Cjdns – An encrypted IPv6 overlay network using public-key cryptography
2 points · Open discussioncjdelisle
cjdns
C2011–2025
cjdelisle / cjdns
cjdns
An encrypted IPv6 network using public-key cryptography for address allocation and a distributed hash table for routing.
74Distinct people
85Mentions
3Explicit recommenders
5.4KGitHub stars
What to know before exploring
What it is
An encrypted IPv6 network using public-key cryptography for address allocation and a distributed hash table for routing.
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
I highly recommend reading the excellent draft document from Usenet at the URL I posted, particularly the example of the "Western Wisconsin Computer Company". It is much…
feelin_googley used a recommendation phrase. 3 indexed comments match. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year85 dated mentions
Observed mentions: 2011-04-10 19:41:09 UTC to 2025-06-23 14:40:46 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2011 | 2011-01-01 00:00:00 UTC | 2012-01-01 00:00:00 UTC | 1 | 1 | 0 |
| 2012 | 2012-01-01 00:00:00 UTC | 2013-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2013 | 2013-01-01 00:00:00 UTC | 2014-01-01 00:00:00 UTC | 6 | 3 | 3 |
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 11 | 1 | 10 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 12 | 2 | 10 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 8 | 1 | 7 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 15 | 1 | 14 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 4 | 0 | 4 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 9 | 2 | 7 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 4 | 0 | 4 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 4 | 0 | 4 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 2 | 1 | 1 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
cjdns
Русская версия
Hrvatski
Svenska
Ελληνικά
Deutsch
繁體中文
简体中文
Español
Français
Português brasileiro
Networking Reinvented
Cjdns implements an encrypted IPv6 network using public-key cryptography for
address allocation and a distributed hash table for routing. This provides
near-zero-configuration networking, and prevents many of the security and
scalability issues that plague existing networks.
Testimonials
23:26 <@jercos> well, cjdns is now officially more reliable than the open
internet for getting to my cheaper VPSes :|
12:52 < mariner> so i don't know if it's been done before, and i assume it's
obvious, but I think it's neat. Currently on hype from an
airplane
00:36 < tester> man sites take so long to load on i2p
00:36 < tester> i value speed over anonymity any day
<DuoNoxSol> it's notably more reliable than the normal internet
09:46 < Kubuxu> I so love cjdns code base
<whyrusleeping> my internet is way better now.
<whyrusleeping> thanks
<whyrusleeping> i'm really upset and sad that its better
<whyrusleeping> but also quite happy
21:01 <@grewalsat> this is amazing. with my workpalce speedtest.net results I get around 6+mb speed, and with my cjdns-gate as vpn network I'm getting like 11-15mb download speed in speedtest.net
21:01 <@grewalsat> :P
21:01 <@grewalsat> plus, access anything! :D
<davidar> Yeah, I have to admit I sort of avoided hypeirc because of stuff like that
Community
irc://irc.efnet.org/#cjdns
Documentation
Project Goals
Cjdns Whitepaper
Advanced configuration:
Setup a cjdns NAT gateway for your LAN
Thank you for your time and interest,
The cjdns developers.
How to install cjdns
These instructions are for Linux distributions and macOS. They should be
informative enough for use on other distributions - just don't expect them to
work verbatim. If you want to know what operating system's base is go here.
Option 1: Using cjdns.sh
If you're on Linux with an amd64 processor (if you don't know your processor, it's amd64), you can install cjdns
pre-built binaries using cjdns.sh. See: https://github.com/cjdelisle/cjdns.sh for more information.
Option 2: Build from source
In order to compile cjdns, you must have:
Rust
NodeJS (used for building the C code)
GCC or Clang C compiler
Make (used for compiling one of the Rust dependencies)
Git (to checkout this repository)
0. Install dependencies
Debian-based distro:
sudo apt-get install nodejs git build-essential
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
Redhat-based distro:
sudo dnf install nodejs git
sudo dnf install @development-tools
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
MacOS:
Check that you have clang activated:
xcode-select --install
Install with Homebrew:
brew install node git make
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
1. Retrieve cjdns from GitHub
Clone the repository from GitHub and change to the source directory:
git clone https://github.com/cjdelisle/cjdns.git cjdns
cd cjdns
2. Build
./do
Look for Build completed successfully, type ./cjdroute to begin setup., then
proceed below:
Setup
Run cjdroute without options for HELP:
./cjdroute
0. Make sure you've got the stuff.
If you're on macOS, skip this step.
LANG=C cat /dev/net/tun
If it says: cat: /dev/net/tun: File descriptor in bad state Good!
