Hi,
I am using tinc 1.0.23 in router mode and am having trouble with
intermittent TCP connect timeouts that do not occur when routing the TCP
over the internet directly.
I am using a pure IPv6 setup (i.e direct IPv6 connections, and tunneled
IPv6 subnets).
My configs are as follows:
Site 1:
-----------------------
tinc.conf:
Name = rsukmhb
AddressFamily = ipv6
BindToAddress = 2001:1b40:5000:19::2
ConnectTo = rps
IffOneQueue = yes
tinc-up:
#!/bin/sh
logger -t tinc Bringing up interface $INTERFACE
ip -6 link set "$INTERFACE" up
ip -6 link set "$INTERFACE" txqueuelen 10
ip -6 addr add fdd1:c52a:3c24:3384::2/64 dev "$INTERFACE"
subnet-up:
#!/bin/sh
[ -z "$NAME" ] && exit 0
[ "$NAME" = "$NODE" ] && exit 0
logger -t tinc Adding route to $SUBNET for $NODE on $NAME
ip -6 route replace $SUBNET dev $INTERFACE
Site 2:
-----------------------
tinc.conf:
Name = rps
AddressFamily = ipv6
BindToAddress = 2001:1b40:5000:9::2
ConnectTo = rsukmhb
IffOneQueue = yes
tinc-up:
#!/bin/sh
logger -t tinc Bringing up interface $INTERFACE
ip -6 link set "$INTERFACE" up
ip -6 link set "$INTERFACE" txqueuelen 10
ip -6 addr add fdd1:c52a:3c24:3384::1/64 dev "$INTERFACE
subnet-up:
#!/bin/sh
[ -z "$NAME" ] && exit 0
[ "$NAME" = "$NODE" ] && exit 0
logger -t tinc Adding route to $SUBNET for $NODE on $NAME
ip -6 route replace $SUBNET dev $INTERFACE
The VPN tun interfaces use private IPv6 IP addresses in the
fdd1:c52a:3c24:3384::/64 range.
I am then using the host entries at each site to advertise an IPv6 /64
subnet used internally (although still publically routable address
subnet) so that it is routed over the VPN tunnel to the other side.
This is working pretty well and I am getting around 80MBits/sec
throughput.
However we have an cron process that runs every 1 minute and makes
several HTTP requests over the VPN every 10s.
About 10-12 times a day we are getting these errors after the specified
5 second connect timeout set in the app.
Request failed: connect() timed out!
If we disable the VPN and just route the requests over the internet (as
I said they are publically routable addresses) then we do not see these
errors, suggesting this is not an application problem.
We are also running Cacti and Nagios over the VPN for monitoring the
remote site.
The traffic level is low, averaging about 20 kbps, but quiet bursty, as
every few minutes nagios/cacti runs, and the rest of the time the tunnel
is quiet except for this cron app that makes a very small HTTP request
every 10s.
Do you know what I could be looking at to fix this?
I have found these posts that suggest a similar connect() timeout
issue:
Page 12 of this doc:
http://tinc-vpn.org/presentations/fosdem-2011/ec2_vpn_fosdem2011.pdf
http://thr3ads.net/tinc-devel/2010/10/1964008-Tweaks-for-high-bandwidth-tinc
I have tried disabled replay protection, setting IffOneQueue, lowering
and increasing the txqueuelen, setting priority of the tinc process.
None of these settings have improved things though.
Any thoughts would be much appreciated.
Thanks
Tom
_______________________________________________
tinc mailing list
[email protected]
http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
