EasyTier 2.6.4

Option A: AWS Marketplace console

• Open the SecureAnyCloud Hardened WireGuard VPN & VPN, Proxy and Remote Access AMIs listing on AWS Marketplace. Choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• When the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace, or Launch from EC2 Console for the full launch wizard. In Version, choose EasyTier 2.6.4 on Ubuntu 24.04, then choose your Region.
• Pick an instance type and your key pair. m5.large is recommended, and the software charge is $0.04 per vCPU per hour.
• Review the security group. The listing's default group allows SSH (22) only, so restrict SSH to your own IP address. You open the mesh port to your peers in Step 5.
• Choose a subnet with internet access and a public IP. Leave the metadata defaults, because the image already requires IMDSv2. Then choose Launch.

Option B: AWS CLI

Run these commands on your own workstation. They create a security group that allows SSH from your management address and the EasyTier port from your peers, then launch the instance. Replace the AMI ID with the one shown for your Region on the Marketplace launch page. Replace the VPC, subnet, key pair and address ranges with your own.

SG=$(aws ec2 create-security-group --group-name easytier \
  --description "EasyTier mesh VPN node" --vpc-id vpc-0123456789abcdef0 \
  --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 22 --cidr <your-mgmt-cidr>
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 11010 --cidr <your-peer-cidr>
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol udp --port 11010 --cidr <your-peer-cidr>
aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids "$SG" \
  --subnet-id subnet-0123456789abcdef0 \
  --associate-public-ip-address \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=easytier}]'

You do not need --metadata-options, because the AMI already requires IMDSv2.

Connect as ubuntu with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ubuntu@<public-ip>

First boot finishes within a minute of launch. It generates the network name and secret, writes the configuration, loads the metadata guard and starts the node. The details are in /root/easytier-credentials.txt, which only root can read. Run this command to show everything except the secret:

sudo grep -v '^easytier.network_secret=' /root/easytier-credentials.txt

# EasyTier 2.6.4 - generated on first boot by easytier-firstboot.service.
# The network secret below admits peers into this instance's private mesh. It was generated on this instance # and no other instance shares it. Keep this file private. To join another machine, install EasyTier on it # and run it with the same network name and secret, pointing it at this node (see the guide): # https://secureanycloud.com/stacks/easytier-2-6-4/ easytier.network_name=sac-16aa85de60b2 easytier.virtual_ipv4=10.144.144.1 easytier.node_endpoint=52.204.42.8:11010 easytier.private_ipv4=172.31.82.234 easytier.rpc_portal=127.0.0.1:15888 easytier.config=/etc/easytier/config.toml easytier.self_test=sudo easytier-selftest

easytier.node_endpoint is the address your peers connect to. It is the instance's public IPv4, or the private one if the instance has none. Your values will differ. Print the secret when you set up a peer:

sudo grep '^easytier.network_secret=' /root/easytier-credentials.txt | cut -d= -f2-

Confirm that the node and the metadata guard are active. The node listens on 11010 over TCP and UDP (IPv4 and IPv6), and its management portal listens on loopback only:

systemctl is-active easytier.service sac-easytier-guard.service /opt/easytier/easytier-core --version sudo ss -Htulnp 'sport = :11010 or sport = :15888' | awk '{print $1, $5}'

active active easytier-core 2.6.4-8428a89d udp 0.0.0.0:11010 udp [::]:11010 tcp 0.0.0.0:11010 tcp 127.0.0.1%lo:15888 tcp [::]:11010

Use easytier-cli to inspect the node itself: its mesh address, its public address and NAT type as STUN sees them, and its listeners.

sudo /opt/easytier/easytier-cli node | grep -E 'Virtual IP|Public IPv4|UDP Stun Type|Listener'

| Virtual IP | 10.144.144.1/24 | | Public IPv4 | 52.204.42.8 | | UDP Stun Type | PortRestricted | | Listener 1 | tcp://0.0.0.0:11010 | | Listener 2 | tcp://[::]:11010 | | Listener 3 | udp://0.0.0.0:11010 | | Listener 4 | udp://[::]:11010 |

Run the shipped self-test to prove the mesh end to end without any machine of yours. It starts a second, short-lived EasyTier node in an isolated network namespace, using this instance's network name and secret. It then checks that:

