Hi there The way we have always approached our network topology is to have the following infrastructure on every exit node of the network - which is a node that also shares an ISP uplink: ISP router [LAN port] <eth> [WAN port] VPN router [LAN port] <eth> [WAN port] LiMe router [LAN port] <eth> [WAN port] HOME router And this instead is the infrastructure on every other [non-exit] LiMe node: LiMe router [LAN port] <eth> [WAN port] HOME router Of course the final part of the exit node config is the same as the non-exit node config LiMe nodes that are not in a specific house or office [or those which are but their owner doesn’t need a home network] don’t have a home router attached to them of course. This way: 1] Every exit node uses the internet uplink without exposing its IP address, therefore protecting the exit node owner for legal issues 2] Every LiMe node [exit or not] can have a Home network that is entirely private to them but also has a reliable LiMe network uplink 3] The shared SSID is always reachable in every part of the network, but when the user is home they can use their home SSID The home network is only - I repeat - for those who request it. In any event, since we’re talking about it, I must specify the way I see things related to this topic [philosophical alert]. I strongly believe that this old-days assumption that the network is secure and that devices can be vulnerable and are unsafe in public networks must come to an end. The network is not secure, just like your neighbourhood’s roads aren’t [and if you think they are right now, just wait until the city grows] and you, as a human, walking down them must be able to handle foreigners and other “dangers" you encounter. Exactly like that, devices must be able to protect themselves every day in every environment. The only way to have a pseudo-secure digital lifestyle is to harden your device, employ device-specific techniques to protect your traffic [always-on VPN at a system level, Tor for specific applications], and understand that the future will make networks vaster and vaster every day. As community networks rise, and persistent layers of multi-technology ever-present connectivity become mainstream, towards the dream of the entire network, in all its layers, being decentralised and - hopefully one day - distributed, every device will be exposed to “THE INTERNET” itself [in the sense of all other devices around it] every instant of every day, at home and also everywhere else. Home networks are a temporary fix, but should not be treated as a long term substitution for education on this topic and shifting this old and outdated frame of mind. </ot> ;] Nk On 11 August 2017 at 12:11:44, Gio (gio(a)diveni.re) wrote: On Wednesday, 9 August 2017 16:03:33 CEST Amuza wrote: Well it seems they have a curious idea of community... but i can understand it in the current situation, with media talking of "hackers" all the time... I believe it is easy to do but i won't do this by default, you could eventually create a community profile (ask Pau for the correct naming) with this enabled by default, but ATM is not on top of my priority stack Yeah, and I have answere that their computer are exposed to the internet anyway, so give a little of trust to your neighbours could be the first step to create a community It is pretty easy I would say It is not an issue, more a "feature" request I would say Cheers! _______________________________________________ lime-users mailing list lime-users(a)lists.libremesh.org https://lists.libremesh.org/mailman/listinfo/lime-users

On 11/08/17 12:11, Gio wrote: Hi, It took me a while to get Gio's point. Now I like it. However, I keep facing the problem. Some people are about to join the community network but they take a step back as soon as they know community users could get into their private network. I try to calm their media-biased worries, talk about the meaning of community and even the technical solutions, but they won't join the community network. The reality is that here we need people sharing their Internet connection. That is why I am resuming this thread and try to find a solution for this specific case. How could I configure my community network profile (files to edit, parameters...) so that community users could only access the community network and the Internet? (Let's consider the community network is 10.0.0.0/8 and the private networks to deny are 192.168.0.0/16 and 172.16.0.0/12). Thank you!

Vc poderia confirmar o endereço por favor? Estou na estrada. ⁣Enviado por BlueMail ​ Em 22 de nov de 2017 13:01, em 13:01, Ilario Gelmetti &lt;iochesonome(a)gmail.com&gt; escreveu:

Hi! On 22/11/17 16:01, Ilario Gelmetti wrote: I didn't understand the paragraph above. I created a Github issue on the network-profiles repository [0], as I keep needing this. Basically, now I am asking for help to create a network profile that simply: - Allows access to public addresses and to 10.0.0.0/8 - Denies access to any host within 192.168.0.0/16 and 172.16.0.0/12 private networks - Keep using all shared Internet gateways, including those within denied networks 192.168.0.0/16 and 172.16.0.0/12 It is not the perfect solution but it would satisfy me for the time being. But I do not know how to do it. As it looks simpler now, can I achieve it just by configuring files? Maybe by editing /etc/firewall.user? Any tip on how to do it or where to start is very much appreciated. [0] https://github.com/libremesh/network-profiles/issues/24