Our primary requirement was simple: build an encrypted private network across multiple compute nodes. WireGuard was a natural choice for the data path, giving us a lightweight encrypted L3 tunnel between nodes.
But encryption wasn't the difficult part.
The interesting problem was discovery: given a VM's IPv6 address, how does a node figure out which other node currently hosts that VM?
WireGuard operates at Layer 3 and doesn't provide this discovery mechanism for us. One straightforward solution would be to use established components such as OVS and BGP. They're proven solutions, but they also provide far more functionality than we actually need.
We wanted to see how much simpler we could make it.
After a lot of experimentation, we ended up building the discovery mechanism around IPv6 NDP, with eBPF programs in the packet path handling validation, discovery and packet steering.
In an L2 environment, we can take advantage of NDP's natural multicast behaviour.
Things get much more interesting in an L3 routed environment, where that multicast domain no longer exists. We experimented with carrying NDP-based discovery between nodes over the routed network, effectively extending the discovery mechanism beyond the environment in which normal neighbor discovery operates.
Once the VM is discovered, the actual traffic can travel through the encrypted WireGuard mesh.
The result is a deliberately small networking stack built around:
NDP for discovery → eBPF for packet steering → WireGuard for the encrypted data path.
The talk is ultimately an experiment in taking simple Linux networking primitives and asking: how far can we push them before we need a much larger networking stack?
Understand the basics of NDP and its packet structure.
Learn about Neighbor Solicitation, Neighbor Advertisement, NDP options and the Neighbor Unreachability Detection (NUD) lifecycle.
Understand the IPv6 addressing model used by the mesh.
See how eBPF can inspect, validate and steer packets directly in the networking path.
Understand the separation between discovery and data transport in a distributed private network.
See how NDP, eBPF and WireGuard can work together to create a lightweight private mesh.
This won't only be an architecture-diagram talk.
I'll spin up actual VMs and use tools such as tcpdump to show the discovery packets and data path as they move through the network.
tcpdump
I'll also migrate a VM between nodes and demonstrate how the network discovers its new location within a fraction of a second, while looking at the packets responsible for making that happen.
The goal is for attendees to leave having seen the protocol operate on a real network, not just on slides.