• the test node joins over the encrypted tunnel
• pings across the two mesh addresses succeed in both directions
• neither the test node nor the node itself can reach the instance metadata service through the mesh

The self-test prints no secret and cleans up after itself:

sudo easytier-selftest

ok: easytier.service is active (pid 5128) ok: management RPC portal on 127.0.0.1:15888 only ok: metadata guard loaded (forward drop for 169.254.169.254, 168.63.129.16, fd00:ec2::254) ok: a test node joined over the encrypted tunnel; ping 10.144.144.1 <-> 10.144.144.250 answers in both directions ok: both nodes list each other as peers (easytier-cli peer list) ok: metadata: 169.254.169.254 is unreachable from a mesh peer through this node ok: metadata: 169.254.169.254 is unreachable from inside easytier.service SELFTEST_OK

Peers outside the VPC connect to easytier.node_endpoint on port 11010. Open TCP and UDP 11010 in the instance's security group to your peers' addresses, such as your office and your other clouds. Use 0.0.0.0/0 only if your peers have no fixed address.

The network secret keeps strangers out, and private mode refuses other networks. A narrow rule also keeps scanners away from the port:

aws ec2 authorize-security-group-ingress --group-id <your-sg> --protocol tcp --port 11010 --cidr <your-peer-cidr>
aws ec2 authorize-security-group-ingress --group-id <your-sg> --protocol udp --port 11010 --cidr <your-peer-cidr>

To open no inbound port at all, let the node connect out to a peer that has one instead (Step 8).

Install EasyTier on the machine you want to add. Downloads for Linux, Windows, macOS, Android and others are on the EasyTier releases page, and the desktop and mobile apps take the same network name, secret and peer address.

On a Linux machine, use a configuration file rather than putting the secret on the command line. Give every node its own mesh address:

curl -fsSLO https://github.com/EasyTier/EasyTier/releases/download/v2.6.4/easytier-linux-x86_64-v2.6.4.zip unzip easytier-linux-x86_64-v2.6.4.zip
sudo install -d -m 0700 /etc/easytier
sudo tee /etc/easytier/config.toml >/dev/null <<'EOF' ipv4 = "10.144.144.2" [network_identity] network_name = "<network-name>" network_secret = "<network-secret>" [[peer]] uri = "tcp://<node-endpoint>" [flags] private_mode = true EOF
sudo chmod 600 /etc/easytier/config.toml
sudo ./easytier-linux-x86_64/easytier-core -c /etc/easytier/config.toml --console-log-level warn

Replace <network-name>, <network-secret> and <node-endpoint> with the values from Step 2. Use udp:// instead of tcp:// if you prefer the UDP transport.

Within a few seconds the two machines reach each other on 10.144.144.1 and 10.144.144.2. When a third machine joins, the nodes connect to each other directly where they can (hole punching) and relay through this node where they cannot.

On the instance, the peer and route tables list every node of your network. On a new instance, only the node itself appears:

sudo /opt/easytier/easytier-cli peer list
sudo /opt/easytier/easytier-cli route list | cut -c1-110

| ipv4 | hostname | cost | lat(ms) | loss | rx | tx | tunnel | NAT | version | |-----------------|------------------|-------|---------|------|----|----|--------|----------------|----------------| | 10.144.144.1/24 | ip-172-31-82-234 | Local | - | - | - | - | - | PortRestricted | 2.6.4-8428a89d | | ipv4 | hostname | proxy_cidrs | next_hop_ipv4 | next_hop_hostname | next_hop_lat | path_len | |-----------------|------------------|-------------|---------------|-------------------|--------------|----------| | 10.144.144.1/24 | ip-172-31-82-234 | | - | Local | 0 | 0 |

Only root may use the management portal. Any other user is refused:

sudo -u nobody /opt/easytier/easytier-cli node >/dev/null 2>&1 || echo "refused for a non-root user"

refused for a non-root user

The node's configuration is /etc/easytier/config.toml, readable only by root. Edit it, then restart the node. The start-up check refuses a configuration without a real network identity:

sudo nano /etc/easytier/config.toml
sudo systemctl restart easytier

To have the node connect out to a peer that accepts connections, add a [[peer]] section, for example uri = "tcp://<peer-public-ip>:11010", and restart. This instance then needs no inbound port.