If it says: cat: /dev/net/tun: No such file or directory, create it using:
sudo mkdir -p /dev/net &&
sudo mknod /dev/net/tun c 10 200 &&
sudo chmod 0666 /dev/net/tun
Then cat /dev/net/tun again.
If it says: cat: /dev/net/tun: Permission denied You're probably using a VPS
based on the OpenVZ virtualization platform. Ask your provider to enable the
TUN/TAP device - this is standard protocol so they should know exactly what you
need.
1. Generate a new configuration file
./cjdroute --genconf | sudo tee -a /etc/cjdroute.conf
Protect your conf file!
A lost conf file means you lost your password and
connections and anyone who connected to you will no longer be able to connect.
A compromised conf file means that other people can impersonate you on the
network.
2. Secure your system - check for listening services
Once your node is running, you're now a newly minted IPv6 host. Your operating
system may automatically reconfigure network services to use this new address.
If this is not what you intend, you should check to see that you are not
offering more services than you intended to. ;)
See doc/network-services.md for instructions.
3. Start it up!
sudo ./cjdroute < /etc/cjdroute.conf
If you want to have your logs written to a file:
sudo ./cjdroute < /etc/cjdroute.conf > cjdroute.log
To stop cjdns:
sudo killall cjdroute
If you are having problems use killall cjdroute to return to sanity. Use
pgrep cjdroute or top to see if it running.
NOTE!
This starts cjdns as the root user so it can configure your system
without concern for permissions. To start cjdns as a non-root user, see
doc/non-root-user.md.
Custom peering
By default, cjdns will reach out to a DNS seeder to find peers and will
automatically connect to them. This of course exposes the fact that you're
running cjdns to the operators of these nodes.
If you're planning on running a "clandestine" cjdns node, find the dnsSeeds
section of the configuration and comment it out. Then take the peering
credentials of a node you would like to connect to and add them to the
UDPInterface / connectTo section of the cjdroute.conf.
See doc/peering.md
Admin interface
When cjdroute is up and running, the admin interface will be available at
udp://localhost:11234 (this can be changed in the cjdroute.conf
configuration file). See doc/admin-api.md for more
information about the admin interface. There are several tools in contrib/
that can interact with it.
You can access the admin API with:
./cjdnstool
The Python library; see here.
The Perl library, maintained by Mikey; see here.
Reporting issues
Don't report in this repo, please instead report it at ht
Read the full README on GitHubWhat Hacker News says
85 sourcesEveryone is commenting on the HN headline, no one on the actual post:
> Building the New Internet
(Insert mandatory reference to Silicon Valley here :))
> We think there’s a better way forward. We're calling it identity-first networking.
I would love to see this. Every day I have to stare at YAML files with IP addresses in them is a day I will never get back. I wish cjdns[0] had succeeded already but oh well, now I hope the Tailscale guys will!
[0]: https://github.com/cjdelisle/cjdns/
In Tailscale has raised $160MThat was the original goal of cjdns, which is why it automatically peers with other nodes reachable over Ethernet (no IP needed), including WiFi (see the first paragraph of https://github.com/cjdelisle/cjdns/blob/master/doc/Whitepape...). Unfortunately, its approach to routing turned out to not scale in practice. Yggdrasil uses a different routing algorithm so it might.
In Yggdrasil Network> I remember watching many years ago a talk about a mesh network scheme where its users would unambiguously assign themselves addresses through some hash function.
Was it this one -> https://github.com/cjdelisle/cjdns/ ?
Anyway, I fully agree with you. Assigning meaningless (and therefore collision-prone and spoofable) numbers to people/machines just seems like such an arcane idea in light of all the cryptographic advances people have made.
Whatever network I configure, I always need to worry about collisions or possible misconfigurations. Whether I set up some private VPN for myself and have to worry about potential spoofed IP packets from outside, or whether I connect to a corporate VPN from home and suddenly I can no longer ping 1.1.1.1 because their IT department couldn't be bothered to configure their routes correctly. It's insane.
In Choose your own IPAlso see, cjdns (https://github.com/cjdelisle/cjdns)
(adding to the list of similar projects)
In Qaul – Internet independent wireless mesh communication appFrom a purely networking perspective, there are far better solutions than tailscale.
Have a look at full mesh VPNs like:
https://github.com/cjdelisle/cjdns
https://github.com/yggdrasil-network/yggdrasil-go
https://github.com/gsliepen/tinc
https://github.com/costela/wesher
These build actual mesh networks where every node is equal and can serve as a router for other nodes to resolve difficult network topologies (where some nodes might not be connected to the internet, but do have connections to other nodes with an internet connection — I work with networks like that every day).
