Resilience

Your network is managed through the Nardeboon control plane, but it doesn't stop working when the control plane is out of reach. If a node can't reach it, for example because it's filtered in your country, the node carries on.

What a node does

When the control plane is unreachable, a node:

1. Detects it and shows a warning in nardeboon status.
2. Keeps working on its last signed network map and data, including after a reboot.
3. Keeps retrying over every transport and every known endpoint, and through relays and peers.

$ nardeboon status
Connected to network home as mypc (100.101.12.4)
  ! Can't reach the control plane since 09:14; the tunnel keeps working on its last network map, valid until Oct 20 09:12.

PEER     ADDRESS       OS     STATUS
hetzner  100.83.20.5   linux  active, 4s ago
laptop   100.101.40.7  linux  online

Its peers keep reaching it too. The control plane shows a node it can't hear from as offline, but peers keep its keys and addresses, so connections that work carry on.

After a reboot

A node keeps its last network map on disk, readable only by root, beside its state in /var/lib/nardeboon. When it starts and the control plane doesn't answer within a few seconds, it brings its tunnel up on that map: its addresses, routes, access rules, device names and peers are back, and it finds its peers directly or through relays as before. Peers still recognize it after the reboot, so it doesn't need the control plane to introduce it again.

Offline validity window

A node relies on its cached state for a limited time: the network's offline validity window. The window is set per network, and the default is generous: a week. After that, a node that still can't reach the control plane stops using the map it kept.

Reaching the control plane again

Control traffic uses the same obfuscated transports as your data, and is indistinguishable from it. A node retries over every transport and every endpoint it knows. If it can't get through on its own, it can reach the control plane through a relay or a peer that can.

On a network that cuts the connections a device starts, the control plane connects to the device instead: the device sends one short message the network lets through, coded so that only it could have sent it, and the control plane calls it back, so it keeps a session of its own even with no peer to go through. The same message has its peers and relays call it. See networks that cut what a device starts.

Gossip between peers

Some updates don't wait for the control plane. Peers gossip them to each other:

Both are signed, so peers can pass them on but can't forge or alter them.

Related

• Transports: how control and data traffic are disguised.
• Paths and relays: how relays work and how paths are chosen.
• Networks and devices: key expiry and revocation.