Differences

This shows you the differences between two versions of the page.

--- vpn-tinc [2022/02/11 00:14] – [Tinc Configuration]-clarity, formatting hogwild
+++ vpn-tinc [2024/11/28 23:27] (current) – [Hosts Tab] hogwild
@@ Line 1: / Line 1: @@
-====== Tinc Daemon ======
+====== Tinc ======
-Tinc is a newer VPN technology that allows you to create partial/full mesh VPN connections without having to define every endpoint, as you'd have to with other VPN protocols. A minimum amount of configuration is still needed for each site. However, it's the quickest way to develop a mesh VPN between network sites.
+Tinc is a newer VPN technology. Unlike with other protocols, it lets you create partial/full mesh VPN connections without having to define every endpoint. A minimum of configuration is needed for each site. It's the quickest way to develop a mesh VPN between network sites.
 The Tinc Daemon menu is divided into tabbed sections, including Tinc Configuration, and (VPN) Hosts.
-===== Tinc Configuration =====
+===== Config Tab =====
 {{:pasted:20220204-091455.png}}
@@ Line 12: / Line 12: @@
  \\
-**Start with WAN:** Enabling this will cause the tinc daemon to start as part of the wanup (WAN interface initialization) process.
+**Start with WAN:** causes the Tinc daemon to start as part of the wanup (WAN interface initialization) process.
-**Interface type:** TUN/TAP: Here, you specify the communication protocol used within your VPN. TUN is routed, and runs at the network (IP) layer. TAP is switched, and runs at the datalink layer. Generally, you should choose TUN. For more information on these protocols, see the "Interface Type" section of the [[:vpn-server|OpenVPN Server]] wiki page. For even more details, see: \\ [[https://en.wikipedia.org/wiki/TUN/TAP|https://en.wikipedia.org/wiki/TUN/TAP]]
+ \\
-**VPN Netmask:** Here, specify the (sub)netmask to be used for intra-site communications.
+**Interface type:** specifies the communication protocol used within your VPN.
-**Host Name:** This is the unique identifier of the OpenVPN device. This is NOT the same as the device's DHCP/DNS Hostnames.
+  * TUN - a routed protocol running at the network (IP) layer.
+  * TAP - a switched protocol running at the datalink layer.
-**Poll interval:** This enables hello packets on the VPN. Hello packets are sent back and forth periodically between routers to establish adjacency (presence for communication).
+ \\
+Generally, you should choose TUN. For more details, see "Interface Type" on the [[vpn-server#interface_type|OpenVPN Server]] wiki page.
  \\
+**VPN Netmask:** here, specify the (sub)netmask to be used for intra-site communications.
+ \\
+**Host Name:** a unique identifier of the OpenVPN device. This is NOT the device's DHCP/DNS Hostnames.
+ \\
+**Poll interval:** if set greater than "0", a watchdog polls whether Tinc is running (not crashed) every n minutes. If it isn't running, it restarts the Tinc service. Settings this to "0" disables the watchdog.
+ \\  \\
 {{:pasted:20220204-091557.png}}
@@ Line 28: / Line 43: @@
  \\
-**Ed25519 Private Key: **In this field, you enter your private Ed25519 key. This key is necessary for the encryption process.
+**Ed25519 Private Key: **the private Ed25519 encryption key.
-**RSA Private Key * : **This field is where you enter your private RSA key. The RSA encryption protocol uses much more CPU power than the Ed25519 protocol. The RSA key is optional and is only needed for communication with hosts using tinc version 1.0 or lower.
+This is needed for the encryption process.
-**Custom: **This field allows you to specify any custom tinc daemon parameters you might want.  \\   \\   \\
+ \\
+**RSA Private Key: *  **here, enter the private RSA key.
-===== Hosts =====
+RSA encryption uses much more CPU power than the Ed25519 protocol. \\ This key is optional and needed only for communication with hosts using Tinc 1.0 or lower.
-Most of the hosts in your network should be defined on this page. Tinc doesn't need all the hosts to be defined. It's able to use a relay to reach secondary hosts if the end devices are not able to communicate with each other because of NAT or some other reason. You do, however, need to define "yourself" on each tinc device.
+ \\
-{{:pasted:20220204-091804.png}}
+**Custom: **here you can specify any custom Tinc daemon parameters you wish.  \\   \\