Sending data through multiple routers is also possible. They also deal with nodes disappearing and change routes accordingly.
tailscale (and similar solutions like netbird) still use a bunch of "proxy servers" for that. You can set them up on intermediate nodes, but
Read the rest
that have to be dealt with manually (and you get two kinds of nodes). You also have to create routes for the node to be able to access the control server.
I'm excited about P2P/decentralized/distributed overlay networks. Still catching up so would be grateful for tips on resources.
Pinecone[0][1], newer initiative made by former Yggdrasil[2] maker(s).
CJDNS[3].
AIUI CJDNS relies on intermediary high-uptime discoverable router nodes which is what is motivating Pinecone. POKT[4][5] to CJDNS seems like what Filecoin is to IPFS.
I'm yet to get around to doing the groundwork of grokking more established solutions like B.A.T.M.A.N.,how all these pieces relate to each other and what's already possible. In particular what's realistically achievable on top of webRTC.
If you want to go real radical, well, Urbit.
[0]: https://fosdem.org/2022/schedule/event/matrix_p2p_pinecone/
[1]: https://github.com/matrix-org/pinecone
[2]: https://yggdrasil-network.github.io/
[3]: https://github.com/cjdelisle/cjdns/
Read the rest
>There's not some program you can "donate" bandwidth to and make money off of it.
There is one:
https://pkt.cash/
from the maker of https://github.com/cjdelisle/cjdns
And there is https://sia.tech/ (Network too but mostly about storage)
In Ask HN: What should I do with my unused 1Gig internet?Reminds me of cjdns
https://github.com/cjdelisle/cjdns
In Make the internet yours again with an instant mesh networkI was really excited for a moment, because I thought this was cjdns https://github.com/cjdelisle/cjdns.
In Remote code execution in cdnjs of CloudflareCjdns,
> An encrypted IPv6 network using public-key cryptography for address allocation and a distributed hash table for routing.
https://github.com/cjdelisle/cjdns
In Wiretrustee: WireGuard-Based Mesh Network> To be honest I kind of wish someone would build a proof-of-bandwidth crypto.
https://pkt.cash/ exists "built to incentivize the growth of infrastructure," and "PKT Network is designed to decentralize internet access around the world by enabling anyone to become an ISP." [0]
A key component of the PKT Network is cjdns (https://github.com/cjdelisle/cjdns).
[0]: https://pkt.cash/PKT_Network_v1.0_2021.02.01.pdf
In What is Chia cryptocurrency and why is it bad news for hard drives?To me, HTTP is the wrong target. It would be much more interesting to replace IP, like Yggdrasil does (and I think gnunet, cjdns, hyperboria & others).
If you IP is a cryptographic identifier:
* It cannot be forged
* Anyone can generate a new one on-demand
* Every packet is authenticated, every packet can be encrypted
* TLS becomes redundant
However, the DNS part remains a hard one. How to securely link to websites you have never seen? Pet names seem like a way to do so. Asking users to type IP addresses isn't really an answer, I think, but I don't know if there's a lot of "basic" users who type URLs in nowadays, they all seem to rely on google providing the right website anyway, or the web browser itself.
It's not like DNS is also our single source of trust nowadays, but at least certificate providers are competent enough to make sure na
Read the rest
mes are resolved correctly.
One option would be to make signed DNS records over a DHT: the root authority "." signs "com", "net", etc, that sign "ycombinator", etc. Publish to DHT, hash-indexed.
Of course, point-to-point connections have their weaknesses as well, it might be interesting to migrate to something like beaker browser (html on top of hypercore, formerly DAT, kind of like mutable torrents in a DHT). At the end of the day, the core issue is: migrating users is difficult if the benefits are not immediately obvious.
And yes, massively adopting anything else would litterally "kill the old web", in the protocol sense. In the community or content sense? Not so sure.
https://yggdrasil-network.github.io/
https://gnunet.org/en/
https://github.com/cjdelisle/cjdns/
https://beakerbrowser.com/
https://hypercore-protocol.org/
Also by this author:
https://github.com/cjdelisle/cjdns
cjdns was one of the early adopters of NaCl
https://nacl.cr.yp.to
https://ianix.com/pub/curve25519-deployment.html
In So you want to roll your own crypto?Networks such as cjdns and secure scuttlebutt can help you overcome this problem, but introduces new ones (or introduces different models that are not already widely deployed)
- [0] https://github.com/cjdelisle/cjdns/
- [1] https://scuttlebutt.nz/
In Why build this blog, or anything, on IPFS?Showing the 15 most recent of 85 sources. Enable JavaScript to search and browse every indexed mention.