Differences

This shows you the differences between two versions of the page.

--- vpn-tinc [2023/01/11 11:00] – rs232
+++ vpn-tinc [2023/09/10 20:04] (current) – rs232
@@ Line 1: / Line 1: @@
-====== Tinc Daemon ======
+====== Tinc ======
 Tinc is a newer VPN technology that allows you to create partial/full mesh VPN connections without having to define every endpoint, as you'd have to with other VPN protocols. A minimum amount of configuration is still needed for each site. However, it's the quickest way to develop a mesh VPN between network sites.
@@ Line 29: / Line 29: @@
 **Ed25519 Private Key: **In this field, enter your private Ed25519 encryption key. This key is needed for the encryption process.
-**RSA Private Key * : **Here, enter your private RSA key. The RSA encryption protocol uses much more CPU power than the Ed25519 protocol. The RSA key is optional and is needed only for communication with hosts using Tinc version 1.0 or lower.
+**RSA Private Key: *  **Here, enter the private RSA key. RSA encryption uses much more CPU power than the Ed25519 protocol. \\ The RSA key is optional and is needed only for communication with hosts using Tinc version 1.0 or lower.
 **Custom: **This field allows you to specify any custom Tinc daemon parameters you might want.  \\   \\
 ===== Hosts Tab =====
-Most of the hosts on your network should be defined on this page. Tinc doesn't need all the hosts to be defined. It's able to use a relay to reach secondary hosts if the end devices are not able to communicate. This can be happen for various reasons, such as the presene of NAT devices between hosts. However, you do need to define "yourself" on each Tinc device.
+Most of the hosts on your network should be defined on this page. Tinc doesn't need all hosts to be defined. It can use a relay to reach secondary hosts if the end devices can't (yet) communicate. Hosts may not be able to communicate for various reasons, including the presence of NAT devices between them.
-**ConnectTo:** This flag and can be set to "On" or left blank. This tells the local Tinc daemon whether it should attempt a direct connection with another host (not including a relayed connection to another host).
+However, you do need to define "yourself" on each Tinc device.
-**Name:** As on the Config tab, this is the unique Tinc identifier defined in the Host Name field.
+ \\
-**Address: **This is used only when direct communication is possible and defines the IP address or FQDN (fully qualified domain name) where the host can be found. Direct communication means without relay.
+{{:pasted:20230111-110422.png?800}}
-**Port: **An empty value configures the default setting (both TCP/UDP on port 655). You might need to tweak this value for devices on the network that do not have root/administrator privileges (not applicable to tomato).
+ \\
-**Compression:** In some cases, compression may increase VPN speeds. Here, the default of "0" (disabled) can be tweaked to as high as "11". All the nodes must be configured with the same compresssion settting. Since most VPN traffic is already compressed/encrypted at the application layer, think carefully about whether you really need this enabled. Enabling compression will add extra workload to the CPU, and may not increase speed/throughput.
+**ConnectTo:**  This flag can be set "On" or left blank. This tells the local Tinc daemon to try connecting directly to another host (without using a relay).
-**Subnet:** Defines the primary subnet reachable via the host being defined.
+**Name:**  As on the Config tab, this is the unique Tinc identifier defined in the Host Name field.
- \\
+**Address:  **This is used only when direct communication is possible. It defines the IP address (or FQDN) where the host can be found. This means without a relay.
-{{:pasted:20220204-091844.png}}
+**Port:  **If left blank, this configures the default setting (TCP/UDP, port 655). You might need to tune this for network devices without root/Administrator privileges (but not FreshTomato).
- \\
+**Compression:**  In some cases, compression may increase VPN speeds. The default of "0" (disabled) can be adjusted as high as "11". All nodes must be configured with the same setting. Since most VPN traffic is already compressed at the application layer, think carefully whether you need this enabled. Enabling compression adds extra workload to the CPU, and may not increase throughput.
+**Subnet:**  This defines the primary subnet reachable via the host being defined. It's published to the tinc peers so they know which peer hosts the subnet.
+**Ed25519 Public Key:**  Here is where you enter your Ed25519 encryption Public Key.
+**RSA Public Key: * ** If you're using RSA encryption, you must define each host's public key here. RSA is optional in Tinc versions 1.0 and later.
+You must provide minimal information for every host defined before you can click OK and go to the next row. Clicking OK **does not** save settings. Only after you've defined all hosts, clicked "OK" for each, and clicked "Save" at the bottom. will all host settings be saved.
-**Ed25519 Public Key:** This is where you enter your Ed25519 encryption Public Key.
+**Custom:**  In this field, you can define custom settings for each host.
-**RSA Public Key *:** If you are using an RSA key, you must define the public key on for each host here. RSA is optional in Tinc 1.0+ .
+For example, if a host communicates with with another subnet, you could add:
-You must provide the minimum information for every host you define before you can click OK and proceed to the next row. Clicking OK does not save the settings. After you've defined all hosts, and clicked "OK" for each, you must then click the "Save" button at the bottom. Only then will all your host settings be saved.
+//  Subnet = 10.10.8.0/24// .
-**Custom:** In this field, you are free to define custom configuration settings for each host. For example, if a host is communicating with a second subnet, you could add something like: //Subnet = 10.10.8.0/24// . Please ensure this is consistent with the host IP/subnet + config-page "netmask" setting.
+You must ensure these settings are consistent with the host IP/subnet + config-page "netmask" setting.
  \\

FreshTomato Wiki

User Tools

Site Tools

Differences

Page Tools