4 ms·

I always found tinc rather difficult to set up. Have had a more convenient experience with zerotier one.

mrmattyboy 6y ago
I agree, but the actual simplicity (no meta server etc.) is amazing. I've found it to be incredibly reliable and low overhead. (I've been using for years for MySQL replication and docker across low latency WAN connections).
- minxomat 6y ago
  > incredibly reliable and low overhead I second that. It's one of those tools I keep coming back to. I've run production LDAP traffic through it, but also plenty of non-prod goofing around. It never let me down.
- hartzell 6y ago
  > I've found it to be incredibly reliable and low overhead. (I'm a bit confused which of tinc and zerotier in the parent post you're referring to....) By "it", you mean tinc, correct?
GekkePrutser 6y ago
I find it really easy actually. 2 lines in a config file. Create key (one command). Put server pubkey on client.. Put client pubkey on server. Restart both. Done. The network handles distribution of other clients' pubkeys in case they need to mesh. And it does this really well: I used to travel a lot in my last job. I'd stream movies from my server, and the first few secs it was stopping/starting and suddenly it would go smoothly. Eventually I became curious and did a wireshark. Guess what, it saw the high traffic and meshed both clients together even though they were both behind NAT! Really nice. Edit: Oh yeah you also have the ifup/ifdown files but they're always exactly the same except the IP. Really I don't find it hard at all. Having said all that I was looking at Zerotier, especially because the firewall rules you can set per tag. That's really nice. With tinc you have to handle that on each client. But I don't really like that the VL1 planet is always run by a third party. You can run your own Network Controller at VL2 level but not your own VL1 planet if I understand it correctly. I know, it can't do anything with that, but I just prefer having no dependencies on anyone. Nevertheless I will give it a try.. I don't see it being as simple as tinc, config-wise though! It is more powerful but that also makes it more complex.
- fcatus 6y ago
  they have a horrible documentation though. Even after downloading tinc via homebrew and port, the "tinc" directory and its associated files don't exist in the system.
  - GekkePrutser 6y ago
    Yes they're there! They're just not in /etc on a Mac - this is because you can't write there anymore in the latest macOS. Apple has locked that down a lot even before Catalina (system integrity protection) I think they're under /usr/local/opt or something.. This is a homebrew thing, nothing to do with tinc really. I'm not on my Mac now so I can't check, but they're definitely somewhere.
  - e12e 6y ago
    I tried to find out which udp/tcp ports need to be open for tinc to work, but could not find anything in the documentation?
zingmars 6y ago
Tinc 1.1 is actually fairly easy to set up - it's only a couple of commands for defining the name of the network, getting a link nodes can use to join etc. The only problem is that it's technically not a full release, so most distros don't carry it. Compiling isn't difficult (a simple ./configure && make && sudo make install), but it could be better. My only major issue with Tinc is lack of any central authority making it really niche - revoking keys seems to involve deleting them on each connected machine. Not fun. From what I can tell ZeroTier seems nice as long as you're okay with using ZeroTier's servers for things (a curious trend I've noticed - so called decentralised services will always be great until you want to have fully independent servers). Sure, you can find github issues telling it's possible to set up your own planets, but the software seems somewhat complex and there's no documentation for it, and moons (what is with this lame terminology anyway?) will ping ZeroTier by default.
- GekkePrutser 6y ago
  Oh thanks, I wasn't aware of that change in Tinc 1.1, I'll try it out. I'm indeed using the distro version, I compliled 1.1 once to have that network view (where you see which nodes are connected) but it wasn't that useful so I didn't bother with it. Didn't realise they simplified the joining also. Though I never thought the joining and revocation was all that difficult anyway. I just have 2 central servers which carry every key, and the others just need to have the server keys. Everything else gets distributed automatically. So keys for clients you can keep on your servers only. You don't have to delete it from all of your clients! I know tinc doesn't really have a client/server concept but I consider clients those devices that aren't publicly reachable (behind NAT) and not used in a ConnectTo statement. And yeah the centralised VL1 "Planet" server in ZeroTier also bothers me. I know it plays no part in the actual access rights to the network and it can't see the traffic content, but still. I just want to run it myself.
  - zingmars 6y ago
    yup, `sudo tinc -n %VPNNAME% invite %CLIENTNAME%` will generate an invite URL on the server side and `tinc join %INVITEURL%` will let you join it. It's definitely really easy now, but unfortunately it's being marked as a pre-release which sets tinc back a bit imho. As for revocation, I have a similar setup and I agree. My worry is that in a theoretical situation an attacker could get access to a network and then spread his key to the entire network and there's little you can do about it. For personal use it's fine (I use it), but because of this, I would be vary of using Tinc for some sort of production use (although I've heard of people doing it). Even if it's a big IF since you need to actually have an access to a node to generate an invite, the attack surface is still there and there's no good way to undo it.

