Sure it's possible, you just need to assign each node a new IP in the 10.30.1.0/24 network. It's not part of the Tinc configuration, it's part of the network configuration of each computer.
All Tinc is doing, is creating a layer 2 path for them to reach each other. Yes broadcasts will traverse the VPN. It literally is virtual ethernet over the internet. :) On Wed, Oct 6, 2010 at 9:04 PM, Andrew Savinykh <[email protected]>wrote: > Donald, thank you for this. > > Do i read you right that to be able to receive broadcasts across LANs I > have to use the address space that I already have and make sure that this > space is the same for both LANs? > > What I'm trying to do is to define a *completely new subnet* that will act > as the common LAN foR both LAN A and LAN B. > > To re-iterate: > I have one router that is 10.1.1.1 and gives out DHCP 10.1.1.* and the > other router 192.168.0.1 that gives out DHCP 192.168.0.*. > I would like to leave these address spaces alone and define a new on > 10.30.1.* that computer from both networks can participate in effectively > forming a new virtual LAN. > > Is this possible with tinc? I know this possible with other software, I'm > just having hard time figuring out if this is something I can configure tinc > to do. > > Andrew > > > > > On 7/10/2010 1:13 p.m., Donald Pearson wrote: > > Sorry you're right. I was looking at the IP address schema where all nodes > would use the 10.30.0.0/24 network. > > There's no need to install tap adapters on the other devices. You have > basically 2 realistic options if you want the LAN function > > You can specify multiple IP addresses for a single interface, even in > Windows. You'll find this under the TCP/IP properties of the network > adapter. And clicking on the Advanced button on the page where you can set > a static IP or designate DHCP. > > A 2nd option would be to re-ip one of your locations so that they all use > the same subnet natively. > > Bridging the tap adapter allows your network frames received by your > physical interface to reach the TAP adapter and therefore traverse the VPN. > This enables later 2 connectivity, the same way a real switch does. Virtual > Ethernet over the Internet is how I like to describe it. This is how I have > my VPN configured personally. > > Without the bridge, a frame that is received at the physical interface has > the frame stripped off and the packet inspected. Now we're talking layer > 3. If the packet is destined for a network on the other side of the VPN, > your Tinc node frames the packet back up with a new frame, and sends it over > the VPN. This act of stripping the frame, reading the packet for the > network destination, and applying a new frame to get it there is what > Routing is. Without the bridge in place, your Tinc node is literally > routing between the physical interface and the tap interface. With the > bridge, you're creating a layer 2 pathway so the frames can shoot across > directly. Of course this means both sides need to be on the same subnet > which you obviously already know. > > Be warned that this configuration comes with it's drawbacks. DHCP will > traverse your VPN. I had location A computers getting addresses from > location B which makes for some really inefficient internet traffic. > > Regards, > Donald > On Wed, Oct 6, 2010 at 7:57 PM, Andrew Savinykh <[email protected]>wrote: > >> Donald, thank you for the explanation. >> >> I understand the part about the switch mode and absence of subnet in >> tinc.config. >> However, could you please explain what bridging the tap adapter will >> achieve and what kind of ip address will be used on tinc nodes and in the >> rest of the network. >> >> In my example one household has local network addresses of 192.168.1.* and >> the other has 10.1.1.