You are here

Setting up VPN node for protocol translation and tunneling

Primary tabs

The GNUnet VPN/PT subsystem enables you to tunnel IP traffic over the VPN to an exit node, from where it can then be forwarded to the Internet. This section documents how to setup VPN/PT on a node. Note that you can enable both the VPN and an exit on the same peer. In this case, IP traffic from your system may enter your peer's VPN and leave your peer's exit. This can be useful as a means to do protocol translation. For example, you might have an application that supports only IPv4 but needs to access an IPv6-only site. In this case, GNUnet would perform 4to6 protocol translation between the VPN (IPv4) and the Exit (IPv6). Similarly, 6to4 protocol translation is also possible. However, the primary use for GNUnet would be to access an Internet service running with an IP version that is not supported by your ISP. In this case, your IP traffic would be routed via GNUnet to a peer that has access to the Internet with the desired IP version.

Setting up an entry node into the GNUnet VPN primarily requires you to enable the "VPN/PT" option in "gnunet-setup". This will launch the "gnunet-service-vpn", "gnunet-service-dns" and "gnunet-daemon-pt" processes. The "gnunet-service-vpn" will create a virtual interface which will be used as the target for your IP traffic that enters the VPN. Additionally, a second virtual interface will be created by the "gnunet-service-dns" for your DNS traffic. You will then need to specify which traffic you want to tunnel over GNUnet. If your ISP only provides you with IPv4 or IPv6-access, you may choose to tunnel the other IP protocol over the GNUnet VPN. If you do not have an ISP (and are connected to other GNUnet peers via WLAN), you can also choose to tunnel all IP traffic over GNUnet. This might also provide you with some anonymity. After you enable the respective options and restart your peer, your Internet traffic should be tunneled over the GNUnet VPN.

The GNUnet VPN uses DNS-ALG to hijack your IP traffic. Whenever an application resolves a hostname (i.e. ''), the "gnunet-daemon-pt" will instruct the "gnunet-service-dns" to intercept the request (possibly route it over GNUnet as well) and replace the normal answer with an IP in the range of the VPN's interface. "gnunet-daemon-pt" will then tell "gnunet-service-vpn" to forward all traffic it receives on the TUN interface via the VPN to the original destination.

For applications that do not use DNS, you can also manually create such a mapping using the gnunet-vpn command-line tool. Here, you specfiy the desired address family of the result (i.e. "-4"), and the intended target IP on the Internet ("-i") and "gnunet-vpn" will tell you which IP address in the range of your VPN tunnel was mapped.

gnunet-vpn can also be used to access "internal" services offered by GNUnet nodes. So if you happen to know a peer and a service offered by that peer, you can create an IP tunnel to that peer by specifying the peer's identity, service name and protocol (--tcp or --udp) and you will again receive an IP address that will terminate at the respective peer's service.