I agree, but the actual simplicity (no meta server etc.) is amazing. I've found it to be incredibly reliable and low overhead. (I've been using for years for MySQL replication and docker across low latency WAN connections).

minxomat 6y ago
> incredibly reliable and low overhead I second that. It's one of those tools I keep coming back to. I've run production LDAP traffic through it, but also plenty of non-prod goofing around. It never let me down.
hartzell 6y ago
> I've found it to be incredibly reliable and low overhead. (I'm a bit confused which of tinc and zerotier in the parent post you're referring to....) By "it", you mean tinc, correct?

GekkePrutser 6y ago

I find it really easy actually. 2 lines in a config file. Create key (one command). Put server pubkey on client.. Put client pubkey on server. Restart both. Done. The network handles distribution of other clients' pubkeys in case they need to mesh. And it does this really well: I used to travel a lot in my last job. I'd stream movies from my server, and the first few secs it was stopping/starting and suddenly it would go smoothly. Eventually I became curious and did a wireshark. Guess what, it saw the high traffic and meshed both clients together even though they were both behind NAT! Really nice. Edit: Oh yeah you also have the ifup/ifdown files but they're always exactly the same except the IP. Really I don't find it hard at all. Having said all that I was looking at Zerotier, especially because the firewall rules you can set per tag. That's really nice. With tinc you have to handle that on each client. But I don't really like that the VL1 planet is always run by a third party. You can run your own Network Controller at VL2 level but not your own VL1 planet if I understand it correctly. I know, it can't do anything with that, but I just prefer having no dependencies on anyone. Nevertheless I will give it a try.. I don't see it being as simple as tinc, config-wise though! It is more powerful but that also makes it more complex.

fcatus 6y ago
they have a horrible documentation though. Even after downloading tinc via homebrew and port, the "tinc" directory and its associated files don't exist in the system.
- GekkePrutser 6y ago
  Yes they're there! They're just not in /etc on a Mac - this is because you can't write there anymore in the latest macOS. Apple has locked that down a lot even before Catalina (system integrity protection) I think they're under /usr/local/opt or something.. This is a homebrew thing, nothing to do with tinc really. I'm not on my Mac now so I can't check, but they're definitely somewhere.
- e12e 6y ago
  I tried to find out which udp/tcp ports need to be open for tinc to work, but could not find anything in the documentation?

zingmars 6y ago

Tinc 1.1 is actually fairly easy to set up - it's only a couple of commands for defining the name of the network, getting a link nodes can use to join etc. The only problem is that it's technically not a full release, so most distros don't carry it. Compiling isn't difficult (a simple ./configure && make && sudo make install), but it could be better. My only major issue with Tinc is lack of any central authority making it really niche - revoking keys seems to involve deleting them on each connected machine. Not fun. From what I can tell ZeroTier seems nice as long as you're okay with using ZeroTier's servers for things (a curious trend I've noticed - so called decentralised services will always be great until you want to have fully independent servers). Sure, you can find github issues telling it's possible to set up your own planets, but the software seems somewhat complex and there's no documentation for it, and moons (what is with this lame terminology anyway?) will ping ZeroTier by default.

GekkePrutser 6y ago
Oh thanks, I wasn't aware of that change in Tinc 1.1, I'll try it out. I'm indeed using the distro version, I compliled 1.1 once to have that network view (where you see which nodes are connected) but it wasn't that useful so I didn't bother with it. Didn't realise they simplified the joining also. Though I never thought the joining and revocation was all that difficult anyway. I just have 2 central servers which carry every key, and the others just need to have the server keys. Everything else gets distributed automatically. So keys for clients you can keep on your servers only. You don't have to delete it from all of your clients! I know tinc doesn't really have a client/server concept but I consider clients those devices that aren't publicly reachable (behind NAT) and not used in a ConnectTo statement. And yeah the centralised VL1 "Planet" server in ZeroTier also bothers me. I know it plays no part in the actual access rights to the network and it can't see the traffic content, but still. I just want to run it myself.
- zingmars 6y ago
  yup, `sudo tinc -n %VPNNAME% invite %CLIENTNAME%` will generate an invite URL on the server side and `tinc join %INVITEURL%` will let you join it. It's definitely really easy now, but unfortunately it's being marked as a pre-release which sets tinc back a bit imho. As for revocation, I have a similar setup and I agree. My worry is that in a theoretical situation an attacker could get access to a network and then spread his key to the entire network and there's little you can do about it. For personal use it's fine (I use it), but because of this, I would be vary of using Tinc for some sort of production use (although I've heard of people doing it). Even if it's a big IF since you need to actually have an access to a node to generate an invite, the attack surface is still there and there's no good way to undo it.