Difference between revisions of "Mesh/Technical Overview"

From Sudo Room
Jump to navigation Jump to search
(→‎The three wifi networks and IP assignment: Updating to reflect current network topology)
Line 30: Line 30:
All three of these networks are available on both 2.4 and 5 GHz on the home node. They are also all three available on any extender nodes plugged in to the home node. The three different networks are extended over a single ethernet cable using VLANs.
All three of these networks are available on both 2.4 and 5 GHz on the home node. They are also all three available on any extender nodes plugged in to the home node. The three different networks are extended over a single ethernet cable using VLANs.


If a node-owner is sharing internet, then the node will create a layer 2 (L2TP) tunnel to a VPN server on the Internet using tunneldigger. batman-adv will connect over this tunnel to other nodes on the mesh, so the mesh can route traffic over the internet if no wifi path to another node is available (e.g. other nodes are physically too far away). When people connect to the peoplesopen.net access point and try to access the Internet, the traffic will flow through the VPN, and the source IP of requests will appear to be the VPN with the sudo mesh organization listed as the abuse contact.  
If a node-owner is sharing internet, then the node will create a layer 2 (L2TP) tunnel to a VPN server on the Internet using tunneldigger. Babel (the mesh routing protocol) will connect over this tunnel to other nodes on the mesh, so the mesh can route traffic over the internet if no wifi path to another node is available (e.g. other nodes are physically too far away). When people connect to the peoplesopen.net access point and try to access the Internet, the traffic will flow through the VPuN, and the source IP of requests will appear to be the VPuN with the sudo mesh organization listed as the abuse contact.  


The nodes run DHCP servers and each have a /24 IPv4 subnet in the 10.0.0.0/8 range that is statically assigned by coordination between mesh groups and individuals hosting and administrating their own nodes on People's Open Network (currently only the sudo mesh organization). If a user connects to the peoplesopen.net access point on a node that isn't sharing internet, then batman-adv intercepts the DHCP request and forwards the request to another node on the network that has Internet connectivity (see the gw_mode option for batman-adv).
The nodes run DHCP servers and each have a /24 IPv4 subnet in the 100.64.0.0/10 range that is statically assigned by coordination between mesh groups and individuals hosting and administrating their own nodes on People's Open Network (currently only the sudo mesh organization).


The private network does not limit bandwidth and provides access to both direct access to the Internet (if the node owner has hooked the node up to the Internet) and access to the mesh. Each node's private network runs on 172.30.0.0/16 and uses NAT between the private network and the mesh. It does not accept any new incoming connections from the mesh onto the 172.30.0.0/16 subnet.
The private network does not limit bandwidth and provides access to both direct access to the Internet (if the node owner has hooked the node up to the Internet) and access to the mesh. Each node's private network runs on 172.30.0.0/16 and uses NAT between the private network and the mesh. It does not accept any new incoming connections from the mesh onto the 172.30.0.0/16 subnet.

Revision as of 21:23, 21 July 2015

Illustration showing how a sudomesh home node can connect to a window-mounted extender node. The device with two antennas is the home node and the device on the outside of the window is an extender node.
Illustration showing a more complicated setup. Here the node operator has connected their personal computer, a small Raspberry Pi computer and two extender nodes: One on the outside of the window and one on the roof (not shown but a can be seen going up and out of the frame). This is definitely an advanced node operator.
A close-up of the wired network ports on the home node and their use.

Home and extender nodes

Note: You can also read the non-technical explanation of home nodes and extender nodes.

Our mesh has two types of nodes: Home nodes and extender nodes.

The home nodes run the full sudowrt firmware and on its own a bunch of home nodes will make up a fine mesh network. The home node is a normal five-ethernet-port indoor wifi router. An extender node runs a minimal firmware and does nothing on its own. Instead, the extender node basically acts as extra radios when plugged in to a home node. The node operator can put a home node in e.g. their living room and if they later decide they want a high speed directional link to a neighbour then they can put e.g. a Nanobridge M5 running the extender node firmware on their roof and connect it via ethernet to the home node. Or they could put a Nanostation M2 pointed out their window and extend the signal further out into the street or to nearby neighbours. Each extender node extends all three networks (explained in the next section).

