5 ms·
As far as I understand, the killer feature of Tinc is automatic mesh routing. You can add a node to one instance and the information spreads through the network
by ZoomZoomZoom 7y ago
As far as I understand, the killer feature of Tinc is automatic mesh routing. You can add a node to one instance and the information spreads through the network, wireguard doesn't do that.
Also, I heard maintainers were contemplating replacing the protocol with Wireguard.
https://www.tinc-vpn.org/pipermail/tinc/2017-February/004755.html https://www.tinc-vpn.org/pipermail/tinc/2017-February/004755...
- tomberek 7y agoTinc as a manger of a mesh of Wireguard connections would be incredible.
- fulafel 7y agoIPsec also supports this - give certs signed by a mutually tusted CA to all nodes and they can all communicate host-to-host in a full mesh without needing to reconfigure when adding a host etc.
- hwh 7y agoCan you please elaborate? As far as I see it, IPsec is encrypting traffic. IKE is for setup of security associations. What part of IPsec would do routing, and in this case: potentially multi-hop mesh routing?
- fulafel 7y agoIKE obviously does the key management part, it's part of IPsec in this picture. There is no separate mesh routing in this scenario, everyone just uses normal internet routing and addressing.
- LinuxBender 7y agoWhat they mean is that with tinc, you can connect from node A to node Z without A and Z being directly connected. Tinc discovers who is connected to whom and will route through nodes to reach one another dynamically in user space. IPSec by itself can not do this without adding very complex route statements on each node and enabling packet forwarding. Tinc operates in user space and does not require kernel packet forwarding or any destination node specific route statements.