slackhq/nebula

Features

• Mesh Networking - Creates a scalable, software-defined mesh network with encrypted tunnels and certificate-based authentication.
• Overlay Networks - Creates secure virtual private networks by encapsulating traffic within encrypted UDP packets across disparate physical infrastructures.
• Peer-to-Peer Networking - Establishes decentralized, direct encrypted connections between nodes to bypass restrictive firewalls and NAT environments.
• Certificate Authorities - Provides a decentralized certificate authority for managing cryptographic host identities without central authentication servers.
• Traffic Encryption - Secures data transmission between network peers using authenticated encryption to ensure privacy and integrity across untrusted public network segments.
• Peer Discovery - Operates a central directory service that helps distributed hosts locate and connect to each other across disparate networks without manual configuration.
• Certificate Authority Management - Generates cryptographic credentials to sign and validate host identities, ensuring only authorized nodes can join and communicate within the network.
• Encrypted Tunneling - Establishes secure, encrypted tunnels between network peers to ensure privacy across untrusted network segments.
• Secure Node Networking - Verifies host identity using certificates and private keys to ensure secure peer-to-peer communication.
• Zero Trust Networking - Enforces zero-trust security by requiring identity-based authentication for all communication between nodes.
• Group-Based - Restricts communication between nodes using certificate-based security groups to enforce expressive and provider-agnostic access control policies.
• NAT Traversal Mechanisms - Coordinates peer connectivity through firewalls and NATs using relay nodes and persistent keep-alive signaling.
• Virtual Network Interfaces - Configures the virtual network device and tunnel lifecycle to handle packet routing and state management for the overlay network.
• Credential Rotators - Updates or replaces security credentials and certificate authorities across the network infrastructure without interrupting active traffic or connectivity.
• Firewall Policies - Enforces granular, policy-driven firewall filtering based on certificate-derived group memberships at the host level.
• Identity Providers - Manages cryptographic host identities and certificate signing to authorize devices within the network.
• Network Access Control - Defines inbound and outbound firewall rules to control traffic flow and enforce security policies at the host level.
• Network and Infrastructure Security - Provides infrastructure for managing host identities and private certificate authorities to secure inter-node communication.
• PKI Management - Issues and validates host certificates to establish trust and authorize communication between nodes within a private network.
• Overlay Networks - Peer-to-peer overlay network for secure cross-site communication.
• Infrastructure and Network Security - Scalable overlay networking tool for secure connectivity.
• Network and Transport Security - Scalable overlay networking tool for secure, performant connectivity.
• VPN and Networking - Scalable peer-to-peer VPN focused on performance and security.
• Vpn Services - Scalable overlay networking for secure communication.
• Virtual Private Clouds - Links servers and services across multiple cloud providers or on-premises data centers into a unified private communication fabric.
• Connection Management - Establishes direct communication between devices by mapping host addresses and using discovery nodes to bridge connections across different network environments.
• Encrypted Relaying - Forwards packets through intermediary nodes to establish connectivity between hosts that cannot communicate directly due to network restrictions.
• Identity Issuance - Assigns unique identities and network addresses to individual nodes to prevent impersonation and enable granular access control.
• Keep-Alive Signaling - Sends keep-alive packets to prevent firewall state expiration, ensuring persistent connectivity between peers located behind restrictive network boundaries.
• Source Validation - Confirms that incoming packets originate from the source address authorized by the sender's certificate to prevent unauthorized traffic injection.
• Remote Signing - Generates valid host certificates by exchanging public keys, eliminating the need to distribute or store sensitive private keys on multiple devices.
• Network Diagnostics - Includes built-in diagnostic utilities to inspect and troubleshoot the status of network hosts.
• Network Traffic Optimization - Prioritizes specific network ranges to improve performance and reduce latency for traffic between connected hosts.
• Non-Overlay Routing - Configures specific network paths to forward traffic through designated nodes, allowing communication with devices that do not run the networking software directly.
• Overlay Resolution - Provides a built-in domain name service to map network addresses to human-readable hostnames for easier connectivity between nodes.

Star history