Today I fumbled thru the install of Rayfish and Yggdrasil. Both are awesome, but Rayfish was so much easier to install and use.
Have you tried these yet?
Here’s the Yggdrasil link:
https://yggdrasil-network.github.io/
Yggdrasil has Android, Windows, Linux, Apple installers.
Rayfish only works on desktop right now, but hopefully soon they will be able to get it on Android.
You must log in or # to comment.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters CGNAT Carrier-Grade NAT DNS Domain Name Service/System ISP Internet Service Provider NAT Network Address Translation VPN Virtual Private Network VPS Virtual Private Server (opposed to shared hosting)
[Thread #53 for this comm, first seen 13th Jul 2026, 09:50] [FAQ] [Full list] [Contact] [Source code]
But rayfish is vibe coded. I’d not trust it.
Evidence?
Well aside from the obvious giveaways in the presentation format of the README.md, and .gitignore, the very first question of its FAQ is:
“You use LLMs? 🤯”
Yes. Heavily. Claude and GLM-5.2 wrote a lot of this repo.
Oooh. I can’t believe I missed that. Thanks!
It also says -
“So it’s all vibe-coded slop.”
The idea is over 4 years old: a trustless, decentralized network with no central entity that can censor who you connect with. I sketched it for years. What an LLM changed was the speed: the prototype came together in a day. The trigger was the release of iroh v1.
Make of that what you will.
Well, at least they tell you to not trust it for production in it’s current stage I guess.
Agreed, it’s not for production. For me, as an engineer, LLMs are a couple of things. One is they are killing the planet by consuming energy, dumping the smog into our communities and consuming the water we need to survive. The other way to see it is…uhh give me a funny ass picture of a cat driving a taxi with a donkey and a giraffe riding in the back…make it a 5 minute video… probably uses way more resources than… write a program that gives me network freedom, here are the specs…
Once I get this initial bit and I study it, then I should be able to develop it like any other piece of software. It’s that initial kick that helps a lot. In my experience, if you keep asking the LLM for more, your program will just suck ass more and more until you’re left with nothing working. The other problem is it makes you lazy. Why should I debug if the LLM can do it?..debug this! But instead of a debug you get a full re-write and you don’t know what changed.
So I hope they are using the LLM in a structured way. Remember, no matter what the LLM does, if you’re not a programmer who would otherwise have understood the program enough to write it, you will still not understand it. Same for the cryptography.
But LLMs are basically a librarian who can parse thru many books and predict the next word or sentence. It’s locally correct. So imagine using Google maps street view to drive your car. First you have to get the big thing…where are you at? Now, with no windows just a gps signal telling you how far you are, you turn left or right based on your own knowledge of where you want to go. Finally, you crash on obstacles like other cars, pedestrians and buildings. Each time you crash you can get out to see where you are and start again. That’s LLMs in a nutshell. But if you finally get to where you wanted to go, you have a full program for anyone else to use. Lol
Hmm 🤔
So…this is kind of like Tor, but different?
It’s a mesh VPN using exclusively IPv6 addresses in the reserved
0200::/7range.By default a new node connects to nothing. You add other nodes explicitly, typically they’d be your own devices, but the network also maintains a few public nodes that are used to facilitate communications across the entire Yggdrasil network.
When a node is connected it raises a tunnel network interface and routes
0200::/7through it. With the usual caveats (it will pick up any service that binds to all interfaces etc.)Each node can act as relay to reach nodes that aren’t directly connected – the network will compute the shortest path in that case – and this can be used to reach nodes behind CGNAT as long as there’s a path that contains at least one publicly reachable node.
All connections are end-to-end encrypted with the keys of the two end-nodes involved in it, so the relay nodes cannot eavesdrop.
That’s about it. Anything else (DNS, routing, firewalls) is the responsibility of each node.
No, this is not tor. This is networking. Imagine two computers where you can plug one to the other with an Ethernet cable that’s it. Except that you connect one at your house and I connect the other at my house. They think they are in the same network so I could browse through your files or use a local website you serve. The benefit being that I could be you and I just traveled to your country yesterday. So I plug in my computer and I can see all my files back home from your country. Neither country can spy into my system or see what I’m doing. All they can do is decide that it’s not worth having a national connection if I’m on the network. So they can unplug the entire Internet just to block me watching YouTube from Tampa while I’m in Italy.
