Getting Started

Please note that connecting as a client or server does not provide instructions for installing the root certificate authority required for HTTPS. Please see RISENet Root CA for information on how to set this up.

As a Client

Connecting to RISENet as a client is straightforward with ST4RGATE. We use NetBird to connect, and as soon as this is set up on your device you're ready to go. Clients can only form outbound connections, they cannot host any services due to NetBird's firewall. See the instructions on joining as a server for how to get around this.

1. Install NetBird

Install NetBird from their official documentation. On Linux, this can be done with curl -fsSL https://pkgs.netbird.io/install.sh | sh, though in many cases a method more suitable to your distribution is available.

OS-Specific Links:

2. Log In

Laptop/PC

This step will depend on your device. The CLI app is the recommended way to set up access, even if you use the GUI afterwards. The command for this is shown below:

Most OSes

netbird up --management-url https://vpn.lab.st4rburn.dev

Windows

netbird up --management-url https://vpn.lab.st4rburn.dev --dns-resolver-address "127.0.0.1:53533"

(Port 53533 can likely be replaced with another unused port)

You should open this link in your browser.

Mobile

Upon opening the app, you may be able to immediately add a profile / configure the default. If not, navigate to settings. From here, you can add a profile with server value https://vpn.lab.st4rburn.dev:443 as shown below.

SSO

Upon logging in / setting up your profile, you'll an SSO page like this:

Select the 'Discord' option and log in with your Discord account. After successful authentication, you should be able to connect.

Note that for new users this will not provide immediate access. You first need to be verified. This can be done by either logging in to the account console ahead of time and being verified when your account is seen, or pinging/DMing @aurillium on Discord. If I know who you are on Discord or one of RedRoom's staff can vouch for you, I'll verify you and you will be able to access RISENet - this may require reauthenticating to the VPN.

As a Server

Connecting as a server is also relatively easy, only requiring a few additional steps.

0. Install as a Client

If you haven't already, install NetBird following the instructions above. From here, we'll allow other devices to connect to you.

1. Firewall

When you connect as a server, you will need to pass the --disable-firewall flag like so:

netbird up --management-url https://vpn.lab.st4rburn.dev --disable-firewall

If you're currently connected to the VPN, run netbird down first, then the command above.

The impact of this flag in this environment is very low, as your host will only be able to directly peer with ST4RGATE's router, which should prevent any non-RISENet traffic reaching you.

If you want to certain however, the following nftables rules will block all traffic which does not come from RISENet on the NetBird interface (wt0 unless otherwise specified).

table inet filter {
    chain input {
        type filter hook input priority 0;
        policy accept;

        iifname "wt0" ct state established,related accept
        iifname "wt0" ip6 saddr fdb3:7561::/32 accept
        iifname "wt0" ip4 saddr 10.128.0.0/10 accept
        iifname "wt0" drop
    }
}

This allows you to initiate outbound connections (traffic for already started connections is allowed through ct state established,related), and allows all RISENet IP addresses inbound, but blocks everything else.

2. IP Address

Most ST4RGATE connections are currently NATed, meaning the IP address you see via ip addr / ifconfig / ipconfig does not match that which clients can find you on. The simplest way to work out your RISENet IP address is to visit or query https://ip.risenet. The web version is able to show both your IPv4 and IPv6 address, but the CLI version will just show the address you connected with. If you need to get both IP addresses programmatically, you can use https://ip4.risenet and https://ip6.risenet.