Skip to main content

Connecting

Access to the ISC³ machines (Carnaval and Rumba) goes through the NetBird VPN: you log in with your personal account and enroll your own devices — no config file to carry around. (The CALC@HEI research nodes are reached directly over SSH instead — see Connecting to CALC@HEI.)

Getting connected​

The NetBird client connects you to the datacenter after a normal login — the service page describes how it works under the hood.

  1. You sign in with your SWITCH edu-ID account. If there's a problem saying that you are not enrolled, ask the staff to add you to the ISC³ roster.
  2. Install the client for your platform: docs.netbird.io/get-started/install (Windows, macOS, Linux, iOS, Android).
  3. Connect it to our server — not the default NetBird cloud:
    • GUI clients: in the settings, set the management URL to https://vpn.isc-vs.ch.
    • Command line: netbird up --management-url https://vpn.isc-vs.ch
  4. A browser window opens — sign in, and you're connected. Enrolling a second device is the same procedure; each device gets its own key automatically.

What you can reach depends on your groups — Your access lists them. Your Internet traffic does not go through the VPN and only the ISC³ networks are routed through it.

For more information, see the access model.

note

NetBird only needs outbound TCP 443, so it works from networks where a classic VPN's UDP is blocked. Lost device? Tell the staff — blocking your account (or just that device) is instant.

Checking that it works​

With NetBird connected, the machine names resolve (the .isc3 domain is served through the tunnel) and SSH works directly:

ping gpu0                       # the lab VM your teacher named — gpu0 here
ssh firstname.lastname@gpu0     # by name, or by the address given with it

The lab VM names change with the course (how they are allocated); access is SSH-key-based, as explained in Getting access.

Troubleshooting​

  • Your edu-ID login succeeds but ends on an error page — you are not enrolled yet (or no longer): VPN access requires being on the ISC roster, not just having an edu-ID. The error page says so and names the contact — ask the staff to be enrolled.
  • Connected but nothing is reachable — check netbird status --detail: it must list the datacenter networks and Nameservers: 1/1 Available. If it does and SSH still fails, your account is probably not in the right group yet — ask the staff.
  • Names don't resolve but IPs work — same check as above (nameservers); reconnect the client to pick up fresh settings (netbird down && netbird up, or toggle in the GUI).
  • Some local devices became unreachable after connecting — an address clash: if your home LAN also uses 192.168.88.x or 192.168.91.x, the tunnel routes shadow those devices while it's up — ask the staff for advice.