What version of tinc are you using? tinc 1.1 already does what you want out of the box: packets sent from node A to node B through node C will use a key that A and B will negotiate between themselves. C doesn't have the key, and will act as a blind relay. C will not be able to decipher the packets flowing between A and B.
This is different from tinc 1.0, where C would have to decipher the packet in order to determine what its final destination is. In tinc 1.1 that routing information is sent in cleartext so that C can forward the packet without having to decipher it. On 2 September 2016 at 09:40, Armin <[email protected]> wrote: > Hello all, > > as written in my other posts, I have a setup of about seven > hosts. Two of them (A and B) use StrictSubnets and an own routing via > a special host (C), because C has better connection to the A and B than a > direct A-B connection. > > Host C is in a place where I need to create special security settings. > The VPN encrypted data shall not be available on host C. > There is no need for host C be in routing of tinc vpn, it just shall > forward the encrypted packets to another host when needed. > > Is it possible to setup a host as part of a tinc network without the > access to the packets (decrypted)? > Or do I need to setup some other kind of tunnel for this? > > Armin > > _______________________________________________ > tinc mailing list > [email protected] > https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc >
_______________________________________________ tinc mailing list [email protected] https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
