Configuring Yggdrasil with systemd-networkd

Yggdrasil, while being a great mesh networking software, doesn’t have that many learning resources on it. The docs on its website and a few enthusiast-established wikis are probably everything you’ll ever find on how to set it up.

This is a simple recipe on how to configure Yggdrasil with systemd-networkd and systemd-resolved while providing other devices on your local network with Ygg addresses and allowing them to use Ygg.

Consider the following setup:

  • an always-on PC
  • a router to which the PC is connected
  • all other devices in LAN

We want to deploy Yggdrasil on the PC and delegate the 300:XXXX:XXXX:XXXX::/64 subnet provided by Ygg to other devices. This guide assumes you have already set up Yggdrasil on your Linux box.

We configure our usual connection with /etc/systemd/network/

# wired connection device name

# Address/Gateway, or DHCP=yes, or whatever else you might have configured
# your wired connection with
# the address inside the 300::/8 subnet; the host will use this address inside
# the wired network
# enable IPv6 router
# the DNS we want to use for clearnet connections

# the prefix advertised to other devices by the machine

# should be an Ygg DNS address, you might prefer to unset this or use your own
# DNS server inside Yggdrasil
RouterLifetimeSec=3600 # should always be set

# the route to Ygg to propagate to devices

Now let’s configure Yggdrasil TUN device with /etc/systemd/network/

# Yggdrasil TUN device name, same as IfName in /etc/yggdrasil.conf if set

# useless with Yggdrasil
# some DNS inside Yggdrasil to resolve .ygg addresses and alike; you might want
# to specify your own address here

# the /128 address Ygg provides us with

# route packets to Yggdrasil

In this schema systemd-resolved will only use Ygg DNS for sites we browse from Ygg, and whatever else we configure in /etc/systemd/resolved.conf by default. This allows the machine to properly resolve .ygg domains while falling back to system default DNS for everything outside Yggdrasil.

Every other IPv6-enabled device on your LAN will now receive Ygg addresses and will be able to connect to Yggdrasil while your machine is on. However, be aware that end-to-end encryption Yggdrasil provides is terminated at your Yggdrasil router. You should also consider setting up a firewall to protect your other devices.