Yggdrasil may help Iranian users?

[immartian]

The internet is not running so well there, net4people/bbs#484, and we can see many tools including Tor is hard to be connected without special configurations.

I wonder if Yggdrasil has a perfect use case here to enable peers to mesh and relay traffic to anywhere around the world. It means that sometimes if the extreme situations occurs, we still need to go back to first principle.

I have one Iranian friend is using my home node to browse internet now but it's ad hoc link, it's the only thing I can do but there's no idea how to scale up yet.

[neilalexander]

This question comes up quite often when global incidents occur. We have heard reports from users that Yggdrasil has been successfully used for censorship avoidance in the past, but this is more of an accident than anything and not something that we build for.

From a practical point of view, finding enough people in close proximity to one another with the technical knowledge to build real-world links and who happen to have the right hardware lying around and know about Yggdrasil to begin with would be the biggest set of challenges.

[immartian]

I make a public node for relief for whoever there wants to have a try:

Experimental Yggdrasil VPN Node

This is a small-scale, whitelisted VPN designed to support individuals in censored regions (such as Iran) by routing traffic through the encrypted Yggdrasil mesh network and a secure WireGuard tunnel.

---

Node Information

• Yggdrasil IPv6:
  206:6da3:9f2:60d2:9769:21c6:10fe:11d4
• Yggdrasil Public Key:
  0324b9ec1b3e5ad12dbc73de03dc5618f2d2d23937dbc774c36695a52fc0391d
• WireGuard VPN IP: 10.66.66.1/24
• VPN Port: 51820/UDP (accessible via Yggdrasil)

---

How to Connect (Client Instructions)

1. Install Yggdrasil

Download the latest release from:
https://github.com/yggdrasil-network/yggdrasil-go/releases

2. Configure and Bootstrap Yggdrasil

Generate a default configuration:

yggdrasil -genconf > yggdrasil.conf

Add public peers to the "Peers" section using entries from:
https://publicpeers.neilalexander.dev/

Example snippet:

"Peers": [
  "tls://public1.yggdrasil.neilalexander.dev:1234",
  "tls://de-fra1.servers.devices.yggdrasil.org:1234"
]

Start Yggdrasil:

yggdrasil -useconffile ./yggdrasil.conf

Check your Yggdrasil IPv6 address:

yggdrasilctl getself

Please share you YGG-IPV6 address at comment, upon which I can add you to whitelist.

---

Disclaimer and Usage Policy

This VPN node is operated as a personal experiment and community support tool to promote open access to information in restricted environments.

By connecting to this service, you agree to the following terms:

• Do not use this node for spam, scanning, torrenting, or other abusive activities.
• This node does not offer privacy guarantees. It is not a replacement for anonymity tools like Tor.
• Minimal connection logging may occur for abuse monitoring.
• This service is offered as-is. Availability and uptime are not guaranteed.

[tuleo1]

hello!, im from iran and i got forwarded here from your comment on the net4people
im intrested in testing this and i built it from source rn on the 0.5.12 branch.
here's the ipv6 address from the getself command.

IPv6 address: 202:d1c7:ad1a:a662:34f8:f831:c6a1:4468

tell me if there's anything else i need to do/test

[immartian]

yggdrasil -genconf > yggdrasil.conf

Add public peers to the "Peers" section using entries from:
https://publicpeers.neilalexander.dev/

you need at least put one boostrap node in .conf, e.g.

  Peers: [
    tls://192.9.143.104:443
quic://37.186.113.100:1515	
]

you should be able to ping(6) the following ipv6 if it's boostrapped, next is to config WireGuard to connect to my home node:

Yggdrasil IPv6:
206:6da3:9f2:60d2:9769:21c6:10fe:11d4
Yggdrasil Public Key:
0324b9ec1b3e5ad12dbc73de03dc5618f2d2d23937dbc774c36695a52fc0391d
WireGuard VPN IP: 10.66.66.1/24
VPN Port: 51820/UDP (accessible via Yggdrasil)

I've added you to the whitelist.

[tuleo1]

i dont belive its working, perhaps the ip is blocked or something else cause without a vpn i dont get anything at all from the log,

only after i connect a vpn i get the following line.
2025/06/23 00:01:58 Connected outbound: 200:3035:1917:6de7:1ed3:18f3:24a9:4bcc@192.9.143.104:443, source 10.71.91.202:35102

which quickly follows with this

2025/06/23 00:02:07 Disconnected outbound: 200:3035:1917:6de7:1ed3:18f3:24a9:4bcc@192.9.143.104:443, source 10.71.91.202:35102; error: read tcp 10.71.91.202:35102->192.9.143.104:443: i/o timeout

maybe some kind of firewall detects im using tor ip? (its the only vpn so far that seems to be working for me. at least that i have access to easily) but regardless thats not useful to debug

[majestrate]

if you have tor working I have a (currently) unlisted .onion yggdrasil peer you can try:

socks://127.0.0.1:9050/2cpuaaz2igmcfth4gfoh3jfbie7cysz5xjcpqdetigza7uiloc5oayyd.onion:993
sockstls://localhost:9050/2cpuaaz2igmcfth4gfoh3jfbie7cysz5xjcpqdetigza7uiloc5oayyd.onion:993

[immartian]

2025/06/23 00:02:07 Disconnected outbound: 200:3035:1917:6de7:1ed3:18f3:24a9:4bcc@192.9.143.104:443, source 10.71.91.202:35102; error: read tcp 10.71.91.202:35102->192.9.143.104:443: i/o timeout

can you try some other boostrap nodes besides of 192.9.143.104?

tcp://37.186.113.100:1514	 
tls://37.186.113.100:1515	 
quic://37.186.113.100:1515
tls://astrra.space:55535	
tls://133.18.201.69:54232	
tls://153.120.42.137:54232

[tuleo1]

ok, yeah im pretty sure theyre practically all blocked.
i tried using those said peers, without vpn nothing, not a single log in the console.
but as soon as i connected the vpn, the log connected and it did actally work and connected the outbound.

but practically useless as without vpn it doesnt work.

[immartian]

i tried using those said peers, without vpn nothing, not a single log in the console.

alright, seems it's pretty rogue blockage, you're almost certainly behind a network that blocks outbound connections on non-whitelisted ports and protocols.

the last hope is 443 peers:

wss://ygg-evn-1.wgos.org:443	
tls://g.ygg.yt:443	
tls://[2a03:90c0:85::28a]:443	
tls://45.95.202.21:443	
tls://45.147.200.202:443	
quic://pp1.ygg.sy.sa:8443	
tls://193.93.119.42:443	
tls://44.234.134.124:443	

(speading almost all nearby countries)

[tuleo1]

sigh, same thing. without vpn nothing and with vpn it starts connecting.
i checked through wireshark and the only thing i see as i filter those ip's are that it keeps trying to retransmit some kind of packet again and again.

[komyl]

👀

[majestrate]

you could try the russian peers if those ASN aren't blocked.

[tetrus93]

you can also try this one: https://github.com/ygguser/peers_updater
you just need to run a program with -p parameter and it should display the peers that are available and not blocked (yet) to you

btw, i don't think wireguard would work in this situation since wireguard connection will be prioritized first and yggdrasil connection will be broken because of this (i mean you can try make it work, but i don't think it's worth of trouble for average users)
there's acetone's outproxy service you can use for browsers (and other programs which support proxies) if you need to.