-**ConnectTo:** This is a flag and can be set to On or left blank. This tells the local tinc daemon whether or not it should attempt a direct connection with another host (not including relaying a connection to another host).
-**Name:** As on the Config tab, this is the unique tinc identifier defined under the Host Name field.
+===== Hosts Tab =====
-**Address: **This is used only when direct reachability is possible and defines the IP or FQDN (fully qualified domain name) where the host can be found. Direct reachability means without relay.
+Most hosts on your network should be defined on this page. Tinc doesn't need all hosts to be defined. It can use a relay to reach secondary hosts if the end devices can't (yet) communicate. There are various reasons hosts may not be able to communicate. This includes the presence of NAT devices between them.
-**Port: **An empty value configures the default setting (both TCP/UDP port 655). You might need to tweak this value if you include direclty windows devices in your tinc communication. <Fix Me!> Needs clarification.
+However, you do need to define "yourself" on each Tinc device.
-**Compression:** Compression can, in some cases, increase VPN speeds. Here, the default of 0 (disabled) can be tweaked to as high as 11. All the nodes must be configured with the same compresssion settting. Since most VPN traffic is already compressed/encrypted at the application layer, think carefully about whether you need this enabled or not. Enabling compression will also add extra workload to the CPU, and may not increase speeds.
+ \\
-**Subnet:** Defines the primary subnet reachable via the host being defined.
+{{:pasted:20230111-110422.png?800}}
-{{:pasted:20220204-091844.png}}
+ \\
+**ConnectTo:** this can be set "On" or left blank. It tells Tinc to connect directly to another host (without a relay).
+ \\
+**Name:** as on the Config tab, this is a unique Tinc identifier defined in the Host Name field.
+ \\
+**Address: **this is used only for direct communication. It defines the IP/FQDN where the host can be found (without a relay).
+ \\
+**Port: **if blank, sets the default setting of TCP/UDP(655).
+You might need to tune this for network devices without root/Administrator privileges (but not FreshTomato).
+ \\
+**Compression:** lets you set the compression level (between the default of "0" (disabled) and "11").
+Sometimes, compression can increase VPN speeds. You must configure all nodes with the same setting. Think carefully about whether you need this, as most VPN traffic is already compressed at the application layer. Enabling compression adds extra CPU workload and may not increase throughput.
+ \\
+**Subnet:** the primary subnet reachable via the host being defined.
+This is published to tinc peers so they know which peer hosts the subnet.
+ \\
+**Ed25519 Public Key:** here, enter your Ed25519 encryption Public Key.
+ \\
+**RSA Public Key: * ** if you're using RSA encryption, you must define each host's public key here.
+RSA is optional in Tinc 1.0 and later. You must provide minimal details for all hosts defined before you can click OK and go to the next row. Clicking OK **does not** save settings. Only after you've defined all hosts, clicked "OK" for each, and clicked "Save" will all host settings be saved.
+ \\
+**Custom:** in this field, you can define custom settings for each host.
+For example, if a host communicates with with another subnet, you could add:
+//  Subnet = 10.10.8.0/24// .
+ \\
-**Ed25519 Public Key:** This is where you enter your Ed25519 encryption Public Key.
+These settings must be consistent with the host IP/subnet + config-page "netmask" setting.
-**RSA Public Key *:** In case of RSA key you must define the public on on a host basis here. RSA is optional in tinc 1.0+
+ \\ \\  \\
-For every host you define, you must provide the minimum info before being able to click OK and proceed to the next row. OK doesn't save the settings. After all the hosts are defined (and having clicked OK for each) you must then click the Save button at the bottom of the menu. Only then will all your host settings be saved.
-**Custom:** In this field, you are free to define custom configuration settings for each host. For example, if a host is providing reachability to a second subnet you could add something like: //Subnet = 10.10.8.0/24// . Make certain this is consistent with the host IP/subnet + config-page "netmask" setting.

FreshTomato Wiki

User Tools

Site Tools

Differences

Page Tools