Tinc is a newer VPN technology that lets you create partial/full mesh VPN connections without having to define every endpoint, as you'd have to with other VPN protocols. A minimum amount of configuration is still needed for each site. However, it's the quickest way to develop a mesh VPN between network sites.

The Tinc Daemon menu is divided into tabbed sections, including Tinc Configuration, and (VPN) Hosts.

Start with WAN: Causes the Tinc daemon to start as part of the wanup (WAN interface initialization) process.

Interface type: Specifies the communication protocol used within your VPN.

• TUN - a routed protocol that runs at the network (IP) layer.
• TAP - a switched protocol that runs at the datalink layer.

Generally, you should choose TUN. For more details, see the “Interface Type” section on the OpenVPN Server Interface Type wiki page.

VPN Netmask: Here, specify the (sub)netmask to be used for intra-site communications.

Host Name: This is a unique identifier of the OpenVPN device. This is NOT the same as the device's DHCP/DNS Hostnames.

Poll interval: If set greater than “0”, a watchdog polls whether Tinc is running (has not crashed) every n minutes. If it finds Tinc is not running, it restarts the service. If set to “0”, the watchdog is disabled.

Ed25519 Private Key: Here, enter the private Ed25519 encryption key. This is needed for the encryption process.

RSA Private Key: * Here, enter the private RSA key. RSA encryption uses much more CPU power than the Ed25519 protocol.
This key is optional and needed only for communication with hosts using Tinc 1.0 or lower.

Custom: This field lets you specify any custom Tinc daemon parameters you like.

Most hosts on your network should be defined on this page. Tinc doesn't need all hosts to be defined. It can use a relay to reach secondary hosts if the end devices can't (yet) communicate. There are various reasons hosts may not be able to communicate. This includes the presence of NAT devices between them.

However, you do need to define “yourself” on each Tinc device.

ConnectTo: This flag can be set “On” or left blank. This tells the local Tinc daemon to try connecting directly to another host (without using a relay).

Name: As on the Config tab, this is the unique Tinc identifier defined in the Host Name field.

Address: This is used only when direct communication is possible. It defines the IP address (or FQDN) where the host can be found. This means without a relay.

Port: If left blank, this configures the default setting (TCP/UDP, port 655). You might need to tune this for network devices without root/Administrator privileges (but not FreshTomato).

Compression: In some cases, compression may increase VPN speeds. The default of “0” (disabled) can be adjusted as high as “11”. All nodes must be configured with the same setting. Since most VPN traffic is already compressed at the application layer, think carefully whether you need this enabled. Enabling compression adds extra workload to the CPU, and may not increase throughput.

Subnet: This defines the primary subnet reachable via the host being defined. It's published to the tinc peers so they know which peer hosts the subnet.

Ed25519 Public Key: Here is where you enter your Ed25519 encryption Public Key.

RSA Public Key: * If you're using RSA encryption, you must define each host's public key here. RSA is optional in Tinc versions 1.0 and later.

You must provide minimal information for every host defined before you can click OK and go to the next row. Clicking OK does not save settings. Only after you've defined all hosts, clicked “OK” for each, and clicked “Save” at the bottom. will all host settings be saved.

Custom: In this field, you can define custom settings for each host.

For example, if a host communicates with with another subnet, you could add:

Subnet = 10.10.8.0/24 .

You must ensure these settings are consistent with the host IP/subnet + config-page “netmask” setting.