These features are off on this image. Enable them deliberately.

• Subnet proxy: lets your peers reach addresses in your VPC, or in another network this instance can reach, through the mesh. Add a [[proxy_network]] section with cidr = "<subnet-cidr>", restart, and allow this instance in the security groups of the targets. Peers learn the route automatically.
• Exit node: set enable_exit_node = true in [flags] and restart. A peer then uses the exit node with exit_nodes = ["10.144.144.1"] in its own configuration.
• Your own STUN servers: add a top-level line such as stun_servers = ["stun.l.google.com:19302"] before the first [section], and restart. Use stun_servers_v6 for IPv6.

Even with a subnet proxy or exit node on, and with IP forwarding enabled, no peer can reach the instance metadata service through the node (Step 10).

The node cannot reach the metadata service, and the guard drops every packet the kernel would forward to it. The guard's counters record any attempt:

systemctl show -p IPAddressDeny easytier.service
sudo easytier-imds-guard show

IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32 table inet sac_easytier { chain forward { type filter hook forward priority filter - 10; policy accept; ip daddr { 168.63.129.16, 169.254.169.254 } counter packets 0 bytes 0 drop ip6 daddr fd00:ec2::254 counter packets 0 bytes 0 drop } chain output { type filter hook output priority filter - 10; policy accept; oifname "lo" tcp dport 15888 meta skuid != 0 counter packets 0 bytes 0 reject with tcp reset } }

The guard is re-applied when nftables.service restarts, and easytier.service will not run without it.

easytier.service runs only when first boot's ready marker exists and only together with the guard. Every start runs a check as root first. The files that hold the network secret are readable only by root. Inspect the unit and the file permissions:

systemctl cat easytier.service | grep -E '^(ConditionPathExists|Requires|ExecStartPre|ExecStart|CapabilityBoundingSet)='
sudo stat -c '%a %U:%G %n' /root/easytier-credentials.txt /etc/easytier /etc/easytier/config.toml
sudo sed -n '/^\[flags\]/,$p' /etc/easytier/config.toml | grep -v '^#'

Requires=sac-easytier-guard.service ConditionPathExists=/var/lib/sac/data/easytier-ready ExecStartPre=+/usr/local/sbin/easytier-preflight ExecStart=/opt/easytier/easytier-core -c /etc/easytier/config.toml --rpc-portal 127.0.0.1:15888 --console-log-level warn CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_NET_BIND_SERVICE 600 root:root /root/easytier-credentials.txt 700 root:root /etc/easytier 600 root:root /etc/easytier/config.toml [flags] dev_name = "et0" default_protocol = "tcp" enable_encryption = true enable_ipv6 = true private_mode = true disable_quic_input = true disable_upnp = true enable_exit_node = false proxy_forward_by_system = false

To replace the network name and secret, for example after a peer machine is lost, run first boot again. It creates a new identity, rewrites the configuration and the credentials file, and restarts the node. Every peer then needs the new values:

sudo systemctl stop easytier.service
sudo rm -f /var/lib/sac/data/easytier-firstboot.done /var/lib/sac/data/easytier-ready
sudo systemctl restart easytier-firstboot.service systemctl is-active easytier.service
sudo grep '^easytier.network_name=' /root/easytier-credentials.txt | cut -c1-31

active easytier.network_name=sac-

journalctl -u easytier shows warnings and errors. To troubleshoot, you can run the node at --console-log-level info in a drop-in for easytier.service. At that level, EasyTier writes its whole configuration, network secret included, into the journal when it starts. Switch back to warn afterwards, and generate a new identity (Step 12) if anyone else can read the journal.

• Keep SSH open only to your management addresses, and open port 11010 only to your peers where you can.
• Treat the network secret like a password. Share it only with machines you control, keep peer configuration files at mode 0600, and generate a new identity (Step 12) if the secret is exposed.
• Keep private mode on unless you deliberately want to run a public relay.
• Give every node its own mesh address. Use EasyTier's ACL options if some peers must not reach others.
• Leave unattended security upgrades on. EasyTier is two binaries in /opt/easytier, and SecureAnyCloud ships updated versions as new versions of this listing.