tinc - May 2017 - Concept clarification between multiple ConnecTo and multiple netname

Hi, Etienne

Thanks for your clarification, and this helped a lot. And in order to get a
better understanding for the mechanism of Tinc and the purpose of ConnectTo
statement, can I think the ConnectTo is the way to get the node into the Tinc
VPN domain, instead of establish VPN connection between nodes.

Once any node ConnectTo the Tinc VPN domain, it learns all other nodes, subnets,
and corresponding public or private(but UDP reachable), and establish full mesh
VPN among them on-demand. So technically speaking, only one ConnectTo would be
enough for the node to join the full mesh VPN, but in order to provide
resilience, add a second ConnectTo will be beneficial.

> On 1 May 2017, at 6:39 PM, Etienne Dechamps <etienne at edechamps.fr>
wrote:
> 
> If you have multiple ConnectTo statements in your tinc.conf, then tinc will
attempt to establish connections with *all* of them. It is not a fallback,
though it is a good idea for every node to have at least two direct connections
for improved resiliency and fault tolerance.
> 
> As to whether you should have just one tinc network or multiple networks,
well, that depends on what you're trying to accomplish and whether you want
isolation between these networks. If all your nodes are meant to be part of the
same VPN (i.e. same address space) and are part of the same trust domain (i.e.
they all trust each other equally), then it's simpler to have them be in the
same tinc network - that will simplify configuration and it will result in
smarter routing decisions.
> 
> If you are setting up individual tinc networks that only have two nodes in
them, then tinc is overkill - you might as well use something simpler like
IP/IP, GRE, OpenVPN or other "point-to-point" VPN solutions.
tinc's purpose is to build a reliable, self-routing VPN out of a large mesh
network of nodes; it makes little sense to use it for simple point-to-point
connections.
> 
> On 30 April 2017 at 00:53, Bright Zhao <startryst at gmail.com
<mailto:startryst at gmail.com>> wrote:
> Hi, Tinc experts
> 
> I’m on-boarding for Tinc for just quite a few days, and trying to setup the
connection between one client to multiple server, where multiple vpn tunnels
from the client to different server. From the documentation, it indicate the
tinc.conf can support multiple ConnecTo, also the tinc can support multiple
netname, like /etc/tinc/net1, /etc/tinc/net2.
> 
> My question is, for my above use case, I should go with multiple netname
instead of multiple ConnectTo, right? I did some tests, and I found no matter
how many ConnectTos I placed in the tinc.conf(on the client side), only one
connection can made to the server, and only one tun0 bring up with is the p2p
connection can only go with one server, even though from debug message, I saw to
connections all established, but only one connection is pingable.
> 
> If this is the case, then can I assume the ConnectTo in the tinc.conf is
connection by sequence which is a failover machoism, instead of "connect
them all"? But multiple netname can do the “connect them all"
> 
> 
> -- 
> Bright Zhao sent from Gmail
> 
> _______________________________________________
> tinc mailing list
> tinc at tinc-vpn.org <mailto:tinc at tinc-vpn.org>
> https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
<https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc>
> 
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://www.tinc-vpn.org/pipermail/tinc/attachments/20170501/52a0b7d9/attachment.html>

That's exactly right. Corollary: if you take one node from a tinc network
and connect it to a node from another isolated tinc network, the two
networks become one :)

On 1 May 2017 at 13:16, Bright Zhao <startryst at gmail.com> wrote:
> Hi, Etienne
>
> Thanks for your clarification, and this helped a lot. And in order to get
> a better understanding for the mechanism of Tinc and the purpose of
> ConnectTo statement, can I think the ConnectTo is the way to get the node
> into the Tinc VPN domain, instead of establish VPN connection between
nodes.
>
> Once any node ConnectTo the Tinc VPN domain, it learns all other nodes,
> subnets, and corresponding public or private(but UDP reachable), and
> establish full mesh VPN among them on-demand. So technically speaking, only
> one ConnectTo would be enough for the node to join the full mesh VPN, but
> in order to provide resilience, add a second ConnectTo will be beneficial.
>
>
> On 1 May 2017, at 6:39 PM, Etienne Dechamps <etienne at edechamps.fr>
wrote:
>
> If you have multiple ConnectTo statements in your tinc.conf, then tinc
> will attempt to establish connections with *all* of them. It is not a
> fallback, though it is a good idea for every node to have at least two
> direct connections for improved resiliency and fault tolerance.
>
> As to whether you should have just one tinc network or multiple networks,
> well, that depends on what you're trying to accomplish and whether you
want
> isolation between these networks. If all your nodes are meant to be part of
> the same VPN (i.e. same address space) and are part of the same trust
> domain (i.e. they all trust each other equally), then it's simpler to
have
> them be in the same tinc network - that will simplify configuration and it
> will result in smarter routing decisions.
>
> If you are setting up individual tinc networks that only have two nodes in
> them, then tinc is overkill - you might as well use something simpler like
> IP/IP, GRE, OpenVPN or other "point-to-point" VPN solutions.
tinc's purpose
> is to build a reliable, self-routing VPN out of a large mesh network of
> nodes; it makes little sense to use it for simple point-to-point
> connections.
>
> On 30 April 2017 at 00:53, Bright Zhao <startryst at gmail.com>
wrote:
>
>> Hi, Tinc experts
>>
>> I’m on-boarding for Tinc for just quite a few days, and trying to setup
>> the connection between one client to multiple server, where multiple
vpn
>> tunnels from the client to different server. From the documentation, it
>> indicate the tinc.conf can support multiple ConnecTo, also the tinc can
>> support multiple netname, like /etc/tinc/net1, /etc/tinc/net2.
>>
>> My question is, for my above use case, I should go with multiple
netname
>> instead of multiple ConnectTo, right? I did some tests, and I found no
>> matter how many ConnectTos I placed in the tinc.conf(on the client
side),
>> only one connection can made to the server, and only one tun0 bring up
with
>> is the p2p connection can only go with one server, even though from
debug
>> message, I saw to connections all established, but only one connection
is
>> pingable.
>>
>> If this is the case, then can I assume the ConnectTo in the tinc.conf
is
>> connection by sequence which is a failover machoism, instead of
"connect
>> them all"? But multiple netname can do the “connect them all"
>>
>>
>> --
>> Bright Zhao sent from Gmail
>>
>> _______________________________________________
>> tinc mailing list
>> tinc at tinc-vpn.org
>> https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
>>
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://www.tinc-vpn.org/pipermail/tinc/attachments/20170501/5cd905e7/attachment-0001.html>

Just one question on this topic (since I am thinking to start a project
on this): how big this could scale? (how many nodes? hundreds? thousands? )
Is there any estimation?



On 05/01/2017 02:20 PM, Etienne Dechamps wrote:
> That's exactly right. Corollary: if you take one node from a tinc
> network and connect it to a node from another isolated tinc network,
> the two networks become one :)

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL:
<http://www.tinc-vpn.org/pipermail/tinc/attachments/20170501/db602bbd/attachment.sig>