Be aware, when you use mesh VPN products such as, ZeroTier, Nebula or Tailscale, the company has access to your network, may add hidden nodes, and sees who is taking to who and what services they are running, which can be a privacy concern.
My comment applies only if Slack provides the lighthouse. I don’t know if it does; usually the company operates a default one for users and provides the option to self host it as well (Tailscale does not offer one, but there is third party code).
"Nebula lighthouses allow nodes to find each other, anywhere in the world. A lighthouse is the only node in a Nebula network whose IP should not change. Running a lighthouse requires very few compute resources, and you can easily use the least expensive option from a cloud hosting provider. If you're not sure which provider to use, a number of us have used $5/mo DigitalOcean droplets as lighthouses."
They spun off a company, Defined Networks, which is enhancing Nebula, and they offer a hosted CA with key rotation and push configuration updates to your fleet, currently in a kind of early beta. You still run your own lighthouses, but they are entirely in control of your CA, so they can sign certs for nodes at their will.
That could allow third parties into your networks, but I'm not sure if that would imply any ability to redirect or decrypt traffic.
It’s the same old key distribution problem; for instance, when you SSH you need to verify the authenticity of the key that is presented to you first time. You approve the wrong public key and it’s over.
This is not to say, Tailscale does that. The service is by far my favorite (Nebula is not as user friendly, and ZeroTier uses nonstandard tunneling). Tailscale is dead simple, uses Wireguard, has integration with SSO, provides ACLs, relays, good NAT traversal, good management interface and lately a lot of DERPs around the world. Just be aware of limitations (in US, they can even be forced to share the networks, even if they don’t want to).
Two other comments. These mesh networking products could use pre-shared keys to address this concern. For example, Tailscale could use Wireguard preshared keys, as an optional feature for those concerned with key distribution. I don’t know why they don’t offer this option. Also, these services are not zero trust, contrary to what they often claim on their websites (usually they twist the meaning of the term zero trust).
Under the hood nebula uses the noise protocol, the same used by wireguard.
Defined Networks version, however, completely controls your CA key, and could generate their own nodes. The config files they generate are plain text and can be inspected for "mirror traffic" configs (I don't remember if Nebula has that feature, ZeroTier does). Defined Networks has a pretty slick setup, which I can go into a bit further if there is interest, I've done an eval and ended up deciding it wasn't quite ready for our use.
Being mesh networks, one could do some examination of traffic to ensure that they aren't shipping traffic external.
With ZeroTier, there are also some "self hosted" options. I haven't dug too deeply into them. I really like ZeroTier, and wanted to use it for our work overlay network, but I'm a bit skeptical about the reliability. It's been good for my test use case, but last year they had some sort of controller outage and when I asked their sales people about it and how we might be able to run a backup controller, he said that sort of outage wasn't possible. When I asked what was meant by this specific tweet that ZeroTier sent out that said it had happened, I got no reply. :-(
ZeroTier is super slick, but I can't move our entire infrastructure over to something that could have an outage that would take out our infrastructure until some third party resolved it.
I also evaluated them, and decided I need a “zero trust” solution (well, or “less trusted” at least).
I thought ZeroTier doesn’t use a standard VPN tunneling protocol, and that’s not a best practice.
Mesh VPNs shine in small businesses with many users, where ACLs, SSO etc become useful. In home labs, a basic Wireguard server works fine.
The best solution IMHO would be to use mesh VPNs and secure inter-node connections with an additional layer of encryption. SSH and TLS should cover most use cases here, and both are widely supported and easy to set up.