Donald, thank you for this.
Do i read you right that to be able to receive broadcasts across LANs I
have to use the address space that I already have and make sure that
this space is the same for both LANs?
What I'm trying to do is to define a *completely new subnet* that will
act as the common LAN foR both LAN A and LAN B.
To re-iterate:
I have one router that is 10.1.1.1 and gives out DHCP 10.1.1.* and the
other router 192.168.0.1 that gives out DHCP 192.168.0.*.
I would like to leave these address spaces alone and define a new on
10.30.1.* that computer from both networks can participate in
effectively forming a new virtual LAN.
Is this possible with tinc? I know this possible with other software,
I'm just having hard time figuring out if this is something I can
configure tinc to do.
Andrew
On 7/10/2010 1:13 p.m., Donald Pearson wrote:
Sorry you're right. I was looking at the IP address schema where all
nodes would use the 10.30.0.0/24 <http://10.30.0.0/24> network.
There's no need to install tap adapters on the other devices. You
have basically 2 realistic options if you want the LAN function
You can specify multiple IP addresses for a single interface, even in
Windows. You'll find this under the TCP/IP properties of the network
adapter. And clicking on the Advanced button on the page where you
can set a static IP or designate DHCP.
A 2nd option would be to re-ip one of your locations so that they all
use the same subnet natively.
Bridging the tap adapter allows your network frames received by your
physical interface to reach the TAP adapter and therefore traverse the
VPN. This enables later 2 connectivity, the same way a real switch
does. Virtual Ethernet over the Internet is how I like to describe
it. This is how I have my VPN configured personally.
Without the bridge, a frame that is received at the physical interface
has the frame stripped off and the packet inspected. Now we're
talking layer 3. If the packet is destined for a network on the other
side of the VPN, your Tinc node frames the packet back up with a new
frame, and sends it over the VPN. This act of stripping the frame,
reading the packet for the network destination, and applying a new
frame to get it there is what Routing is. Without the bridge in
place, your Tinc node is literally routing between the physical
interface and the tap interface. With the bridge, you're creating a
layer 2 pathway so the frames can shoot across directly. Of course
this means both sides need to be on the same subnet which you
obviously already know.
Be warned that this configuration comes with it's drawbacks. DHCP
will traverse your VPN. I had location A computers getting addresses
from location B which makes for some really inefficient internet traffic.
Regards,
Donald
On Wed, Oct 6, 2010 at 7:57 PM, Andrew Savinykh <[email protected]
<mailto:[email protected]>> wrote:
Donald, thank you for the explanation.
I understand the part about the switch mode and absence of subnet
in tinc.config.
However, could you please explain what bridging the tap adapter
will achieve and what kind of ip address will be used on tinc
nodes and in the rest of the network.
In my example one household has local network addresses of
192.168.1.* and the other has 10.1.1.*
If we don't install tap interfaces on other PC's this means that
the other PCs won't have another ip address.
I understand that bridging is going to solve this somehow, but I
still don't see how broadcast from 10.1.1.7 can reach 192.168.1.5
in the other LAN.
In short I don't understand how bridging to adapters work. I'll
try to google this topic to get a better understanding, meanwhile,
could you please explain
how this applies to our tinc configuration case.
Also can you briefly describe what we achieve by setting
PMTUDiscovery = Yes. I read the description in manual but it
didn't tell me much.
Thank you again for all your help,
Andrew
On 7/10/2010 11:40 a.m., Donald Pearson wrote:
Oh okay. Yes you can make it appear as a single LAN. Your Tinc
nodes will behave as bridges instead of routers (or gateways as
you put it).
Your tinc nodes will have the same subnet mask and default router
as all your other devices at that location.
You will need to run the add-tap script only on the tinc nodes on
each side.
You will then need to bridge the tap adapter to the local area
connection on the tinc nodes on each side.
This will create a bridge network object under your network
connections. This bridge will have the IP configuration you
illustrated.
You have the right idea in segregating the IP distribution while
still using the 255.255.255.0 subnet mask.
One both nodes are up and connected, and the interfaces have been
bridged on the Tinc nodes for each location, you will have a
virtual LAN between the two locations.
Your Tinc configuration will be Switch mode. This means no
Subnet configurations are required in your tinc.conf
Your tinc.conf will be something like
Name = NodeA
ConnectTo = NodeB
Interface = <something>
Mode = switch
PrivateKeyFile = <path to the rsa_key.priv>
Host files will be something like
For the host file named "NodeA"
Address = <host.dyndns.org <http://host.dyndns.org>>
PMTUDiscovery = Yes
--Begin RSA etc. etc.--
On Wed, Oct 6, 2010 at 6:17 PM, Andrew Savinykh
<[email protected] <mailto:[email protected]>> wrote:
Donald,
thank you, while I still have some questions, your answer is
definitely a step in the right direction.
In the other reply I was asked what I'm trying to achieve.
Let's consider the following scenario (which is quite similar
to the one that described in the tinc manual).
Let's assume we have two households, each has 3-5 computers
in it. Both house holds have similar network configuration:
They are connected to internet with an ADSL line and a router.
