tinc devel - Jul 2007 - packet default route

Hi All,

I have two queries to be clarified. Any response would be appreciated.

1. If I setup a default route to a particular network to go to the tun
device which in turn is picked up by the tinc daemon how does the
subsequent UDP/TCP connection made by the tinc daemon to the peer
daemon go through the network to the other end and not go to the local
tun device again ( by the virtue of the default route that we setup
earlier ).I am curious how tinc handles this.

2. If a default is route is set up in such a way that all the packets
can be intercepted by the tinc, then how does tinc handle the case of
an individual packet being forwarded to a particular host. Would the
setup be bypassed in that case.Once we setup the network so that *all*
the packets being sent out or being received _should_ go through the
daemon ( iptables etc.) would there be any case where this setup is
not used.


Thanks
Ashwin Ganti.


-- 
"There are two ways of constructing a software design: One way is to
make it so simple that there are obviously no deficiencies and the
other way is to make it so complicated that there are no obvious
deficiencies." -- C.A.R. Hoare, The 1980 ACM Turing Award Lecture
www.cs.uic.edu/~aganti
--

On Mon, Jul 23, 2007 at 02:22:18PM -0500, Ashwin Ganti wrote:
> 1. If I setup a default route to a particular network to go to the tun
> device which in turn is picked up by the tinc daemon how does the
> subsequent UDP/TCP connection made by the tinc daemon to the peer
> daemon go through the network to the other end and not go to the local
> tun device again ( by the virtue of the default route that we setup
> earlier ).I am curious how tinc handles this.
Tinc does not handle this. You are responsible to add another route so
that tinc's own UDP and TCP traffic does not loop back to the tun
device.  This is easy if you don't use the IP addresses of the hosts
running the tinc daemons on the VPN itself. But if you do, you can use
techniques like source based routing or firewall techniques (for
example, netfilter's ROUTE target) to divert only tinc's traffic to a
real interface.
> 2. If a default is route is set up in such a way that all the packets
> can be intercepted by the tinc, then how does tinc handle the case of
> an individual packet being forwarded to a particular host. Would the
> setup be bypassed in that case.Once we setup the network so that *all*
> the packets being sent out or being received _should_ go through the
> daemon ( iptables etc.) would there be any case where this setup is
> not used.
On the host that sends a packet, the kernel will first use the routing
table to see to which interface it has to send the packet. If it goes to
tinc's tun interface, then tinc will encrypt and forward the packet. If
the routing table says the packet can be sent directly, the kernel will
send it to a real interface, thus bypassing tinc. A default route always
has the lowest priority, any other route has a higher priority. So you
have to check yourself if your routing table allows packets for certain
destinations to bypass tinc.

-- 
Met vriendelijke groet / with kind regards,
     Guus Sliepen <guus@tinc-vpn.org>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url :
http://brouwer.uvt.nl/pipermail/tinc-devel/attachments/20070723/528e7f03/attachment.pgp