tinc - Jul 2014 - Tinc tunnel between two subnets

Hi,

I'm trying to setup tinc tunnel between my work and home linux machines as
shown here http://cl.ly/image/1H1R2X2D403X

I am able to setup tinc session between A and B and I can ping them. But I
can't ping C or D from B, or A respectively.

Home network 192.168.1.0
Work network 10.20.50.0
tinc tunnel is 15.0.0.x.

Do I need to run tinc on C and D as well? Or Do i need to manually define
the routes?

I tried setting multiple subnets for A's host config as below and that
didn't work either.

Subnet = 15.0.0.2/32
Subnet = 10.130.50.107/32

Thanks,
Zia
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://www.tinc-vpn.org/pipermail/tinc/attachments/20140707/02254e8e/attachment.html>

On 07/08/2014 02:55 AM, Zia Syed wrote:
> I'm trying to setup tinc tunnel between my work and home linux machines
> as shown here http://cl.ly/image/1H1R2X2D403X
>
> I am able to setup tinc session between A and B and I can ping them. But
> I can't ping C or D from B, or A respectively.
>
> Home network 192.168.1.0
> Work network 10.20.50.0
> tinc tunnel is 15.0.0.x.
>
> Do I need to run tinc on C and D as well? Or Do i need to manually
> define the routes?
When using tinc in router mode, tinc needs to be aware of which subnets 
are to be routed through a specific node so that it knows which node to 
send packets to. This means that if you want A (and C) to access D, you 
need to declare the 10.20.50.0/24 subnet on B. Likewise, if you want B 
(and D) to access C, you need to declare the 192.168.1.0/24 subnet on A.

Keep in mind, though, that this is only for tinc's internal routing 
purposes. You still need to manually create the routes at the OS level 
so that the OS knows it needs to send the packets down tinc's virtual 
interface. In practice that means that B needs to have a route for 
192.168.1.0/24 and A needs to have a route for 10.20.50.0/24.

-- 
Etienne Dechamps

On Mon, Jul 07, 2014 at 06:55:12PM -0700, Zia Syed wrote:
> I'm trying to setup tinc tunnel between my work and home linux machines
as
> shown here http://cl.ly/image/1H1R2X2D403X
> 
> I am able to setup tinc session between A and B and I can ping them. But I
> can't ping C or D from B, or A respectively.
> 
> Home network 192.168.1.0
> Work network 10.20.50.0
> tinc tunnel is 15.0.0.x.
Note that you don't need to have a special subnet just for the tunnel.
Also, 15.0.0.0/8 is a range of public IP addresses, don't use that
unless you really don't mind missing parts of the Internet.

You can just give the VPN interface the same address as the LAN
interface. And as Etienne already said, you have to tell tinc about the
192.168.1.0/24 and 10.20.50.0/24 Subnets. So, on B you should have this
in hosts/B:

Subnet = 10.20.50.0/24

And in B's tinc-up:

#!/bin/sh
ip addr add 10.20.50.107 dev $INTERFACE
ip route add 192.168.1.0/24 dev $INTERFACE
ip link set dev $INTERFACE up

Also, don't forget that you have to enable forwarding in the kernel, if
that's not already done:

echo 1 >/proc/sys/net/ipv4/ip_forward

Also check that if you have any firewall rules on A and B that they
allow forwarding packets between the LAN and the VPN. Last but not
least, do C and D know that packets for each other's LAN have to go via
A and B? If A and B are the gateways on their LANs, you don't have to do
anything else. If they are not, then you need to tell D for example:

ip route add 192.168.1.0/24 via 10.20.50.107

Or if you have even more machines on the LAN that you want to give
access to the VPN, then tell the real gateway to route packets for the
VPN to the machine running tinc.

-- 
Met vriendelijke groet / with kind regards,
     Guus Sliepen <guus at tinc-vpn.org>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL:
<http://www.tinc-vpn.org/pipermail/tinc/attachments/20140708/7fb5b1c2/attachment.sig>