Networking Azure

EasyTier on Ubuntu 24.04 on Azure User Guide

| Product: EasyTier 2.6.4 on Ubuntu 24.04 LTS on Azure

Overview

This guide covers the deployment and configuration of EasyTier on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. EasyTier is a simple, fast and decentralized mesh VPN and SD WAN built in Rust. Instead of routing everything through a central concentrator, every EasyTier node is a peer that discovers the others and forms direct, encrypted, point to point tunnels, falling back to relaying only when a direct path is impossible. The result is one flat virtual private network that spans your on premises machines, cloud instances and remote sites, with low latency because traffic takes the shortest path rather than hair pinning through a gateway.

The image installs EasyTier 2.6.4 from the official prebuilt release binaries, run under systemd as the easytier.service mesh node. The node is managed with the easytier-cli command line tool over a loopback only RPC port, so the management interface is never exposed to the network. The peer to peer mesh transport listens on port 11010 over both TCP and UDP, which is the only network facing surface the image opens besides SSH. There is no web interface and no database: the flat /etc/easytier/config.toml is the whole configuration.

Secure by default — no known credentials. A node joins a network purely by knowing that network's name and secret, so a shared or default secret would let anyone join your mesh. This image avoids that: on the first boot of every VM a one shot service generates a unique network name and a strong random network secret for this VM alone, writes them to a root only credentials file, binds the management RPC port to loopback, and only then starts the node. You retrieve your per instance network name and secret and use them to join your other machines to the mesh.

What is included:

  • EasyTier 2.6.4 from the official prebuilt release binaries (easytier-core and easytier-cli), run under systemd as easytier.service

  • A decentralized full mesh with direct peer to peer tunnels and automatic relay fallback, with UDP and TCP NAT traversal so nodes behind NAT still connect directly

  • End to end encryption keyed by your private network secret

  • The peer to peer transport on 0.0.0.0:11010 (TCP and UDP) — the only network facing port besides SSH

  • A loopback only management port (127.0.0.1:15888) that easytier-cli uses to read peer and route tables, never reachable from the network

  • A unique per instance network name and secret generated on first boot, written to /root/easytier-credentials.txt (root only)

  • A built in mesh self test (/opt/easytier/mesh-selftest.sh) that proves the node forms a real tunnel, self contained on the one VM

Prerequisites

  • Active Azure subscription, SSH public key, VNet + subnet in target region

  • Subscription to the EasyTier listing on Azure Marketplace

  • Network Security Group rules allowing TCP 22 (admin) and TCP 11010 and UDP 11010 (the peer to peer mesh transport) from the peers that will join the network

Recommended virtual machine size: Standard_B2s (2 vCPU, 4 GB RAM) is ample for a mesh hub or a small to medium network. EasyTier is a lightweight Rust daemon; larger sizes are only needed for very high throughput relaying.

Step 1: Deploy from the Azure Portal

Search EasyTier in Marketplace, select the cloudimg publisher, and click Create. Configure the Network Security Group to allow TCP 11010 and UDP 11010 from the peers that will join this network, and TCP 22 for administration. UDP 11010 is the primary path (it enables direct NAT hole punching); TCP 11010 is the fallback for restrictive networks.

Step 2: Deploy from the Azure CLI

RG="mesh-prod"; LOCATION="eastus"; VM_NAME="easytier1"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/easytier-ubuntu-24-04/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 11010 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1002

Step 3: First boot — retrieve your per instance network name and secret

On first boot the image generates a unique network name and a strong random network secret for this VM, renders /etc/easytier/config.toml with those values and this node's virtual IP, resolves this VM's public IP for the peer join endpoint, writes the root only credentials file, and starts easytier. This completes within seconds. SSH in as azureuser and read the credentials:

sudo cat /root/easytier-credentials.txt

The file records your per instance network_name and network_secret (the key that admits peers), this node's virtual_ipv4, and the node_endpoint (<public-ip>:11010) that your other machines connect to. Keep the network secret private — anyone who has it can join your mesh.

Step 4: Confirm the node is running

easytier.service is active, easytier-core --version reports 2.6.4, and ss confirms the node is listening on :11010 for the peer to peer transport (TCP and UDP) while the management RPC port is bound to loopback only.

systemctl is-active easytier.service
/opt/easytier/easytier-core --version
sudo ss -tulnp | grep -E ':11010|:15888'

easytier.service reports active, easytier-core reports version 2.6.4, and ss shows the node listening on port 11010 for the peer to peer transport over both TCP and UDP on all interfaces while the management RPC port 15888 is bound only to the loopback interface 127.0.0.1

Step 5: Inspect this node

easytier-cli talks to the node over the loopback management port. easytier-cli node shows this node's virtual IP, its public IP, its peer id and its listeners.

sudo /opt/easytier/easytier-cli node

The virtual IP (10.144.144.1/24 by default) is this node's address inside the mesh. Every node you add gets a distinct virtual IP in the same range, and every node can reach every other node over its virtual IP once it has joined.

