Routes
Routes allow nodes in a drasyl network to reach external IP networks.
Conceptβ
Each route defines how traffic to an external destination is forwarded through a specific gateway node.
Communication is only allowed for nodes belonging to permitted groups.
Route enforcement is decentralized: both the sending node and the gateway apply the rules independently.
Currently, the gateway must be a Linux system with IP forwarding and NAT enabled.
Route Attributesβ
Each route entry consists of the following attributes:
dest
β
The destination network (in CIDR notation) that should be reachable through this route.
- Must be unique within a drasyl network.
- Must be a network address (not a host address).
- Overlapping routes are resolved by prefix length (longest match wins).
Defining the same dest
in multiple networks on the same device results in undefined behavior. Run drasyl status
in the terminal to check if duplicate routes exist and which one is currently applied.
gw
β
The public key (pk
) of the node that will act as a gateway.
This device must:
- Be part of the current drasyl network.
- Run a Linux system.
- Have IP forwarding enabled and act as a NAT router.
To prepare the gateway device, perform the following steps:
Enable IP forwardingβ
Edit /etc/sysctl.conf
to uncomment:
net.ipv4.ip_forward=1
Apply the change immediately:
sudo sysctl -w net.ipv4.ip_forward=1
Configure iptablesβ
Set the correct interface names (adjust to your system):
PHY_IFACE=eth0
DRASYL_IFACE=drasyl230whb89k
The name of the drasyl interface can be retrieved using the drasyl UI or the terminal by running drasyl status
:
Then add NAT and forwarding rules:
sudo iptables -t nat -A POSTROUTING -o $PHY_IFACE -j MASQUERADE
sudo iptables -A FORWARD -i $PHY_IFACE -o $DRASYL_IFACE -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i $DRASYL_IFACE -o $PHY_IFACE -j ACCEPT
Make the rules persistent:
sudo apt install iptables-persistent
sudo bash -c "iptables-save > /etc/iptables/rules.v4"
groups
β
A list of node groups allowed to use this route. Only nodes in one of the listed groups may send traffic to the specified destination.
If omitted, the route is accessible to all nodes in the network.
Example Route Configurationβ
[[route]]
dest = "192.168.188.0/24"
gw = "689a1b9f5efcb861ac67ce185ddb2396444326e12fe1df353731416f5a3a2706" # john-desktop
groups = [ "admins" ]