Gluon integrates several OSI-Layer 2 tunneling protocols to enable interconnects between local meshes and provide internetwork access. Available protocols currently are:
- L2TPv3 (via tunneldigger)
fastd is a lightweight userspace tunneling daemon, that implements cipher suites that are specifically designed to work well on embedded devices. It offers encryption and authentication. Its primary drawback are the necessary context-switches when forwarding packets.
L2TPv3 is an in-kernel tunneling protocol that performs well, but offers no security properties by itself. The brokering of the tunnel happens through tunneldigger, its primary drawback being the lack of IPv6 support.
From the site configuration fastd can be allowed to offer toggleable encryption in the config mode with the intent to increase throughput, although in practice the gain is minimal.
- Add the feature
mesh_vpn.fastd.configurable = truein
- Optionally add
mesh_vpn.fastd.methodstable if you want “Performance mode” as default (not recommended)
- Prepend the
nullcipher in fastd’s method list
Config Mode: The resulting firmware will allow users to choose between secure (encrypted) and fast (unencrypted) transport.
Unix socket: To confirm whether the correct cipher is being used, fastds unix socket can be interrogated, after installing for example socat.
opkg update opkg install socat socat - UNIX-CONNECT:/var/run/fastd.mesh_vpn.socket