Configuring Yggdrasil with systemd-networkd
Yggdrasil, while being a great mesh networking software, doesn’t have that many learning resources on it. The docs on its website and a few enthusiast-established wikis are probably everything you’ll ever find on how to set it up.
This is a simple recipe on how to configure Yggdrasil with systemd-networkd and systemd-resolved while providing other devices on your local network with Ygg addresses and allowing them to use Ygg.
Consider the following setup:
- an always-on PC
- a router to which the PC is connected
- all other devices in LAN
We want to deploy Yggdrasil on the PC and delegate the
subnet provided by Ygg to other devices. This guide assumes you have already
set up Yggdrasil on your Linux box.
We configure our usual connection with
# wired connection device name
# Address/Gateway, or DHCP=yes, or whatever else you might have configured
# your wired connection with
# the address inside the 300::/8 subnet; the host will use this address inside
# the wired network
# enable IPv6 router
# the DNS we want to use for clearnet connections
# the prefix advertised to other devices by the machine
# should be an Ygg DNS address, you might prefer to unset this or use your own
# DNS server inside Yggdrasil
RouterLifetimeSec=3600 # should always be set
# the route to Ygg to propagate to devices
Now let’s configure Yggdrasil TUN device with
# Yggdrasil TUN device name, same as IfName in /etc/yggdrasil.conf if set
# useless with Yggdrasil
# some DNS inside Yggdrasil to resolve .ygg addresses and alike; you might want
# to specify your own address here
# the /128 address Ygg provides us with
# route packets to Yggdrasil
In this schema systemd-resolved will only use Ygg DNS for sites we browse from
Ygg, and whatever else we configure in
/etc/systemd/resolved.conf by default.
This allows the machine to properly resolve
.ygg domains while falling back
to system default DNS for everything outside Yggdrasil.
Every other IPv6-enabled device on your LAN will now receive Ygg addresses and will be able to connect to Yggdrasil while your machine is on. However, be aware that end-to-end encryption Yggdrasil provides is terminated at your Yggdrasil router. You should also consider setting up a firewall to protect your other devices.