> Every node can connect to every other one. At the Tinc level, they can't connect to you unless you have their public key configured locally. At the IP level

> Every node can connect to every other one. At the Tinc level, they can't connect to you unless you have their public key configured locally. At the IP level, set 'StrictSubnets = yes' in the main config file to prevent nodes not explicitly configured locally to send packets to you.