3 ms·

So what exactly does mesh VPN mean in this context? Because my need is to ensure that three portable devices (2 laptops, 1 android phone) always have access to

So what exactly does mesh VPN mean in this context? Because my need is to ensure that three portable devices (2 laptops, 1 android phone) always have access to the same private LAN and any services hosted by the devices on that LAN. Today I use a hub-and-spoke design with wireguard to achieve this, because I never know where these devices will be so I can't guarantee that I can forward ports to them through a firewall. Does tinc solve that port forwarding problem? I've read the intro in the manual but it only says tinc is a regular VPN.

detaro 3y ago
"Mesh VPN" means that if two devices want to communicate, it will attempt to establish a direct VPN connection between them. E.g. if you have a central server X and 3 "mobile" devices A, B and C, it's enough that ABC can talk to X, they will automatically learn about each other and when e.g. A wants to talk to B it will attempt to establish a direct tunnel between them, coordinating through X, including attempting to punch holes through NAT if needed. If that fails, it falls back to sending traffic through X. (And X could be more than one device too)
dspillett 3y ago
> Does tinc solve that port forwarding problem? From the features list: “Regardless of how you set up the tinc daemons to connect to each other, VPN traffic is always (if possible) sent directly to the destination, without going through intermediate hops.” and “As long as one node in the VPN allows incoming connections on a public IP address (even if it is a dynamic IP address), tinc will be able to do NAT traversal, allowing direct communication between peers.” So yes, it gets around that problem if you have at least one publicly connectable node. How it does this if that node doesn't have a fixed address I've not looked into. Also there are no doubt NAT arrangements that it can't punch through meaning it'll have to fall-back to something akin to your hub model with nodes affected by such NAT talking to each other through another node.
blueflow 3y ago
> Does tinc solve that port forwarding problem? Yes. I use it in production for that exact purpose. It only requires that one node is reachable via public IP address. An advantage that tinc has over wireguard is that it can do local discovery and direct communication if your devices happen to be in the same local network.
- INTPenis 3y ago
  So it's no different from the setup I have today with a hub VPS then. Since my portable devices are always on the move, I must have a VPS to remain publicly accessible. Just like tinc.
  - admax88qqq 3y ago
    It's different in that two portable devices can negotiate a direct connection without having to route all traffic through your VPS. The VPS is still used as a central discovery location, but remote devices can learn about each other and talk directly to eachother.

detaro 3y ago

"Mesh VPN" means that if two devices want to communicate, it will attempt to establish a direct VPN connection between them. E.g. if you have a central server X and 3 "mobile" devices A, B and C, it's enough that ABC can talk to X, they will automatically learn about each other and when e.g. A wants to talk to B it will attempt to establish a direct tunnel between them, coordinating through X, including attempting to punch holes through NAT if needed. If that fails, it falls back to sending traffic through X. (And X could be more than one device too)

dspillett 3y ago

> Does tinc solve that port forwarding problem? From the features list: “Regardless of how you set up the tinc daemons to connect to each other, VPN traffic is always (if possible) sent directly to the destination, without going through intermediate hops.” and “As long as one node in the VPN allows incoming connections on a public IP address (even if it is a dynamic IP address), tinc will be able to do NAT traversal, allowing direct communication between peers.” So yes, it gets around that problem if you have at least one publicly connectable node. How it does this if that node doesn't have a fixed address I've not looked into. Also there are no doubt NAT arrangements that it can't punch through meaning it'll have to fall-back to something akin to your hub model with nodes affected by such NAT talking to each other through another node.

blueflow 3y ago

> Does tinc solve that port forwarding problem? Yes. I use it in production for that exact purpose. It only requires that one node is reachable via public IP address. An advantage that tinc has over wireguard is that it can do local discovery and direct communication if your devices happen to be in the same local network.

INTPenis 3y ago
So it's no different from the setup I have today with a hub VPS then. Since my portable devices are always on the move, I must have a VPS to remain publicly accessible. Just like tinc.
- admax88qqq 3y ago
  It's different in that two portable devices can negotiate a direct connection without having to route all traffic through your VPS. The VPS is still used as a central discovery location, but remote devices can learn about each other and talk directly to eachother.