The computers in the local network access internet via the
router.
The router is configured so that one of the computers have
port 665 forwarded to be accessible outside.
The external IP is changed rarely and there is dynamic DNS
service (external) in use to accommodate for the change of IP
when it happens.
One household has local network addresses of 192.168.1.* and
the other has 10.1.1.*
I'm installing tinc on one computer in each household.
The goal is to let all computers in both house holds to see
each other by ip address. Also it is desired that for
computer games purposes
all computers appear to be on the same LAN (for broadcasts).
But this is not mandatory. (it appears that it's not possible
without installing tinc on every PC
as every tinc daemon serves a subnet and two tinc daemons
can't serve a part of subnet each)
All computers run different flavours of Windows, most being
Windows 7.
I have two ideas how to set this up, although I'm not sure if
any of these two works:
IDEA1.
=====
Household A
Gateway IP: 10.30.0.1
Gateway Mask: 255.255.255.0
Gateway Default Gateway: ????
Other PCs IP: 10.30.0.2,3,4 etc
Other PCs Mask: 255.255.255.0
Other PCs Deafult Gateway: 10.30.0.1
Tinc Subnet: 10.30.0.0/25 <http://10.30.0.0/25>
Household B
Gateway IP: 10.30.0.129
Gateway Mask: 255.255.255.0
Gateway Default Gateway: ????
Other PCs IP: 10.30.0.130,131,132 etc
Other PCs Mask: 255.255.255.0
Other PCs Default Gateway: 10.30.0.129
Tinc Subnet: 10.30.0.128/25 <http://10.30.0.128/25>
IDEA2.
=====
Household A
Gatway IP: 10.30.0.1
Gateway Mask: 255.255.255.0
Gateway Default Gateway: ????
Other PCs IP: 10.30.0.2-255 etc
Other PCs Mask: 255.255.255.0
Other PCs Default Gateway: 10.30.0.1
Tinc Subnet: 10.30.0.0/24 <http://10.30.0.0/24>
Household B
Gateway IP: 10.30.1.1
Gateway Mask: 255.255.255.0
Gateway Default Gateway: ????
Other PCs IP: 10.30.1.2-255 etc
Other PCs Mask: 255.255.255.0
Other PCs Default Gateway: 10.30.0.129
Tinc Subnet: 10.30.1.0/24 <http://10.30.1.0/24>
So IDEA 1 probably won't work at all. Will it? And with IDEA
2 the pc's won't appear on the same LAN and their broadcasts
won't reach each other.
As far as I understand I need to install TAP interface on
each of the participating windows PCs, correct?
What is specified in default gateway of the gateways?
Thank you in advance,
Andrew
On 7/10/2010 4:36 a.m., Donald Pearson wrote:
The PCs that you want to participate need to have a route
for the VPN subnet pointing to their local VPN gateway,
which would be the local device with Tinc installed on it.
Theoretical configuration example.
VPN subnet is 10.10.10.0/24 <http://10.10.10.0/24>
At a location, one computer 192.168.1.254/24
<http://192.168.1.254/24> connects to the VPN and serves as
the VPN gateway. This gateway needs to be configured for
TCP/IP forwarding.
http://support.microsoft.com/kb/315236 - windows
http://www.ducea.com/2006/08/01/how-to-enable-ip-forwarding-in-linux/ -
linux
Other computers local to the gateway need a route to the VPN
network added so they know how to get there.
In windows. route -p add 10.10.10.0 mask 255.255.255.0
192.168.1.254
This will add the persistent route that remains after reboot.
Does that answer your question?
On Wed, Oct 6, 2010 at 6:41 AM, Andrew Savinykh
<[email protected] <mailto:[email protected]>> wrote:
Thank you for your reply. As far as I can see there is
no point specifying subnet that consists of more than
one PC in tinc config if you are going to install tinc
on every PC in the subnet anyway. Correct me if I'm wrong.
Now, assuming I'm right, there will be PCs in the subnet
that don't have tinc installed on them. How to configure
these PCs so they are a part of the subnet and
participate in routing?
Cheers,
Andrew
On 6/10/2010 10:13 p.m., Cédric Lemarchand wrote:
Hi,
I am not sure to understand what you mean with
"joining" a subnet.
But if your "local computer" need to reach the "remote
subnet" served by tinc, you can set the local IP of the
local tinc server as the default gateway, or add a
route to the remote subnet via the local tinc IP. Of
course, computer located on the remote subnet need the
same thing.
Cédric
Le 06/10/10 09:37, Andrew Savinykh a écrit :
Hello all,
I understand that each tinc daemon corresponds to one
or more subnets that it "owns" a subnet can be a
single ip or more.
Could you please tell me what do I need to do to join
a computer in local network (windows) to a subnet
served by tinc?
Thank you in advance,
Andrew
_______________________________________________
tinc mailing list
[email protected] <mailto:[email protected]>
http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
_______________________________________________
tinc mailing list
[email protected]
http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
_______________________________________________
tinc mailing list
[email protected]
http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