* >> If we don't install tap interfaces on other PC's this means that the other >> PCs won't have another ip address. >> I understand that bridging is going to solve this somehow, but I still >> don't see how broadcast from 10.1.1.7 can reach 192.168.1.5 in the other >> LAN. >> >> In short I don't understand how bridging to adapters work. I'll try to >> google this topic to get a better understanding, meanwhile, could you please >> explain >> how this applies to our tinc configuration case. >> >> Also can you briefly describe what we achieve by setting PMTUDiscovery = >> Yes. I read the description in manual but it didn't tell me much. >> >> Thank you again for all your help, >> Andrew >> >> >> >> >> On 7/10/2010 11:40 a.m., Donald Pearson wrote: >> >> Oh okay. Yes you can make it appear as a single LAN. Your Tinc nodes >> will behave as bridges instead of routers (or gateways as you put it). >> >> Your tinc nodes will have the same subnet mask and default router as all >> your other devices at that location. >> >> You will need to run the add-tap script only on the tinc nodes on each >> side. >> >> You will then need to bridge the tap adapter to the local area connection >> on the tinc nodes on each side. >> >> This will create a bridge network object under your network connections. >> This bridge will have the IP configuration you illustrated. >> >> You have the right idea in segregating the IP distribution while still >> using the 255.255.255.0 subnet mask. >> >> One both nodes are up and connected, and the interfaces have been bridged >> on the Tinc nodes for each location, you will have a virtual LAN between the >> two locations. >> >> Your Tinc configuration will be Switch mode. This means no Subnet >> configurations are required in your tinc.conf >> >> Your tinc.conf will be something like >> >> Name = NodeA >> ConnectTo = NodeB >> Interface = <something> >> Mode = switch >> PrivateKeyFile = <path to the rsa_key.priv> >> >> Host files will be something like >> For the host file named "NodeA" >> >> Address = <host.dyndns.org> >> PMTUDiscovery = Yes >> >> --Begin RSA etc. etc.-- >> >> >> On Wed, Oct 6, 2010 at 6:17 PM, Andrew Savinykh <[email protected]>wrote: >> >>> Donald, >>> >>> thank you, while I still have some questions, your answer is definitely a >>> step in the right direction. >>> In the other reply I was asked what I'm trying to achieve. Let's consider >>> the following scenario (which is quite similar to the one that described in >>> the tinc manual). >>> >>> Let's assume we have two households, each has 3-5 computers in it. Both >>> house holds have similar network configuration: >>> They are connected to internet with an ADSL line and a router. >>> The computers in the local network access internet via the router. >>> The router is configured so that one of the computers have port 665 >>> forwarded to be accessible outside. >>> The external IP is changed rarely and there is dynamic DNS service >>> (external) in use to accommodate for the change of IP when it happens. >>> >>> One household has local network addresses of 192.168.1.* and the other >>> has 10.1.1.* >>> I'm installing tinc on one computer in each household. >>> >>> The goal is to let all computers in both house holds to see each other by >>> ip address. Also it is desired that for computer games purposes >>> all computers appear to be on the same LAN (for broadcasts). But this is >>> not mandatory. (it appears that it's not possible without installing tinc on >>> every PC >>> as every tinc daemon serves a subnet and two tinc daemons can't serve a >>> part of subnet each) >>> >>> All computers run different flavours of Windows, most being Windows 7. >>> >>> I have two ideas how to set this up, although I'm not sure if any of >>> these two works: >>> >>> IDEA1. >>> ===== >>> Household A >>> Gateway IP: 10.30.0.1 >>> Gateway Mask: 255.255.255.0 >>> Gateway Default Gateway: ???? >>> >>> Other PCs IP: 10.30.0.2,3,4 etc >>> Other PCs Mask: 255.255.255.0 >>> Other PCs Deafult Gateway: 10.30.0.1 >>> >>> Tinc Subnet: 10.30.0.0/25 >>> >>> Household B >>> Gateway IP: 10.30.0.129 >>> Gateway Mask: 255.255.255.0 >>> Gateway Default Gateway: ???? >>> >>> Other PCs IP: 10.30.0.130,131,132 etc >>> Other