3 ms·
This is great news, and I'm looking forward to giving it a try once it's released as part of the kernel. I've been using tinc[1] for several years now, and it'
by imiric 7y ago
This is great news, and I'm looking forward to giving it a try once it's released as part of the kernel.
I've been using tinc[1] for several years now, and it's been very simple to configure and use. Similarly to WG, it can tunnel over UDP, but also over TCP, supports router or switch modes, NAT traversal, etc. It's a great project, but not very popular and I'm concerned about its maintenance and security issues moving forward.
To someone who's used both projects: can WG today be a drop-in replacement for tinc?
[1]: https://tinc-vpn.org/ https://tinc-vpn.org/
- ZoomZoomZoom 7y agoAs far as I understand, the killer feature of Tinc is automatic mesh routing. You can add a node to one instance and the information spreads through the network, wireguard doesn't do that. Also, I heard maintainers were contemplating replacing the protocol with Wireguard. https://www.tinc-vpn.org/pipermail/tinc/2017-February/004755.html https://www.tinc-vpn.org/pipermail/tinc/2017-February/004755...
- tomberek 7y agoTinc as a manger of a mesh of Wireguard connections would be incredible.
- fulafel 7y agoIPsec also supports this - give certs signed by a mutually tusted CA to all nodes and they can all communicate host-to-host in a full mesh without needing to reconfigure when adding a host etc.
- hwh 7y agoCan you please elaborate? As far as I see it, IPsec is encrypting traffic. IKE is for setup of security associations. What part of IPsec would do routing, and in this case: potentially multi-hop mesh routing?
- fulafel 7y agoIKE obviously does the key management part, it's part of IPsec in this picture. There is no separate mesh routing in this scenario, everyone just uses normal internet routing and addressing.
- LinuxBender 7y agoWhat they mean is that with tinc, you can connect from node A to node Z without A and Z being directly connected. Tinc discovers who is connected to whom and will route through nodes to reach one another dynamically in user space. IPSec by itself can not do this without adding very complex route statements on each node and enabling packet forwarding. Tinc operates in user space and does not require kernel packet forwarding or any destination node specific route statements.