Interesting. Never heard of it. I’ll have to do some reading.
Been using Yggdrasil for quite a while at this point, both for encrypted service communication and also as unbreakable VPN links to various places where I don’t want to have to mess about with NAT traversal.
It’s been nice to be able to just drop it onto my router, add an ALFIS DNS entry, and have all my devices just work with Yggdrasil with no additional configuration.
Never heard of it. Why should I use it instead of established systems?
Because, specially rayfish, both are encrypted peer to peer and have their own DNS and are decentralized. So no company in the middle collecting everything you do in a data center and giving it to your enemies while charging you for it.
With Rayfish you don’t even need a dynamic DNS or FQN so my FQN cost and it’s never ending complications go away. The only problem is that they don’t have an android app yet for Rayfish. For now I’m using Yggdrasil.
So no advantage over something known like Netbird and Wireguard, then
Both Rayfish and Yggdrasil are serverless and can traverse a NAT. So you can’t block them unless you unplug.
Keep in mind they can only “traverse NAT” if you have a publicly reachable node available, otherwise peering can’t complete. The Yggdrasil network maintains a handful of public nodes for this purpose, or you can set one up yourself on a VPS etc. But you still need to deal with this.
No, they are trivial to block using techniques like deep package inspection.
In addition to that, they aren’t truly decentralized (no decentralized network really is), both rely on relay/bootstrap servers to start up the connection. So, if you block the public relay/bootstrap servers, you effectively block access to the network.
Tailscale, netbird also can traverse NAT.
Iroh (the actually pretty interesting software which the vibecoded rayfish is based on) and Yggdrassil do have their uses, but evading blocks isn’t one of them.
I suppose they don’t work without having
- a coordination server of sorts
- having all the nodes on static IP
Like, if the IPs keep changing, and a device goes offline and then online, how does yggdrasil know how to reach that system?
In the Yggdrasil network any node can act as relay for other nodes. So you can get to unreachable nodes via reachable nodes, as long as there’s a possible path through the network graph.
The community also maintains a few nodes with static public addresses, specifically so they can be used as entry points into the network.
Each node has two addresses, one used for communications inside the network and one used for peering. The inner address is IPv6 allocated randomly from the reserved
0200::/7range and never changes (unless you wipe and re-configure the node). The peering address needs to be public and static, yes, but can be either IPv4 or IPv6 fwiw.You only need to peer with one such public and static address to be able to reach other nodes, as long as there’s a path to them among all the peers in the graph. If you’re taking advantage of the larger Yggdrasil network that is taken care of by the public community nodes. If you want to set up your own separate network then you need to set up at least one node with a public static address. But you can also use a domain name and do DDNS for example.
Thanks, this was quite detailed. You do need public relay nodes after all… which was what I was wondering.
My phone gets a new IP when I hop from wifi to cell but it’s still able to communicate. Supposedly rayfish has this solved too although I cannot test that since the computer is on my network but maybe I could tether something to my cellphone and test that way.
If you’re using ipv6 supposedly you don’t need to forward ports. So that means that regardless of what IP your ISP gives you, your network should survive.
f you’re using ipv6 supposedly you don’t need to forward ports.
You don’t need to forward ports but you still need to maintain network rules for each port so you can get through the firewall. And those rules need to know IPs. And if your public IPv6 prefix changes you need to update the rules.
So, really, there’s no advantage over forwarding, on the contrary, since forwarding uses private IPs which you can make static so they never change.
Some router software like OpenWRT attempts to work around this issue by using a special “minus netmask” shorthand syntax for the network rules, for example
::2/-64means you want to reach[whatever the dynamic prefix is right now]::2. Which assumes you’ve set things up so that a certain machine always gets static suffix::2, which means that machine does not do MAC anonymization and can use DHCPv6, which excludes all Android and iOS devices. So it can be used with Linux servers for example but with a lot of caveats.
I’m thinking about doing BGP+Wireguard
