From CCCHHWiki
Revision as of 17:54, 10 April 2010 by Openfly (talk | contribs) (fonera20n)
Jump to: navigation, search

and AgoraLink

the big picture

What is this all about? will write some stuff about it. In case you have awesome ideas just add them.

A view on the connected nodes inside the ChaosVPN. Refreshed every minute:

ChaosVPN 2.0


The Rebuild of the ChaosVPN became nessesary at some point, as the vermittlung is blackholed. Furthermore we would like to put live back to the ChaosVPN and use it to interconnect the hackerspaces.

So we thought its a good time to redesign stuff. We will climb up to tinc 1.0.10.


An unfinshed Howto for Debian systems is available at Debian - users of other systems need to adapt it likewise, more documentation will hopefully follow in the future.


we use tinc. There will be a tinc 2.0 version soon. The developer has his ideas about tinc 2.0 at and first code is at

Config builder

Currently we are porting haegars script from perl to c and strip off curl and openssl, so it fits in a OpenWRT box.

OpenWRT Packages

Blogic will build a special OpenWRT package, which is called chaosvpn at the moment and a recent tinc 1.0.10 for that.

See also Packages may be in flux for awhile, if you have trouble with any of the binaries, email cjp.

Debian Packages

Haegar updated (backported) tinc 1.0.11 packages for debian. They are availible at:

I will also create Debian packages of the config builder once it is in a usable state.


For the fonera 2.0n openfly have collected some information

Included are Packages for ChaosVPN, and TINC There are source code packages as well.

Packages go in /openwrt/packages/ Source goes in /openwrt/dl/

.config is a sample config for fonera2n. It is not minimalist in any way. Vyrus has a minimal config I will hunt down.

The chaosvpn version is not reflected in the name of the package... that is just there because I was too lazy to update the chaosvpn package for the current version.


helios maintains an AUR-package:


The source code repository is available at:

You can download the source with git

git clone git://

IP Ranges and Participants:

Please see IPRanges for more Infos.

other related software


There is a need for a dns.

wanted changes

short term

  • clients don't have to authentificate themself - everybody can see the config.
  • if admins are lazy and don't rebuild the config file properly we will have old routes in the network that don't dissapear (at least until the tinc is reconfigured and restarted) (not a problem anymore with a current .git snapshot, the problem will only affect the non-updating participant with it)

long term

tinc does have some problems. That is the reason why we want to replace that in the forseable future. That will be ChaosVPN 3.0

  • Participants can fake network ranges my intention or mistake. (control informations inside tinc are not proper authentificated) (not true anymore with latest chaosvpn.git where we do not import infos from the tinc-network anymore (TunnelServer=yes))

ChaosVPN 3.0

ChaosVPN 1.0 (historic)

ChaosVPN 1.0 is obsolete, please see above for the next implementation.


At the moment the Hamburg ccc Erfa uses TINC together with some dirty perl-scripts, which are used to read the routes and peers.

For this Setup we have howtos for Debian and Gentoo (in german).

Beginninig in 2003

(haegar:) For me the whole setup with Openvpn was to complicated. It would take some time till its done and the scaling problems were forseable.

Therefore i took time today to get a working mini-solution with tinc running real quick.

The bigger issues with ip-submission and database are able to be added later without any big effort.

Most importand design goals were:

  • data traffic between participants must not rely on the ccc infrastructure.
  • failure of any parts of the infrastructure must not shut down the network completely
  • no work needed for participants just because a new participant is joining or a old one quitting.

system requirements

  • linux only first
    • tinc is availible for nearly all unix variants and windows, but my perl script is only working on linux so far.
  • perl with LWP and https support
  • working dyndns hostname that conains the actual router-ip or static ip

Update 2006

Today (2006) i would implement things different than i did before, but when this happens is completely up in the stars. Until there is a better setup we will use the old setup.

Chaosvpn Geekends

We want to do a chaosvpn geekend. Therefore this wiki page: geekend 0 at Hamburg