git)		* GitHub project: https://github.com/UCIS/QuickTun (git repository: https://github.com/UCIS/QuickTun.git)
			* BitBucket project: https://bitbucket.org/IvoSmits/quicktun
	* Debian/Ubuntu packages: http://apt.ucis.nl/packages/		* Debian/Ubuntu packages: http://apt.ucis.nl/packages/
	* Sourcecode archives: http://oss.ucis.nl/quicktun/src/ (latest: http://oss.ucis.nl/quicktun/src/quicktun.tgz)		* Sourcecode archives: http://oss.ucis.nl/quicktun/src/ (latest: http://oss.ucis.nl/quicktun/src/quicktun.tgz)

← Older revision		Revision as of 21:31, 18 October 2014
Line 74:		Line 74:
	* TUN_UP_SCRIPT - run specified command or script after the tunnel device has been opened		* TUN_UP_SCRIPT - run specified command or script after the tunnel device has been opened
	* SETUID - drop privileges and change user and group IDs to specified username after setting up the tunnel		* SETUID - drop privileges and change user and group IDs to specified username after setting up the tunnel
	* nacl0 and ~~nacltai~~ (encrypted) protocols only:		* nacl0, nacltai and salty (encrypted) protocols only:
	** PRIVATE_KEY - local secret key in hexadecimal form (not needed for raw protocol)		** PRIVATE_KEY - local secret key in hexadecimal form (not needed for raw protocol)
	** PUBLIC_KEY - remote public key in hexadecimal form (not needed for raw protocol)		** PUBLIC_KEY - remote public key in hexadecimal form (not needed for raw protocol)
Line 102:		Line 102:
	**** @remote - (optional) specifies the remote tunnel in IP:PORT format, eg 10.0.0.2:2997		**** @remote - (optional) specifies the remote tunnel in IP:PORT format, eg 10.0.0.2:2997
	***** Note that at least one of local and remote must be specified!		***** Note that at least one of local and remote must be specified!
	**** @protocol - specifies the QuickTun cryptographic protocol to use (currently supported are "raw", "nacl0" and "~~nacltai~~")		**** @protocol - specifies the QuickTun cryptographic protocol to use (currently supported are "raw", "nacl0", "nacltai" and "salty")
	**** <secretkey> - (nacl0 and ~~nacltai~~ protocols only) this element contains the secret key of the local end (eg <secretkey>THE_KEY_GOES_HERE_IN_HEXADECIMAL</secretkey>)		**** <secretkey> - (nacl0, nacltai and salty protocols only) this element contains the secret key of the local end (eg <secretkey>THE_KEY_GOES_HERE_IN_HEXADECIMAL</secretkey>)
	**** <publickey> - (nacl0 and ~~nacltai~~ protocols only) this element contains the public key of the remote end		**** <publickey> - (nacl0, nacltai and salty protocols only) this element contains the public key of the remote end

	Note that <xxx> indicates an XML element. @xxx indicates an attribute to the XML element. See also the example configuration file.		Note that <xxx> indicates an XML element. @xxx indicates an attribute to the XML element. See also the example configuration file.
Line 113:		Line 113:
	* nacl0: the IP or ethernet packet is encrypted using the curve25519xsalsa20poly1305_box function, with the nonce set to all zero, the first 16 all-zero bytes of the result are stripped off, the rest is sent in an UDP packet (crypto adds 16 bytes of overhead)		* nacl0: the IP or ethernet packet is encrypted using the curve25519xsalsa20poly1305_box function, with the nonce set to all zero, the first 16 all-zero bytes of the result are stripped off, the rest is sent in an UDP packet (crypto adds 16 bytes of overhead)
	* nacltai: the IP or ethernet packet is encrypted using the curve25519xsalsa20poly1305_box function, with the nonce being <7bytes=0><1byte=local_pub_key>remote_pub_key?1:0><16bytes:tai64an_packed_timestamp>, the tai64an_packed_timestamp is copied to the beginning of the encrypted buffer (to the area that is normally all zero), the entire buffer is sent (crypto adds 32 bytes of overhead)		* nacltai: the IP or ethernet packet is encrypted using the curve25519xsalsa20poly1305_box function, with the nonce being <7bytes=0><1byte=local_pub_key>remote_pub_key?1:0><16bytes:tai64an_packed_timestamp>, the tai64an_packed_timestamp is copied to the beginning of the encrypted buffer (to the area that is normally all zero), the entire buffer is sent (crypto adds 32 bytes of overhead)
			* salty: the IP or ethernet packet is encrypted using the curve25519xsalsa20poly1305_box function, with temporary keys and nonces which are periodically regenerated and exchanged; this protocol provides Perfect Forward Secrecy and does not depend on clock synchronization for replay protection; the current implementation may not work well if both endpoints are floating.

	== QuickTun Linux kernel module ==		== QuickTun Linux kernel module ==