tinc - Jun 2018 - Dual, backup, Tinc Servers?

Hi,Is it possible to configure two tinc vpn servers to act as backups for each
other?
For example, suppose there are three PCs on a local LAN.TincServerA and
TincServerB are configured to connect to the other end.
MachineC wants to connect to services on the other end, via either TincServerA
or TincServerB.
In my current single tinc vpn setup, MachineC has a static route informing it of
the single tinc server.If this tinc vpn server goes down, MachineC cannot
connect to other end.
In a two tinc vpn servers setup, is there a way of switching the static
route on MachineC to use TincServerB if TincServerA were to go down?
(If all three PCs were tinc vpn servers, it would mitigate the single point of
failure, but would that waste Internet bandwidth with all three connecting to
the other side?
Perhaps this is the only practical solution.)
Thanks
John
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://www.tinc-vpn.org/pipermail/tinc/attachments/20180616/712fa3b4/attachment.html>

Hello John,


Am Sat, 16 Jun 2018 09:23:47 +0000 (UTC)
schrieb "jradxl at yahoo.com" <jradxl at yahoo.com>:
> In a two tinc vpn servers setup, is there a way of switching the static
> route on MachineC to use TincServerB if TincServerA were to go down?
I assume, that you could solve your challenge with tinc easily by using the
"weight" field in your subnet definitions (see "man
tinc.conf"):

= TincServerA Subnet = 10.23.42.0/24#3

= TincServerB Subnet = 10.23.42.0/24#5

Here both nodes feel responsible for the same network. Thus TincServerC will
send packages for this network via TincServerA, if it is available (due to the
lower "weight"). Otherwise it will use TincServerB.
This should be working in "router" (the default) out of the box, I
guess.

In "switch" mode, you will need to apply the "weight" in
your subnet-up-Script,
e.g.:

 ip route add "$SUBNET" dev "$INTERFACE" metric
"$WEIGHT"


And another last detail: if your traffic is directed at hosts _behind_
TincServerA/B, then you will also need to take care for the routing of the
traffic coming back from these hosts to C. Source NAT on A/B could be a quick
(and quite dirty) solution for this.

> If all three PCs were tinc vpn servers, it would mitigate the single point
> of failure, but would that waste Internet bandwidth with all three
connecting
> to the other side?
This depends on your scarcity of bandwidth. I assume, that it is not
problematic in most situations.


Cheers,
Lars