Skip to main content

Connecting

Access to the ISC³ machines (Calypso and Rumba) goes through the NetBird VPN: you log in with your personal account and enroll your own devices — no config file to carry around. (The CALC@HEI research nodes are reached directly over SSH instead — see Connecting to CALC@HEI; holders of a legacy wgXXX.conf file: see WireGuard (legacy).)

Getting connected​

The NetBird client connects you to the datacenter after a normal login — the service page describes how it works under the hood.

  1. Ask the staff to enroll you — there is no password to receive: once you're on the ISC roster, you sign in with your SWITCH edu-ID account.
  2. Install the client for your platform: docs.netbird.io/get-started/install (Windows, macOS, Linux, iOS, Android).
  3. Connect it to our server — not the default NetBird cloud:
    • GUI clients: in the settings, set the management URL to https://vpn.isc-vs.ch.
    • Command line: netbird up --management-url https://vpn.isc-vs.ch
  4. A browser window opens — sign in, and you're connected. Enrolling a second device is the same procedure; each device gets its own key automatically.

What you can reach depends on your groups (most people: the calypso nodes and lab VMs; staff with extra entitlements: more) — see the access model. Your Internet traffic does not go through the VPN.

note

NetBird only needs outbound TCP 443, so it works from networks where a classic VPN's UDP is blocked. Lost device? Tell the staff — blocking your account (or just that device) is instant.

Checking that it works​

With NetBird connected, the machine names resolve (the .calypso domain is served through the tunnel) and SSH works directly:

ping calypso0                       # the first compute node must answer
ssh firstname.lastname@calypso0     # by name, or by IP: 192.168.91.10

The node addresses are listed on the ISC³ network page; access is SSH-key-based, as explained in Getting access.

Troubleshooting​

  • Your edu-ID login succeeds but ends on an error page — you are not enrolled yet (or no longer): VPN access requires being on the ISC roster, not just having an edu-ID. The error page says so and names the contact — ask the staff to be enrolled.
  • Connected but nothing is reachable — check netbird status --detail: it must list the datacenter networks and Nameservers: 1/1 Available. If it does and SSH still fails, your account is probably not in the right group yet — ask the staff.
  • Names don't resolve but IPs work — same check as above (nameservers); reconnect the client to pick up fresh settings (netbird down && netbird up, or toggle in the GUI).
  • Some local devices became unreachable after connecting — an address clash: if your home LAN also uses 192.168.88.x or 192.168.91.x, the tunnel routes shadow those devices while it's up — ask the staff for advice.