TFT ZeroOS - Enterprise Firewall without UPNP

#1

Im not sure about what ports are required and i cant find any documentation anywhere on what ports are required. I’m guessing this solution uses some kind of UPNP. Does anyone know what ports are required or if there exists some kind of network diagram for the solution? Would be super if it included the 3bot as well.

#2

Just making a note that we’ve been covering this over on another thread: How to set-up your own 3Node

#3

Aaaand, bringing the convo back here :smile:

@zerosubnet asks:

I have look at the source code and the Network large scale deployment wiki and it looks like all the 3nodes require a public IP or on small scale home networks it uses UPNP.

Are you sure there’s no documentation on the packet flow? Is wireguard a requirement for the node to come up? because wireguard uses UDP NAT holepunching.

#4

Huh…
nono, we don’t UPnP at all.
3Nodes do not require a public IPv4 and don’t punch holes (although that would be in the works)
the way it behaves, is when it’s a fully hidden node , i.e. no IPv6, only RFC1918 private networks, it:

  • uses the planetary network (tcp) to create an overlay through the NAT gateway
  • finds a node with a public IP to relay the private networks for containers and vms

Either way, a node will be a lot happier in terms of performance if there is some IPv6 available.

#5

Hi,

Okey. But the overlay network is wireguard, right? Because i need to receive the frames on my node on the same port as the outgoing port. Wireguard does not support random source port as the port is part of the algo. I can ofc keep the original source tcp port when the packet egresses the network, but that would make me allocate a ton of tcp sorce ports in the firewall for that specific IP.

So if this is the case that it uses Wireguard to build the overlay network.
Is there an option to hardcode the port that wireguard uses in ZOS?

If i had a ton of IP’s i could ofc 1:1NAT the traffic but thats a no go as i dont have alot of spare ipv4

#6

please DM me on Telegram (@delandtj)

#7

Don’t have telegram, discord?

#8

don’t even know what that is :smiley:

#9

:slight_smile: its what most people use i guess. I got Teams, Discord, Keybase.

#10

So, does it use wireguard or nahh?

#11

Nodes communicate with each other over both Wireguard and Yggdrasil. Wireguard is a strict requirement, as it’s used to create the private overlay networks which host all workloads. There really aren’t any options to set in Zos, beyond the farmer id and some kernel parameters.

1 Like