Emanuele Faranda - Creating network overlays with IoT devices using N2N

Creating Network Overlays
with IoT Devices using N2N
Emanuele Faranda <faranda@ntop.org>

Emanuele Faranda – LinuxLab 2018
IoT Challenges [1/2]
 Constrained resources (cpu, memory)
 Connect to the device for
configuration/troubleshooting
 Remotely export data and metrics
 Remotely install security updates

IoT Challenges [2/2]
 Interconnect different IoT devices in a
secure way
 Monitor the devices traffic for
anomaly/malware detection
 Implement policies to block unknown
threats

Internet Today
 The IP address of the devices is dynamic
 IoT devices are often located behind NAT
 IPv6 can improve the situation but we still
need a way to define our own networks

NAT and Home [1/2]

NAT and Home [2/2]
How to reach the device from anywhere?
 Setup IP forwarding in the home router
 Use dedicated vendor software to access
the device from the cloud
 The vendor must implement security into
the application

 Existing VPN solutions are complex and
heavyweight
 Most IoT protocols are not encrypted by
design (MQTT, HTTP, ...) and would require
modifications
Other Problems

Our Vision
 The internet should be a “transparent” IP-
based transport for users, not a
geographical/ISP constrain
 Users should control/create their
community networks (today network
administrators do)
 Move encryption and network reachability
from the application to the network layer

Introducing N2N [1/2]
 Is an encrypted Layer 2 VPN
 It can cross NAT and firewalls
 It’s decentralized, no single point of failure
(like traditional VPN)
 Makes it simple to join multiple virtual
networks (comminities)

 Open source project, driven by the
community
 Easy setup: cli tool or service
 Easy integration: just a single function call
 Cross platform: Android, Linux, *BSD,
MacOs, Windows
Introducing N2N [2/2]

N2N Architecture [1/2]
Edge
Node
Edge
Node
Edge
Node
Edge
Node
Super
Node
Super
Node
Edge
Node
Edge
Node
Super
Node
Super
Node
Edge
Node
Edge
Node
Edge
Node
Edge
Node
Edge
Node
Edge
Node
Edge
Node
Edge
Node

 Meshed, semi-centralized architecture (like
P2P) with super-nodes that can be build the
basic network infrastructure
 Multiple supernodes to announce hosts
 Edge nodes beloging to the same
community can talk together
 Each edge node has a virtual network
interface for each network it joined
N2N Architecture [1/2]

Don’t Reinvent The
Wheel
 TUN/TAP adapters to run across OS
 L2/L3 encrypted tunnels are used by peers
to communicate
 P2P protocols will be used for finding and
registering hosts, as well as announcing
new networks (communities)
 DHCP and DNS

Why P2P
 P2P has overcome all the limitation of the
“closed” internet (firewalls, dynamic IP and
NAT)
 P2P can be seen as a “new/modern” IP
routing protocol
 P2P allows decentralized application
design and works even with non-
permanent connections contrary to IP

Install N2N
Prebuilt binaries:
 Setup repo http://packages.ntop.org
 $ apt-get install n2n
From github:
 $ git clone https://github.com/ntop/n2n
 $ ./autogen.sh && make

Run N2N
 edge1$ edge -d n2n0 -c mycommunity -k
mykey -a 192.168.9.1 -l
supernode.ntop.org:7777
 edge2$ edge -d n2n0 -c mycommunity -k
mykey -a 192.168.9.2 -l
supernode.ntop.org:7777
 edge2$ ping 192.168.9.1

N2N Today
 Users can setup their own supernodes
Users can join different communities at
once
 Edge nodes can talk directly (in a LAN via
multicast advertisements, or in a WAN if
not NATed)
 N2N can be intergrated into other software

Embedding N2N

Remote Assistance
(ntopng)

Performance (scp)
 Line rate: 1 gbit/s
 Direct transfer: 900 mbit/s
 N2N no encryption: 850 mbit/s
 N2N with encryption: 114 mbit/s
Note: encryption currently requires high computational
resources and provides low througput. This will be
addressed in the next release.

Going Beyond
 Use asymmetric keys for nodes end-to-end
encryption
 Leverage hardware encryption
 Apply traffic policies at the edge (nDPI)
 Make N2N traffic stealth to DPI software

Credits and Links
● Luca Deri <deri@ntop.org>
● https://www.ntop.org/products/n2n
● https://github.com/ntop/n2n
● https://www.ntop.org/guides/ntopng/remot
e_assistance.html
● https://github.com/gregnietsky/simpletun

Thank You

Emanuele Faranda - Creating network overlays with IoT devices using N2N

More Related Content

What's hot (20)

Similar to Emanuele Faranda - Creating network overlays with IoT devices using N2N (20)

More from linuxlab_conf (10)

Recently uploaded (20)

Emanuele Faranda - Creating network overlays with IoT devices using N2N