direct connection to node (hole punching)

[x1ddos]

at the moment, direct connection to the node is possible only via tech-savvy configuration of a home router and other tricks like ipv6. tor as an alternative is slow and unreliable.

a "zero conf" direct connection from a client app like zap or zeus has been one of the goals of the project from the start. however, hole punching doesn't always work, in which case an intermediary relay is required. a client and the node also need a handshake server. additional requirement is open source, at least the self-hosted bits.

i believe nebula is the best candidate to start with:

• simple architecture for self-hosted
• uses noise protocol and PKI for mutual auth
• single binary
• has an android and ios opensource apps at https://github.com/DefinedNet/mobile_nebula

later could also implement some alternatives.

NOTE: tor is still available for those who wants it. UI-wise, probably a "route all traffic through tor" toggle would make sense. turning it "on" should then disable direct connections.

alternatives

innernet

similar in its goals to Slack's nebula or Tailscale, but takes a bit of a different approach. It aims to take advantage of existing networking concepts like CIDRs and the security properties of WireGuard to turn your computer's basic IP networking into more powerful ACL primitives.

one disadvantage is, would need to build own android and ios client apps. otherwise, a pretty good alternative to nebula.

zerotier

• weird BSL (business) license; unclear what constitutes a business use
• only JNI wrapper is open source, not the rest of mobile apps; found only a reverse-engineered android app
• a more complicated self-hosted setup

tailscale

• not everything is open source; specifically, the controller server is closed sourced
• an alternative controller exists - headscale - but it is again a reverse-engineered from the original

i've considered quite a few others: they are either more complicated to setup, implement other things or not fully open source.

nostr

• very much in flux
• would probably require a somewhat more involved changes to client apps and the node using nip-04
• nip-04, the direct messages, is considered suboptimal but no alternative nips exist atm

other resources

• a good list of existing tunnelling solutions: https://github.com/anderspitman/awesome-tunneling
• a nice write up on complexiting of "punching a hole": https://tailscale.com/blog/how-nat-traversal-works/
• small UPnP library: http://miniupnp.free.fr/