Windows Firewall, network discovery

Erik Popp
2015-04-02T20:05:16Z

<meta http-equiv="content-type" content="text/html;
charset=UTF-8">


I have a simple VPN that consists of:

1 Xubuntu box
1 Windows 7 desktop
1 Windows 8 laptop

There are a couple of other machines that I had at one time
added, but they're almost never active.

The Xubuntu box is in my grandparents' home network, the
Windows
      7 desktop at my parents' home, and the laptop is sometimes in one,
sometimes the other, and sometimes in other networks.

The Xubuntu box and Windows 7 box each have port forwarding set
      up, so that they can ping each other, and I can even do backups
      with rsync through an SMB share (painfully slow due to the
internet's latency).

To reach them, I use a single DDNS host name for both:
nslookup blah.example.com
server: 192.168.1.1

Non-authoritative answer:
Name: blah.example.com
Address: 1.2.3.4
Name: blah.example.com
Address: 5.6.7.8

I know that the DDNS works because I can ping each router from
      the other network, and I can access the router on one that I've
set up SSH on.

The VPN operates on layer 2, using the mode =
switch
option, and has the IPv4 address block 192.168.2.0

I don't keep any one machine going all the time, although I
have
      a router that I plan to eventually put tinc on, and that'll be up
24/7. Usually, at least 1 of these machines is down.

I have 3 separate problems:


Windows Firewall doesn't know where the center of my VPN
is.
        This is because I intentionally didn't make one.  Thus, my
        Windows boxes call it "Unidentified Network", and assign it to
the restrictive settings for public networks.
        If I tell Windows that 1 or more of the machines on the VPN is a
        default gateway, it recognizes the network, but only if that
        machine was up when the Windows box connected to the network.
        Also, Windows gives me a warning that setting multiple default
        gateways is meant for multiple connections to a single network,
        not separate connections to separate networks.  I currently want
the VPN to be separate from either physical LAN.

At my grandparents' house, tinc's local peer discovery
doesn't
        work properly.  They don't discover each other on the network
        unless they can both talk to a third machine over the internet,
        and then they can route traffic through each other via the third
        machine.  If I have 1 or both of them ping each other for awhile
        (a few seconds to several minutes), they'll discover each
        others' local addresses for sending data, but they appear to
        still use their remote peer for the meta connection.  The router
        which local peer discovery has WAN loopback (incorrect term?)
        enabled, so I can SSH into the router using its WAN IP, from
inside its LAN.
When the tinc daemon/service is turned on, it breaks LAN
        gaming on Age of Empires III, for that machine.  I suspect that
        this is a firewall issue.  I can't see any games that are being
        hosted on the LAN.  If I try to connect with a direct IP, it
        seems that messages are getting to 1 of them, but 2-way
communication doesn't work.


tinc.conf on xubuntu box:

Name = gaius
Device = /dev/net/tun
LocalDiscovery = yes
Mode = switch
ConnectTo = proctor
ConnectTo = valerian
ConnectTo = octavian
ConnectTo = lucius

tinc-up on Xubuntu box:
#!/bin/bash

ifconfig "$INTERFACE" 192.168.2.2

Host file for Xubuntu box:

#host info for machine "gaius"

#the address/domain that this host can be reached at
Address = blah.example.com

#to do: pick the strongest cipher available
Cipher = blowfish
Digest = sha1

        #experiment to find what's the best compression level for
me
#Compression = 11#"fast lzo"

        #I'm not quite sure what this does anymore, so I'm gonna see
what happens when
#I disable it
#IndirectData = yes

#it's a bit confusing, but this is not a subnet mask.
        #instead, it's the address/address range that this machine is

#responsible for routing packets to.
        #usually, a tinc daemon is responsible for routing packets only

        #to itself, but if you set a subnet that's the same as your
LAN's
        #address range, it's effectively a proxy to the inside of the

#rest of your physical LAN.
Subnet = 192.168.2.2/32

-----BEGIN RSA PUBLIC KEY-----

*snip *

-----END RSA PUBLIC KEY-----


tinc.conf on Windows 7 box:

Name = valerian
Mode = switch

ConnectTo = gaius
ConnectTo = proctor
ConnectTo = octavian
ConnectTo = lucius

#the network interface that tinc listens on
Interface = VPN Virtual Network Card

#allows tinc machines on the same LAN to find each
#other and talk to each other using each others'
#LAN addresses
LocalDiscovery = yes

#May help some with latency issues
ProcessPriority = high

        PrivateKeyFile = C:\Program Files
(x86)\tinc\modulus\rsa_key.priv

host file for Windows 7 box:

#the public address where this machine can be
found
Address = blah.example.com

#this is the subnet that this machine is the next hop to
Subnet = 192.168.2.3/32
Cipher = blowfish
Digest = sha1

#compression types:
#0 = off
#1-9 = zlib, higher number is better compression
#10-11 = lzo, higher number is better compression
Compression = 11

-----BEGIN RSA PUBLIC KEY-----

*snip *

-----END RSA PUBLIC KEY-----



tinc.conf on Windows 8 laptop:
#tinc.conf for machine code-named
"proctor"
Name = proctor
ConnectTo = gaius
ConnectTo = valerian
ConnectTo = octavian
ConnectTo = lucius

        #set this once I discover what the name of the tun/tap device
will be
Interface = tinc-vpn

        #hopefully, there won't be any conflict between this and the use
of a tun (layer 3) device
Mode = switch

        #Allows computers running tinc to find each other automatically
if they're on the same local network
LocalDiscovery = yes
host file for Windows 8 laptop:

#host file for machine "proctor"
#in newer versions of tinc, this line is no longer required.
        #if you omit it in every machine's copy, nobody can find it,

#but it might be able to find other machines.
        #if it tries to connect to a machine that it doesn't know the

#real address for, any other machine that it does know should
#introduce the two machines so they can talk directly

#Address = blah.example.com

#turn off security until I get it up and running
Cipher = blowfish
Digest = sha1

        #experiment with different compression levels to find out what's
practical
#Compression = 11#"best lzo"

        #a useful dynamic routing feature, I think.  I'm not sure what
it does anymore
#IndirectData = yes

#Is this needed?
Subnet = 192.168.2.1/32

-----BEGIN RSA PUBLIC KEY-----

*snip *

-----END RSA PUBLIC KEY-----