PCs Mask: 255.255.255.0 >>> Other PCs Default Gateway: 10.30.0.129 >>> >>> Tinc Subnet: 10.30.0.128/25 >>> >>> >>> IDEA2. >>> ===== >>> Household A >>> Gatway IP: 10.30.0.1 >>> Gateway Mask: 255.255.255.0 >>> Gateway Default Gateway: ???? >>> >>> Other PCs IP: 10.30.0.2-255 etc >>> Other PCs Mask: 255.255.255.0 >>> Other PCs Default Gateway: 10.30.0.1 >>> >>> Tinc Subnet: 10.30.0.0/24 >>> >>> Household B >>> Gateway IP: 10.30.1.1 >>> Gateway Mask: 255.255.255.0 >>> Gateway Default Gateway: ???? >>> >>> Other PCs IP: 10.30.1.2-255 etc >>> Other PCs Mask: 255.255.255.0 >>> Other PCs Default Gateway: 10.30.0.129 >>> >>> Tinc Subnet: 10.30.1.0/24 >>> >>> >>> So IDEA 1 probably won't work at all. Will it? And with IDEA 2 the pc's >>> won't appear on the same LAN and their broadcasts won't reach each other. >>> As far as I understand I need to install TAP interface on each of the >>> participating windows PCs, correct? >>> What is specified in default gateway of the gateways? >>> >>> >>> >>> Thank you in advance, >>> Andrew >>> >>> On 7/10/2010 4:36 a.m., Donald Pearson wrote: >>> >>> The PCs that you want to participate need to have a route for the VPN >>> subnet pointing to their local VPN gateway, which would be the local device >>> with Tinc installed on it. >>> >>> Theoretical configuration example. >>> >>> VPN subnet is 10.10.10.0/24 >>> >>> At a location, one computer 192.168.1.254/24 connects to the VPN and >>> serves as the VPN gateway. This gateway needs to be configured for TCP/IP >>> forwarding. >>> >>> http://support.microsoft.com/kb/315236 - windows >>> http://www.ducea.com/2006/08/01/how-to-enable-ip-forwarding-in-linux/ - >>> linux >>> >>> Other computers local to the gateway need a route to the VPN network >>> added so they know how to get there. >>> >>> In windows. route -p add 10.10.10.0 mask 255.255.255.0 192.168.1.254 >>> This will add the persistent route that remains after reboot. >>> >>> Does that answer your question? >>> >>> On Wed, Oct 6, 2010 at 6:41 AM, Andrew Savinykh <[email protected]>wrote: >>> >>>> Thank you for your reply. As far as I can see there is no point >>>> specifying subnet that consists of more than one PC in tinc config if you >>>> are going to install tinc on every PC in the subnet anyway. Correct me if >>>> I'm wrong. >>>> Now, assuming I'm right, there will be PCs in the subnet that don't have >>>> tinc installed on them. How to configure these PCs so they are a part of >>>> the >>>> subnet and participate in routing? >>>> >>>> Cheers, >>>> Andrew >>>> >>>> >>>> On 6/10/2010 10:13 p.m., Cédric Lemarchand wrote: >>>> >>>> Hi, >>>> >>>> I am not sure to understand what you mean with "joining" a subnet. >>>> >>>> But if your "local computer" need to reach the "remote subnet" served by >>>> tinc, you can set the local IP of the local tinc server as the default >>>> gateway, or add a route to the remote subnet via the local tinc IP. Of >>>> course, computer located on the remote subnet need the same thing. >>>> >>>> Cédric >>>> >>>> Le 06/10/10 09:37, Andrew Savinykh a écrit : >>>> >>>> Hello all, >>>> >>>> I understand that each tinc daemon corresponds to one or more subnets >>>> that it "owns" a subnet can be a single ip or more. >>>> Could you please tell me what do I need to do to join a computer in >>>> local network (windows) to a subnet served by tinc? >>>> >>>> Thank you in advance, >>>> Andrew >>>> >>>> >> >> _______________________________________________ >> tinc mailing list >> [email protected] >> http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc >> >> > > _______________________________________________ > tinc mailing > [email protected]http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc > > > > _______________________________________________ > tinc mailing list > [email protected] > http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc > >
_______________________________________________ tinc mailing list [email protected] http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
