howto/tinc.md
... ...
@@ -0,0 +1,83 @@
1
+[Tinc](http://www.tinc-vpn.org/) is a mesh-able vpn. It allows multiple parties to connect and discover each other independently, with no single point of failure. Tinc will try to find the shortest path to the other side but can also tunnel traffic over a third node, if 2 peers cannot reach each other directly. Tinc is in use by the Freifunk community where it powers [ICVPN](https://github.com/freifunk/icvpn).
2
+
3
+Tinc operates in 2 modes: router and switch. In Router mode each peer announce a subnet it serves. Tinc will act as a Layer3 network. This is the default mode, but unsuitable for dn42, because you cannot influence how tinc will route to a certain network. In Switch mode tinc will act like a Layer2 network. Each peer gets a MAC address assigned.
4
+
5
+One advantage of tinc is that you can have multiple peering over the same VPN configuration by opening multiple connections.
6
+
7
+
8
+## Configuration
9
+
10
+Example `/etc/tinc/tinc.conf`:
11
+
12
+```
13
+Name = host1
14
+Mode = switch
15
+# To discover other hosts,
16
+# it is required to initially
17
+# specify a number of hosts to connect to.
18
+# ConnectTo can be specified multiple times.
19
+ConnectTo = host2
20
+```
21
+
22
+Tinc requires to add manually ip addresses and routes to the tap/tun interfaces. On startup it will execute `/etc/tinc/tinc-up` if it exists and is executable:
23
+
24
+Example `/etc/tinc/tinc-up`:
25
+```
26
+#!/bin/sh
27
+
28
+# these lines differs depending on the operating system in use
29
+# on linux the following will work.
30
+# INTERFACE is an environmental variable set by tinc, when executing this script
31
+ip link set dev $INTERFACE up
32
+# to peer over tinc it is convenient to an transfer net, which is exclusively on this link;
33
+# this way you don't have to specify routes for each peer.
34
+# the transfer network does not need to be part of dn42,
35
+# you can also pick a network from 192.168.0.0/14 range
36
+ip addr add dev $INTERFACE 192.168.41.1/24 scope link
37
+# for ipv6 you can use fixed link-local addresses
38
+ip addr add dev $INTERFACE fe80::1/64
39
+```
40
+
41
+For authentication tinc uses public key authentication instead of certificates or pre-shared keys.
42
+For each key tinc should connect to or allow to connect, a file with the name of the peer in tincd -n twwh -K
43
+is required. To generate a public/private key pair use:
44
+
45
+```
46
+$ tincd -K
47
+```
48
+
49
+Import for each other party the key like this `/etc/tinc/hosts/<peername>`:
50
+
51
+```
52
+# Address and Port can be also skipped,
53
+# in this case the other side has to make an attempt to connect.
54
+Address = <ip_or_dns_name>
55
+Port = <port_if_different_from_655>
56
+-----BEGIN RSA PUBLIC KEY-----
57
+MIIBCgKCAQEAoGeD5b1HKW2UAFpIPayxsOOYx5qC0oHrJnvcPH33jnDBGiOYJ9ma
58
+QZErWdF0Qsnqh/wJE6i569fzKWOUdLHrN5dVzD/Q5zjMOwJf3rmcerS0oAFTxKDj
59
+pkw2kKcLA/lSNMIN//W66mM258BLo1XgEraUx5RcJ4hTxawhNTn0NTJVCbfUX6e5
60
+tcJpbgbYRzBTUPdSL3OB8k0qlmFI2ZYTnCzOSpgxRQARIB1ecoqOYVxQISK2pzxi
61
+MHQQlVbquwldaKiVoj7tD7PFW4oQxpiMHZnHIA6dnZCsT3ktTOzCjhf2XMi8o8u5
62
+P9C5dYrmVWrVAWQznlbuq/w1z+PrTYquoQIDAQAB
63
+-----END RSA PUBLIC KEY-----
64
+```
65
+
66
+
67
+## Fun with tinc-pre
68
+
69
+The current development version (which is pretty stable by the way), allow to bootstrap networks using by invitation urls. Instead of rsa keys it uses additionally ed25519 keys. It also introduces a tinc command in addition to tincd, which allows tinc to be configured via an readline interface:
70
+
71
+On one node which is already part of the network use:
72
+```
73
+$ tinc invite foo
74
+<ip-or-address>/nIRp5pJCnfnhuV13JUomscGs1q5HqEbz3AydZer7wRaMcpUB
75
+```
76
+
77
+On the other node you can join by using:
78
+
79
+```
80
+$ tinc join <invitation-url>
81
+```
82
+
83
+This node will then automatically generate configuration, private/public keys and will exchange this key with the other node on connection.
... ...
\ No newline at end of file