nebula

Nebula is an open-source overlay networking tool created at Slack Technologies. It builds a mutually authenticated peer-to-peer software-defined network on top of the Noise Protocol Framework, letting computers connect directly regardless of where they are or which cloud provider hosts them. Key capabilities described in the README: - Scalability: designed to connect anything from a few machines to tens of thousands of hosts. - Portability: runs on Linux (64/32-bit, ARM and others), Windows, macOS, FreeBSD, iOS, and Android. Distribution packages exist for Arch, Fedora, Debian, Alpine, Homebrew, and Docker. - Security model: certificates assert a node's IP address, name, and membership in user-defined groups. Default cryptography uses ECDH key exchange and AES-256-GCM; Curve25519 is the default curve, with optional NIST P256 and FIPS 140-3 build modes. - Discovery: lightweight "lighthouse" nodes with routable IPs let peers find each other, optionally using UDP hole punching to traverse NATs and firewalls. - Traffic control: user-defined groups enable provider-agnostic firewall rules similar in style to cloud security groups. Getting started involves generating a certificate authority with nebula-cert, signing host certificates with IPs and groups, writing per-host configuration files, and running the nebula binary. The README warns that the CA private key is the most sensitive file and must not be copied to individual nodes, and notes that CAs expire after one year by default. Nebula can be built from source with Go using make targets for all platforms or specific ones. The project is maintained by Slack and offers a managed option through Defined Networking for users who prefer not to run their own PKI and lighthouses.