Step 6: Prove the mesh forms — run the self test

The image ships a mesh self test that starts a second, short lived EasyTier node in an isolated network namespace, joins it to the same network as this node, and pings across the two virtual IPs to prove a real peer to peer tunnel carries traffic — all self contained on this one VM, with no external peers required.

sudo /opt/easytier/mesh-selftest.sh

It prints MESH_SELFTEST_OK when the tunnel forms and the cross tunnel ping succeeds in both directions. Under the hood it confirms both nodes see each other as connected peers.

the easytier-cli peer table lists the connected test peer at virtual IP 10.144.144.250 with a finite latency and a direct p2p tunnel, and the mesh self test prints that the tunnel formed between 10.144.144.1 and 10.144.144.250 with the cross virtual IP ping succeeding in both directions

You can inspect the mesh routing table the same way, which shows the virtual IP of every reachable node and the next hop the node uses to reach it.

sudo /opt/easytier/easytier-cli route

the easytier-cli route table lists the virtual IPs of the nodes in the mesh with their next hop, and a ping across the tunnel from one virtual IP to the other returns replies, proving the encrypted peer to peer tunnel is carrying data traffic

Step 7: Join a second machine to the mesh

To grow the mesh, install the free EasyTier client on another machine (or launch another of these images) and join it to the same network name and secret, pointing it at this node's public endpoint. Read your network_name, network_secret and node_endpoint from /root/easytier-credentials.txt (Step 3), then on the other machine run:

sudo easytier-core \
  --network-name <EASYTIER_NETWORK_NAME> \
  --network-secret <EASYTIER_NETWORK_SECRET> \
  --ipv4 10.144.144.2 \
  --peers tcp://<public-ip>:11010 \
  --rpc-portal 127.0.0.1:15888

Give the second node a distinct virtual IP (10.144.144.2 here). Once it connects, each node can reach the other over its virtual IP — for example ping 10.144.144.1 from the second machine. Because both nodes share the same secret, all traffic between them is authenticated and encrypted end to end. Add as many nodes as you like; the network is a full mesh, so every node talks directly to every other node wherever a direct path exists.

Step 8: Secure by default

This image ships with no known credentials. The network secret — the key that admits peers — is generated uniquely per VM at first boot and stored root only. The management RPC port that easytier-cli uses is bound to loopback only, so it can never be reached from the network, and mesh traffic is encrypted with your secret. The only network facing surface besides SSH is the peer to peer transport on port 11010.

sudo ss -tulnp | grep 15888
sudo grep -E 'enable_encryption|network_name' /etc/easytier/config.toml

ss shows the management RPC port 15888 bound only to the loopback address 127.0.0.1 and never to 0.0.0.0, and the config.toml shows encryption enabled with the unique per instance network name, confirming the node is secure by default with no network reachable management interface and no shared credential

Step 9: Rotate the network secret

To rotate the secret (for example if it may have leaked), generate a new one, update [network_identity] in /etc/easytier/config.toml on every node in the network, and restart the service. All nodes must share the same name and secret to stay in one network.

NEW_SECRET="$(openssl rand -hex 24)"
echo "New network secret: $NEW_SECRET"
sudo sed -i "s/^network_secret = .*/network_secret = \"$NEW_SECRET\"/" /etc/easytier/config.toml
sudo systemctl restart easytier.service

Apply the same new secret to your other nodes so they can rejoin.

Troubleshooting

  • A peer will not connect. Confirm the NSG allows UDP 11010 and TCP 11010 from the peer, and that both nodes use the identical network name and secret. Check sudo /opt/easytier/easytier-cli peer on both sides.

  • Check node health. sudo /opt/easytier/easytier-cli node dumps this node's own state; sudo /opt/easytier/easytier-cli peer lists connected peers with latency; sudo systemctl status easytier and sudo journalctl -u easytier show service logs.

  • NAT traversal. EasyTier prefers a direct UDP tunnel and falls back to TCP, then to relaying through another reachable node. Opening UDP 11010 gives the best chance of a direct, low latency path.

Support

cloudimg provides 24/7 technical support for this EasyTier image. Our engineers help with mesh address planning, joining machines, clouds and sites, exposing LAN subnets with the subnet proxy, NAT traversal and relay tuning, firewall and NSG rules, monitoring, and EasyTier version upgrades. Critical issues receive a one hour average response time. Contact support@cloudimg.co.uk.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.