60 lines
2.5 KiB
Markdown
60 lines
2.5 KiB
Markdown
---
|
|
title: Securing Connections Across Untrusted Networks
|
|
menu_order: 80
|
|
---
|
|
|
|
|
|
To connect containers across untrusted networks, Weave Net peers can be instructed to encrypt traffic by supplying a `--password` option or by using the `WEAVE_PASSWORD` environment variable during `weave launch`.
|
|
|
|
For example:
|
|
|
|
host1$ weave launch --password wfvAwt7sj
|
|
|
|
or
|
|
|
|
host1$ export WEAVE_PASSWORD=wfvAwt7sj
|
|
host1$ weave launch
|
|
|
|
>**NOTE**: The command line option takes precedence over the environment variable._
|
|
|
|
> To avoid leaking your password via the kernel process table or your
|
|
> shell history, we recommend you store it in a file and capture it
|
|
> in a shell variable prior to launching weave: `export
|
|
> WEAVE_PASSWORD=$(cat /path/to/password-file)`
|
|
|
|
To guard against dictionary attacks, the password needs to be reasonably strong with at least 50 bits of entropy is recommended. An easy way to generate a random password that satisfies this requirement is:
|
|
|
|
< /dev/urandom tr -dc A-Za-z0-9 | head -c9 ; echo
|
|
|
|
The same password must be specified for all Weave Net peers, by default both control and data plane traffic will then use authenticated encryption.
|
|
|
|
[Fast datapath](/site/using-weave/fastdp.md) does not support
|
|
encryption. If you supply a password at `weave launch`, Weave Net
|
|
falls back to the slower `sleeve` mode for encrypted communication.
|
|
|
|
As an optimization, you can selectively disable data plane encryption
|
|
if some of your peers are co-located in a trusted network, for example
|
|
within the boundary of your own data center. List these networks using
|
|
the `--trusted-subnets` argument with `weave launch`:
|
|
|
|
weave launch --password wfvAwt7sj --trusted-subnets 10.0.2.0/24,192.168.48.0/24
|
|
|
|
If *both* peers at the end of a connection consider the other to be in
|
|
a trusted subnet, Weave Net attempts to establish fast datapath
|
|
connectivity, which is unencrypted. Otherwise communication is encrypted which
|
|
imposes overheads.
|
|
|
|
Configured trusted subnets are shown in [`weave status`](/site/troubleshooting.md#weave-status).
|
|
|
|
Be aware that:
|
|
|
|
* Containers will be able to access the router REST API if fast datapath is disabled. You can prevent this by setting:
|
|
[`icc=false`](https://docs.docker.com/engine/userguide/networking/default_network/container-communication/#communication-between-containers).
|
|
* Containers are able to access the router control and data plane
|
|
ports, but this can be mitigated by enabling encryption.
|
|
|
|
**See Also**
|
|
|
|
* [Weave Encryption](/site/how-it-works/encryption.md)
|
|
* [Using Fast Datapath](/site/using-weave/fastdp.md)
|