- Category
- Cybersecurity
- Rank
- No. 773Tools index
Previous survey · No. 2032 ·
- Pricing
- Open Source
- Type
- TOOL
- Use case
- Deployment & Operations · Security & Identity
- Builder
- @mittsh
- GitHub
- 18.4k stars
- Latest release
- v1.11.2
- Date
About
Nebula is an overlay networking tool from Slack that joins hosts sitting on separate networks into a single encrypted network, so machines can address each other directly no matter where they run. The repository is Go source with its own certificate, handshake, and firewall layers rather than a wrapper around an existing VPN, which is what lets it stay a self-contained binary you operate yourself.
What it does
The site describes Nebula as a peer-to-peer overlay network built on the Noise Protocol Framework. Each node carries a certificate stating its IP, name and groups, and firewall rules filter traffic by those groups. Lighthouse nodes help peers find each other and punch through NAT, according to the page.
Stated on the product site
- Protocol basis
- Mutually authenticated peer-to-peer network built on the Noise Protocol Framework
- Default cryptography
- ECDH key exchange with AES-256-GCM
- Node identity
- Certificates assert each node's IP address, name and group membership
- Peer discovery
- Lighthouse nodes, with optional UDP hole punching through firewalls and NAT
- Platforms
- Linux, macOS, Windows, FreeBSD, iOS and Android
- Packaging
- Arch, Fedora, Debian and Alpine packages, Homebrew, and a Docker image
- Setup requirements
- nebula-cert plus a nebula binary per platform, and at least one lighthouse with a routable IP is recommended
Not stated on the site
- The page claims networks of tens of thousands of computers but shows no measurements behind that figure.
- The page shows no throughput or latency numbers to back its focus on performance.
- The page mentions a managed offering from Defined Networking but does not show its pricing or how it differs from running Nebula yourself.
- The page does not say what happens when no lighthouse is reachable or when hole punching fails.
Written from the product site at github.com.
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.