Nebula
Open-source tool that links computers across the internet into one private, encrypted network.
- Stars
- 18.5k
- Forks
- 1.2k
- Licence
- MIT
- Language
- Go
- Last update
- 7 days ago
- Type
- App
What it is
Nebula is a networking tool that connects computers wherever they are into a single private network, so they can reach each other as if on the same local network. It uses certificates and encryption to authenticate each machine, and lets you write firewall rules based on named groups. The README says it runs on Linux, macOS, Windows, iOS, and Android, and can connect from a few computers up to tens of thousands.
- Connect a laptop to home servers that sit behind different firewalls
- Link machines across several cloud providers into one addressable network
- Restrict which groups of hosts can reach which services using group-based rules
- Run a small private network of a few computers using a lighthouse on a cheap cloud instance
Great for
- Teams connecting servers across several clouds or data centers
- People who want a private network between their own machines without a fixed address plan
- Operators who want group-based firewall rules similar to cloud security groups
- Users comfortable managing certificates and a small cloud host
Not ideal for
- People who want a plug-and-play VPN with no setup: the README describes creating a certificate authority, signing certs, and editing config files
- Teams that do not want to run their own certificate authority and lighthouse; the README points to a paid managed service from Defined Networking for that
- Anyone needing a consumer 'hide my browsing' VPN, since the README frames Nebula as a network overlay for connecting hosts
How to get it
- 1
Install with a package manager
You'll need: Go (only if building from source)
Install on macOS with Homebrew
brew install nebulaInstall on Arch Linux
sudo pacman -S nebulaInstall on Debian Linux
sudo apt install nebulaPull the Docker image
docker pull nebulaoss/nebula - 2
Run it
- Create a certificate authority with ./nebula-cert ca -name "Myorganization, Inc"
- Sign a certificate for each host with ./nebula-cert sign, choosing a name and IP address
- Set am_lighthouse: true on the lighthouse node and define the lighthouse in each host's config.yml
- Copy the binary, config.yml, and the host's certificate files to each host, keeping ca.key off the hosts
- Start Nebula on each host with ./nebula -config /path/to/config.yml
- 3
Get the most out of it
- Use groups in certificate signing (for example -groups "servers") to write traffic rules between hosts
- Use the -duration flag to set shorter host certificate lifetimes
- Use the P256 curve option (nebula-cert ca -curve P256) if your compliance requirements call for it
- Run a lighthouse on a cheap cloud instance with a routable IP so hosts behind NAT can find each other
- Follow the documentation for rotating the certificate authority before it expires
Downloads
Strengths
- Built on established cryptography: the README names the Noise Protocol Framework, ECDH, and AES-256-GCM by default
- Runs on many platforms, including mobile, and is available through several package managers and Docker
- MIT licensed and actively maintained, with an official example configuration and documentation site
Trade-offs
- Setup involves several steps: binaries, a certificate authority, host certificates, config files, and a lighthouse with a routable IP
- The README notes that certificate authorities expire after one year by default and need rotation
- Building with FIPS or BoringCrypto options involves extra build targets, and the README says BoringCrypto support is deprecated
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.