Nebula
A scalable, secure overlay networking tool for connecting computers anywhere with a focus on performance and simplicity.
What is Nebula?
Nebula is a scalable overlay networking tool that enables secure, peer-to-peer connections between computers anywhere in the world. It uses certificates for authentication and security groups for traffic filtering, allowing users to move data across cloud providers, datacenters, and endpoints without maintaining a specific addressing scheme. It was designed to provide a mechanism for groups of hosts to communicate securely over the internet with expressive firewall definitions.
System administrators, DevOps engineers, and organizations needing to securely connect distributed infrastructure, remote teams, or IoT devices across multiple environments. It's ideal for those who require a self-hosted, scalable alternative to traditional VPNs.
Developers choose Nebula for its simplicity, strong security with modern encryption, and ability to scale from small setups to tens of thousands of nodes. Its unique integration of certificates, security groups, and peer-to-peer discovery offers a cohesive solution that outperforms piecemeal approaches, with cross-platform support and no vendor lock-in.
Overview
A scalable overlay networking tool with a focus on performance, simplicity and security
Use Cases
Best For
- Securely connecting remote teams and distributed infrastructure across cloud providers
- Building scalable mesh networks for IoT or edge computing deployments
- Replacing traditional VPNs with a more flexible, certificate-based overlay network
- Establishing peer-to-peer connections between devices behind NATs or firewalls
- Implementing fine-grained traffic filtering with user-defined security groups
- Creating portable networks that run on diverse platforms from servers to mobile devices
Not Ideal For
- Organizations without dedicated DevOps or security teams to manage certificate authorities and rotations
- Projects needing instant, zero-configuration networking without setting up and maintaining lighthouse servers
- Environments where UDP traffic is heavily restricted or symmetric NATs prevent effective hole-punching
Pros & Cons
Pros
Uses the Noise Protocol Framework with ECDH key exchange and AES-256-GCM encryption by default, providing modern, robust security out of the box, as highlighted in the technical overview.
Can seamlessly connect from a handful to tens of thousands of devices, reducing reliance on central servers after initial discovery, which is core to its value proposition for distributed infrastructure.
Runs on Linux, macOS, Windows, FreeBSD, iOS, and Android, with distribution packages and Docker support, making it versatile for diverse environments from servers to mobile devices.
User-defined security groups enable expressive, provider-agnostic firewall rules similar to cloud security groups, allowing fine-grained control over inter-node communication.
Cons
Requires multiple manual steps: creating a CA, signing host certificates, configuring lighthouses, and managing configuration files, as detailed in the seven-step getting started guide.
Certificate authorities expire in one year by default, necessitating manual rotation and ongoing PKI maintenance, a weakness admitted in the documentation with a guide for rotating CAs.
Discovery nodes must have routable IPs and remain online for new peers to connect, introducing a single point of failure for network establishment if not redundant.
Frequently Asked Questions
Related Projects
HeadscaleAn open source, self-hosted implementation of the Tailscale control server
IPsec VPN Server Auto Setup ScriptsSet up your own IPsec VPN server in just a few minutes, with IPsec/L2TP, Cisco IPsec and IKEv2. Supports Ubuntu, Debian, CentOS/RHEL, Amazon Linux, Alpine and Raspberry Pi. Includes client config and management scripts.
InnernetA private network system that uses WireGuard under the hood.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.