<html><head></head><body><div
style="font-family: Verdana;font-size: 12.0px;"><div>
<div>Hi everyone,</div>
<div> </div>
<div> </div>
<div>>> I did some digging, and thus far I could not find any other
culprit other<br/>>> than tinc itself. The packages that are being sent are addressed
directly to<br/>
>> the other tinc hosts on their vpn addresses. During my latest tests,
within<br/>
>> about 12 seconds 100MB of data were transmitted this way.<br/>
><br/>
> Just in order to avoid any misunderstandings:<br/>
> * you took a look at the traffic *through* the tinc network
interface<br/>
> (this should be the payload that you expect to see floating through your
VPN)<br/>
> * this traffic uses the internal VPN addresses of your VPN<br/>
> (we expect this)<br/>
> * you are surprised by the amount of traffic<br/>
><br/>
> This sounds like a routing issue.<br/>
> (traffic passing through the VPN that should take a different
path)</div>
<div> </div>
<div>1. Yes, I ran wireshark on the interface vpn0, which is the set up by
tinc.</div>
<div> </div>
<div>2. and 3. Yes.</div>
<div> </div>
<div> </div>
<div>>> At the very beginning, normal connections are being set up
and a few ICMP<br/>>> neighbor advertisements/solicitations are being exchanged. Next a short
TCP<br/>
>> session was created between the public IP addresses of two of my
hosts,<br/>
>> through the VPN.<br/>
><br/>
> What do you mean with "session"? Some http-requests that you are
sending<br/>
> through the VPN? Or something special?</div>
<div>
<div> </div>
<div>Just like before, there should not have been any payload traffic
involved. I was referring to the TCP connection you attribute to tinc
itself.</div>
<div> </div>
<div> </div>
<div>>> Thus you may want to verify, that the routes on the tinc
peers (while the<br/>>> VPN is established) meet your expectations. Maybe you want to share
these<br/>
>> (obfuscated) routes with us?</div>
<div> </div>
<div>I think I understand the problem now. My node-up files look like
this:</div>
<div> </div>
<div># node01-up</div>
<div>
<div>ip -6 route del 1111:1:1::/64 via 1111:1::1<br/>
ip -6 route del <node01's public ipv6>/64 via 1111:1::1</div>
<div> </div>
<div>I just tested whether the second rule causes the issue and it does.
When I remove this line from all node-ups on all but one of my hosts, everything
is fine as long as that "faulty" host is not up. As soon as I run tinc
on the host with the additional configuration line, things start going haywire.
<div>My intention was to make my nodes route traffic to their respective
public interfaces through the VPN as well. The goal was that all connections
between my nodes, regardless of whether they are destined for internal or
external ipv6 addresses, end up using the VPN.</div>
<div> </div>
</div>
<div>Kind regards and thank you very much for your help</div>
<div>Christopher</div>
</div>
</div>
</div></div></body></html>