Nebula on Fedora

 June 30, 2022

In the last year, I moved more and more data and services to hardware that I can directly control. A direct consequence of this is that I started to run more hardware at my house. This change has been very positive, but it is suboptimal when not at home. All services I run are secure and could be shared directly on the web, but I prefer a more cautious approach. For this reason, I decided to create a VPN.

My first VPN choice was Wireguard. In theory, it should have been a very sensible solution due to its security and protocol optimization. Reality is different, though, and creating a mesh network with Wireguard becomes very complex.

The first alternative I evaluated was Tailscale. I knew this service due to its popularity in the Linux community, so I decided to look at it. Starting from the fact that I was not even considering a third-party managed VPN, my interest quickly moved to headscale. With a little bit of more profound analysis, I realized that many Tailscale clients (even open-source ones) do not support well the usage of servers different from Tailscale’s, so this brought me to drop this option.

My attention shifted then to Nebula, a VPN system based on the Noise Protocol (the same one that Wireguard uses), but to create peer-to-peer networks. Since the beginning, I’ve enjoyed Nebula’s configuration simplicity, even if I suffered a little bit from the absence of complete documentation. After having installed it manually on multiple devices and appreciating its features, I decided to package it in Fedora so that it’s easier to install for myself and all the other Fedora users.

Since early June, the nebula package is now available in Fedora 36+, containing the latest version of Nebula.

Overall, Nebula works very well in my use case. The only feature I’ve not tried so far is the UDP hole punching to overcome NATs since I always try to connect to public destinations.

As for problematic features, the only one that I’ve not yet figured out how to make it work without damaging my machines' configuration is the Nebula DNS. My understanding is that Nebula DNS would need to bind on port 53 on the lighthouse, and the other nodes would need to connect to the lighthouse port 53. In my Fedora setup, this might prove not as easy as I’d like, but probably I’m missing some configuration.

If there is interest in the topic, I’ll do updates over time because I think Nebula is a very promising VPN, thanks to its reliability and simplicity.