For home nodes we are currently only officially supporting the TP-Link TL-WDR3600. We are not planning to support anything else for the time being, though if you have a good reason please let us know. For extender nodes we are currently supporting

The mesh is made up mostly of wifi routers using Atheros chipsets and running our own firmware based on OpenWRT, Babel and wlan slovenja's tunneldigger.

Node-owners can choose to connect the nodes to their existing internet connection using ethernet. If they have Internet access, they can share a portion of it with the mesh. The amount of bandwidth shared is limited with 'tc'. It is chosen at node-configuration time and can be changed using the simple built-in web admin interface.

The three wifi networks and IP assignment

The nodes each run three wifi networks (three SSIDs on the same physical wifi interfaces):

  • The Open network with SSID peoplesopen.net is an open access point. Most people will use the network by connecting to this.
  • The Mesh network with SSID pplsopen.net-node2node is an ad-hoc network that the nodes use to mesh with each other using Babel
  • A private wifi network that is named by the node owner (or a name is generated) and uses WPA2-PSK.

All three of these networks are available on both 2.4 and 5 GHz on the home node. They are also all three available on any extender nodes plugged in to the home node. The three different networks are extended over a single ethernet cable using VLANs.

If a node-owner is sharing internet, then the node will create a layer 2 (L2TP) tunnel to a VPN server on the Internet using tunneldigger. Babel (the mesh routing protocol) will connect over this tunnel to other nodes on the mesh, so the mesh can route traffic over the internet if no wifi path to another node is available (e.g. other nodes are physically too far away). When people connect to the peoplesopen.net access point and try to access the Internet, the traffic will flow through the VPuN, and the source IP of requests will appear to be the VPuN with the sudo mesh organization listed as the abuse contact.

The nodes run DHCP servers and each have a /24 IPv4 subnet in the 100.64.0.0/10 range that is statically assigned by coordination between mesh groups and individuals hosting and administrating their own nodes on People's Open Network (currently only the sudo mesh organization).

The private network does not limit bandwidth and provides access to both direct access to the Internet (if the node owner has hooked the node up to the Internet) and access to the mesh. Each node's private network runs on 172.30.0.0/16 and uses NAT between the private network and the mesh. It does not accept any new incoming connections from the mesh onto the 172.30.0.0/16 subnet.

Node flashing and configuration

One of our medium-term goals is to be able to sell nodes on our website and minimize the amount of work required to re-flash/configure the nodes and provide documentation for the user. To facilitate this, our current process for new nodes is:

  • A new node is flashed either automatically (using e.g. ubiquiti-flasher or merakiflasher) or manually with your own tools and the sudowrt firmware.
  • The node is then configured by a sudo mesh volunteer using our makenode software.
  • makenode generates SSH keys, SSH root password, web admin password and private wifi password, then it configures the node, saves the info in the node database and shuts down the node.
  • makenode then automatically prints a sticker containing some basic info including wifi and web admin passwords.
  • The sudo mesh volunteer attaches the sticker to the nodes power supply and puts the node back in the box with a set of instructions for how to install and use the node.
  • The node is shipped to the new node owner!

Node management

All nodes set up by sudo mesh automatically allow root access using an SSH key held by a few trusted sudo mesh organizers. This is to allow us to update the firmware and troubleshoot network issues. We inform node-owners of this fact and tell them how to prevent sudo mesh from accessing their nodes, but also indicate that they should be ready to manage their own node if they choose to do this.

We don't yet have a solution for node monitoring but we're expecting to use the new version of wlan slovenja's nodewatcher software.

We don't yet have an automatic update solution in place, but we are looking at the software used by Gluon. The Gluon update system is centralized but in the long term we would like to have a decentralized system that works something like this:

  • Any number of node-updater servers announce themselves on the mesh and whether or not an update is available.
  • The nodes run a future version of mdnssd-min as a daemon that keeps a currently list of node-updaters.
  • Once every N hours +/- a random factor, if any node-updaters have updates available, all nodes connect to a randomly chosen node-updater and request an update.
  • The node-updaters send the nodes an ipk file with the update and the nodes check the signature and install it if it's signed by a trusted authority.

Detailed Documentation

Retrieved from "https://sudoroom.org/mediawiki/index.php?title=Mesh/Technical_Overview&oldid=9528"