diff --git a/.github/workflows/smoke.yml b/.github/workflows/smoke.yml
new file mode 100644
index 0000000..71accea
--- /dev/null
+++ b/.github/workflows/smoke.yml
@@ -0,0 +1,34 @@
+name: smoke
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+jobs:
+
+  smoke:
+    name: Run 3 node smoke test
+    runs-on: ubuntu-latest
+    steps:
+
+    - name: Set up Go 1.13
+      uses: actions/setup-go@v1
+      with:
+        go-version: 1.13
+      id: go
+
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@v1
+
+    - name: build
+      run: make
+
+    - name: setup docker image
+      working-directory: ./.github/workflows/smoke
+      run: ./build.sh
+
+    - name: run smoke
+      working-directory: ./.github/workflows/smoke
+      run: ./smoke.sh
+
+    timeout-minutes: 10
diff --git a/.github/workflows/smoke/.gitignore b/.github/workflows/smoke/.gitignore
new file mode 100644
index 0000000..796b96d
--- /dev/null
+++ b/.github/workflows/smoke/.gitignore
@@ -0,0 +1 @@
+/build
diff --git a/.github/workflows/smoke/Dockerfile b/.github/workflows/smoke/Dockerfile
new file mode 100644
index 0000000..db9b34f
--- /dev/null
+++ b/.github/workflows/smoke/Dockerfile
@@ -0,0 +1,5 @@
+FROM debian:buster
+
+ADD ./build /
+
+ENTRYPOINT ["/nebula"]
diff --git a/.github/workflows/smoke/build.sh b/.github/workflows/smoke/build.sh
new file mode 100755
index 0000000..2841b8d
--- /dev/null
+++ b/.github/workflows/smoke/build.sh
@@ -0,0 +1,24 @@
+#!/bin/sh
+
+set -e -x
+
+rm -rf ./build
+mkdir ./build
+
+(
+    cd build
+
+    cp ../../../../nebula .
+    cp ../../../../nebula-cert .
+
+    HOST="lighthouse1" AM_LIGHTHOUSE=true ../genconfig.sh >lighthouse1.yml
+    HOST="host2" LIGHTHOUSES="192.168.100.1 172.17.0.2:4242" ../genconfig.sh >host2.yml
+    HOST="host3" LIGHTHOUSES="192.168.100.1 172.17.0.2:4242" ../genconfig.sh >host3.yml
+
+    ./nebula-cert ca -name "Smoke Test"
+    ./nebula-cert sign -name "lighthouse1" -ip "192.168.100.1/24"
+    ./nebula-cert sign -name "host2" -ip "192.168.100.2/24"
+    ./nebula-cert sign -name "host3" -ip "192.168.100.3/24"
+)
+
+docker build -t nebula:smoke .
diff --git a/.github/workflows/smoke/genconfig.sh b/.github/workflows/smoke/genconfig.sh
new file mode 100755
index 0000000..cc9a3f2
--- /dev/null
+++ b/.github/workflows/smoke/genconfig.sh
@@ -0,0 +1,60 @@
+#!/bin/sh
+
+set -e
+
+
+if [ "$STATIC_HOSTS" ] || [ "$LIGHTHOUSES" ]
+then
+  echo "static_host_map:"
+  echo "$STATIC_HOSTS" | while read -r NEBULA_IP STATIC
+  do
+    [ -z "$NEBULA_IP" ] || echo "  '$NEBULA_IP': ['$STATIC']"
+  done
+  echo "$LIGHTHOUSES" | while read -r NEBULA_IP STATIC
+  do
+    [ -z "$NEBULA_IP" ] || echo "  '$NEBULA_IP': ['$STATIC']"
+  done
+  echo
+fi
+
+lighthouse_hosts() {
+  if [ "$LIGHTHOUSES" ]
+  then
+    echo
+    echo "$LIGHTHOUSES" | while read -r NEBULA_IP STATIC
+    do
+      echo "    - '$NEBULA_IP'"
+    done
+  else
+    echo "[]"
+  fi
+}
+
+cat <<EOF
+pki:
+  ca: /ca.crt
+  cert: /${HOST}.crt
+  key: /${HOST}.key
+
+lighthouse:
+  am_lighthouse: ${AM_LIGHTHOUSE:-false}
+  hosts: $(lighthouse_hosts)
+
+listen:
+  host: 0.0.0.0
+  port: ${LISTEN_PORT:-4242}
+
+tun:
+  dev: ${TUN_DEV:-nebula1}
+
+firewall:
+  outbound:
+    - port: any
+      proto: any
+      host: any
+
+  inbound:
+    - port: any
+      proto: any
+      host: any
+EOF
diff --git a/.github/workflows/smoke/smoke.sh b/.github/workflows/smoke/smoke.sh
new file mode 100755
index 0000000..591922c
--- /dev/null
+++ b/.github/workflows/smoke/smoke.sh
@@ -0,0 +1,34 @@
+#!/bin/sh
+
+set -e -x
+
+docker run --name lighthouse1 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm nebula:smoke -config lighthouse1.yml &
+sleep 1
+docker run --name host2 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm nebula:smoke -config host2.yml &
+sleep 1
+docker run --name host3 --device /dev/net/tun:/dev/net/tun --cap-add NET_ADMIN --rm nebula:smoke -config host3.yml &
+sleep 1
+
+set +x
+echo
+echo " *** Testing ping from lighthouse1"
+echo
+set -x
+docker exec lighthouse1 ping -c1 192.168.100.2
+docker exec lighthouse1 ping -c1 192.168.100.3
+
+set +x
+echo
+echo " *** Testing ping from host2"
+echo
+set -x
+docker exec host2 ping -c1 192.168.100.1
+docker exec host2 ping -c1 192.168.100.3
+
+set +x
+echo
+echo " *** Testing ping from host3"
+echo
+set -x
+docker exec host3 ping -c1 192.168.100.1
+docker exec host3 ping -c1 192.168.100.2