Submitted 3 weeks ago by altphoto@lemmy.today to selfhosted@lemmy.world
https://rayfish.xyz/blog/01-introducing-rayfish
Today I fumbled thru the install of Rayfish and Yggdrasil. Both are awesome, but Rayfish was so much easier to install and use.
Have you tried these yet?
Here’s the Yggdrasil link:
Yggdrasil has Android, Windows, Linux, Apple installers.
Rayfish only works on desktop right now, but hopefully soon they will be able to get it on Android.
ace@lemmy.ananace.dev 3 weeks ago Been using Yggdrasil for quite a while at this point, both for encrypted service communication and also as unbreakable VPN links to various places where I don’t want to have to mess about with NAT traversal.
It’s been nice to be able to just drop it onto my router, add an ALFIS DNS entry, and have all my devices just work with Yggdrasil with no additional configuration.
Never heard of it. Why should I use it instead of established systems?
Because, specially rayfish, both are encrypted peer to peer and have their own DNS and are decentralized. So no company in the middle collecting everything you do in a data center and giving it to your enemies while charging you for it.
With Rayfish you don’t even need a dynamic DNS or FQN so my FQN cost and it’s never ending complications go away. The only problem is that they don’t have an android app yet for Rayfish. For now I’m using Yggdrasil.
So no advantage over something known like Netbird and Wireguard, then
I suppose they don’t work without having
Like, if the IPs keep changing, and a device goes offline and then online, how does yggdrasil know how to reach that system?
My phone gets a new IP when I hop from wifi to cell but it’s still able to communicate. Supposedly rayfish has this solved too although I cannot test that since the computer is on my network but maybe I could tether something to my cellphone and test that way.
If you’re using ipv6 supposedly you don’t need to forward ports. So that means that regardless of what IP your ISP gives you, your network should survive.
f you’re using ipv6 supposedly you don’t need to forward ports.
You don’t need to forward ports but you still need to maintain network rules for each port so you can get through the firewall. And those rules need to know IPs. And if your public IPv6 prefix changes you need to update the rules.
So, really, there’s no advantage over forwarding, on the contrary, since forwarding uses private IPs which you can make static so they never change.
Some router software like OpenWRT attempts to work around this issue by using a special “minus netmask” shorthand syntax for the network rules, for example ::2/-64 means you want to reach [whatever the dynamic prefix is right now]::2. Which assumes you’ve set things up so that a certain machine always gets static suffix ::2, which means that machine does not do MAC anonymization and can use DHCPv6, which excludes all Android and iOS devices. So it can be used with Linux servers for example but with a lot of caveats.
In the Yggdrasil network any node can act as relay for other nodes. So you can get to unreachable nodes via reachable nodes, as long as there’s a possible path through the network graph.
The community also maintains a few nodes with static public addresses, specifically so they can be used as entry points into the network.
Each node has two addresses, one used for communications inside the network and one used for peering. The inner address is IPv6 allocated randomly from the reserved 0200::/7 range and never changes (unless you wipe and re-configure the node). The peering address needs to be public and static, yes, but can be either IPv4 or IPv6 fwiw.
You only need to peer with one such public and static address to be able to reach other nodes, as long as there’s a path to them among all the peers in the graph. If you’re taking advantage of the larger Yggdrasil network that is taken care of by the public community nodes. If you want to set up your own separate network then you need to set up at least one node with a public static address. But you can also use a domain name and do DDNS for example.
Thanks, this was quite detailed. You do need public relay nodes after all… which was what I was wondering.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
| Fewer Letters | More Letters |
|---|---|
| CGNAT | Carrier-Grade NAT |
| DNS | Domain Name Service/System |
| ISP | Internet Service Provider |
| NAT | Network Address Translation |
| VPN | Virtual Private Network |
| VPS | Virtual Private Server (opposed to shared hosting) |
[Thread #53 for this comm, first seen 13th Jul 2026, 09:50] [FAQ] [Full list] [Contact] [Source code]
irmadlad@lemmy.world 3 weeks ago So…this is kind of like Tor, but different?
It’s a mesh VPN using exclusively IPv6 addresses in the reserved 0200::/7 range.
By default a new node connects to nothing. You add other nodes explicitly, typically they’d be your own devices, but the network also maintains a few public nodes that are used to facilitate communications across the entire Yggdrasil network.
When a node is connected it raises a tunnel network interface and routes 0200::/7 through it. With the usual caveats (it will pick up any service that binds to all interfaces etc.)
Each node can act as relay to reach nodes that aren’t directly connected – the network will compute the shortest path in that case – and this can be used to reach nodes behind CGNAT as long as there’s a path that contains at least one publicly reachable node.
All connections are end-to-end encrypted with the keys of the two end-nodes involved in it, so the relay nodes cannot eavesdrop.
That’s about it. Anything else (DNS, routing, firewalls) is the responsibility of each node.
No, this is not tor. This is networking. Imagine two computers where you can plug one to the other with an Ethernet cable that’s it. Except that you connect one at your house and I connect the other at my house. They think they are in the same network so I could browse through your files or use a local website you serve. The benefit being that I could be you and I just traveled to your country yesterday. So I plug in my computer and I can see all my files back home from your country. Neither country can spy into my system or see what I’m doing. All they can do is decide that it’s not worth having a national connection if I’m on the network. So they can unplug the entire Internet just to block me watching YouTube from Tampa while I’m in Italy.
irmadlad@lemmy.world 3 weeks ago Interesting. Never heard of it. I’ll have to do some reading.
I’m thinking about doing something like BGP+Wireguard
paperd@lemmy.zip 3 weeks ago
But rayfish is vibe coded. I’d not trust it.
uuj8za@piefed.social 3 weeks ago
Evidence?
Well aside from the obvious giveaways in the presentation format of the README.md, and .gitignore, the very first question of its FAQ is:
Yes. Heavily. Claude and GLM-5.2 wrote a lot of this repo.
altphoto@lemmy.today 3 weeks ago
Hmm 🤔