bubuntux/nordlynx repository overview

bubuntux/nordlynx⁠

⁠Quick reference

• Maintained by: Julio Gutierrez⁠
• Where to get help: Github discussions⁠

⁠Supported tags

• edge (created nightly)
• latest (created monthly or on demand)
• YYYYmmdd (created monthly or on demand)

⁠Quick reference (cont.)

• Where to file issues: Github issues⁠
• Supported architecture: (more info⁠) amd64, arm32v7, arm64, s390x
• Published image artifact details: DockerHub⁠, Github packages⁠
• Continuous integration: Github actions⁠
• Source: Github⁠

⁠What is NordLynx?

NordLynx is a technology built around the WireGuard® VPN protocol. It lets you experience WireGuard’s speed benefits without compromising your privacy. You can find more information about NordLynx in this blog post⁠.

⁠What is WireGuard?

WireGuard®⁠ is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. It is currently under heavy development, but already it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry.

⁠Road warriors, roaming and returning home

If you plan to use Wireguard both remotely and locally, say on your mobile phone, you will need to consider routing. Most firewalls will not route ports forwarded on your WAN interface correctly to the LAN out of the box. This means that when you return home, even though you can see the Wireguard server, the return packets will probably get lost.

This is not a Wireguard specific issue and the two generally accepted solutions are NAT reflection (setting your edge router/firewall up in such a way as it translates internal packets correctly) or split horizon DNS (setting your internal DNS to return the private rather than public IP when connecting locally).

Both of these approaches have positives and negatives however their setup is out of scope for this document as everyone's network layout and equipment will be different.

⁠Usage

Here are some example snippets to help you get started creating a container.

⁠docker-compose (recommended, click here for more info⁠)

---
version: "3"
services:
  nordlynx:
    image: ghcr.io/bubuntux/nordlynx
    container_name: nordlynx
    cap_add:
      - NET_ADMIN #required
    environment:
      - PRIVATE_KEY=xxxxxxxxx #required
    restart: unless-stopped

⁠docker cli (click here for more info⁠)

docker run -d \
  --name=nordlynx \
  --cap-add=NET_ADMIN `#required` \
  -e PRIVATE_KEY=xxxxxxxxx `#required` \
  --restart unless-stopped \
  ghcr.io/bubuntux/nordlynx

⁠Env Variables

⁠Sysctl

• net.ipv4.conf.all.src_valid_mark=1 May be required. (depends on multiple factors)
• net.ipv6.conf.all.disable_ipv6=1 Recommended when only using ipv4.