similar to: Mesh and scalability

On 4 June 2015 at 22:36, Johannes Ernst <johannes.ernst at gmail.com> wrote: > It seems to me that if Node B is supposed to be able to send stuff directly to Node C (instead of Node A), Node B needs to know where Node C is. Does this mean that each Node has to have a complete network map? This seems to become very unwieldy with larger deployments. Yes, each node knows about the entire

We have a handful of nodes set up. Some are NAT'd but a few have direct access to the Internet. Sample confs: HostA: Name = HostA AddressFamily = any Interface = tap0 Mode = switch Connectto = HostB GraphDumpFile = /tmp/mesh HostB: Name = HostB AddressFamily = any Interface = tap0 Mode = switch Connectto = HostA GraphDumpFile = /tmp/mesh And so on. If I use HostA as the main meta sever.

Hang on a second. I've just re-read your original message and I believe you are confused about what the "Subnet" option does. Again, it deals with addresses *inside* the VPN. In the configuration you posted you seem to be using 10.240.0.4 and 10.240.0.5 as internal addresses, but then your other statements (and especially your dump edges output) seem to indicate that 10.240.0.4 and

Hi, Etienne Thanks for your clarification, and this helped a lot. And in order to get a better understanding for the mechanism of Tinc and the purpose of ConnectTo statement, can I think the ConnectTo is the way to get the node into the Tinc VPN domain, instead of establish VPN connection between nodes. Once any node ConnectTo the Tinc VPN domain, it learns all other nodes, subnets, and

Hi, Tinc experts I’m on-boarding for Tinc for just quite a few days, and trying to setup the connection between one client to multiple server, where multiple vpn tunnels from the client to different server. From the documentation, it indicate the tinc.conf can support multiple ConnecTo, also the tinc can support multiple netname, like /etc/tinc/net1, /etc/tinc/net2. My question is, for my above

Hi everyone. I'm wondering whether a setup like the one described below would be possible with Tinc: nodeA1 nodeB3 | | (Network A) --- [GWA] --- (Internet) --- [GWB] --- (Network B) | | nodeA2

Hello All, How are you all doing today? Good i hope. I am wondering if some one could please comment on the scalability limitations of Tinc as far as bandwidth usage and connections? Thinking about the documentation on Tinc suggests that if it is always trying to maintain a full mesh topology and if there would be many nodes, e.g. more than about 100 or so active at a give time, then Tinc

Hi I have a Tinc cluster of about 100 nodes, and they are all running tinc 1.1pre14. I'd like to upgrade to tinc 1.1pre15. Is there a suggested mechanism to do this while keeping the cluster up? For instance can I simply automate the installation of tinc 1.1pre15 on each node and reload the existing configuration using 'tinc reload' Will the temporary state of having a mix set of

@Etienne, I understood your explanation about the Subnet being the network *inside* the VPN, but the following the example https://www.tinc-vpn.org/examples/proxy-arp/, it seems to have: Subnet = 192.168.1.0/24 for the office, yet the IP address for the office is 192.168.1.2. Is that example no longer valid or am I misunderstanding? On Tue, Feb 14, 2017 at 4:01 PM, James Hartig <james at

http://www.open-mesh.org/ Idea #1: is BATMAN worth considering using as part of the layer 2 routing in Tinc? Idea #2: would it be possible to embed BATMAN as an option to avoid having to use Quagga for routing v6 subnets? -------------- next part -------------- An HTML attachment was scrubbed... URL:

Hi, I wrote a draft puppet module to maintain a L2 mesh based on tinc [1]. I tried to explain what it is about so that it makes sense even to people who know nothing about tinc [2]. Before polishing it so that it can be useful to the general public instead of just myself, I would very much appreciate your comments. This is my first experience with tinc and I would like to improve :-) Thanks for

Hi, if we are to configure Tinc just like a traditional server-client VPN, what would be the options to set in the configuration file to achieve that. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://www.tinc-vpn.org/pipermail/tinc/attachments/20160501/b5d5935f/attachment.html>

I've tried IRC in #tinc and #pfsense on freenode for this, not luck yet, figured I'd try the mailing list. A summary of my problem is here: https://www.reddit.com/r/PFSENSE/comments/789xus/tinc_vpn_can_do_everything_but_be_accessed/ If there are any details I can provide that would help I'll be more than happy to. I'm hoping it will be something obvious that someone can say

Hello, tinc experts! I have a question that I have not been able to find an answer to after reading the manual and examples and I was hoping someone could help me. So, let's say I have an elastic number of hosts all in rfc-1918 space that need to talk to each other. And lets also say that I do not trust the network they are on. Is there a way I can configure tinc on all N hosts to use the

You might want to try with https://github.com/gsliepen/tinc/pull/120 - that said, this bug probably doesn't explain everything because tinc is supposed to log a message from setup_vpn_in_socket() anyway, but there's no such message in your log. In addition, I really don't see any way the "Received UDP packet from unknown source" message could be logged if the UDP socket

Hi. I read that one feature of tink vpn solution is the Automatic Full Mesh Routing support that is defined as: "regardless of how you set up the tinc daemons to connect to each other, VPN traffic is always (if possible) sent directly to the destination, without going through intermediate" hops. What this means? I don't understand how this work. Can you please give me some

On 11 November 2015 at 21:57, David Nicol <davidnicol at gmail.com> wrote: > it is entirely possible to write code that uses threads on Win32 and forks > on POSIX by abstracting the communication bits generically. Signalling could > work over pipes on both. > > https://msdn.microsoft.com/en-us/library/windows/desktop/aa365152(v=vs.85).aspx Hum... yes of course, but I

On 09/03/2016 10:56 AM, Etienne Dechamps wrote: > C will still need keys in order to establish metaconnections with A and B (as > well as a few other things). However there is no need for C to own any > "Subnets" at all. If somebody breaks into C, he could get access to the vpn network, right? Because the keys are there, it will be possible to use them to get access. Even if

Hi, Etienne In addition, is there any option or switch can turn of the automatic direct connection? For the example below, even A has the route to C and can establish UDP connection directly, but I need the traffic to go through B, how can I achieve that easily? (instead of remove something from A’s routing table, or manually block the connection between A and C) > On 1 May 2017, at 6:28 PM,

I am running tinc v. 1.1pre (truly as I read somewhere, ?one of the internet?s best kept secrets?) on some consumer home routers flashed with tomato firmware. I have a whole network of these, but for the purposes of this question I will focus on just three Router A (subnet 192.168.5.0/24) is connected via a standard tinc ?router? mode network with Router B (subnet 192.168.15.0/24). Router B, in