New 42-day free trial
Smarty

How to setup a tinc VPN

Jonathan Duncan
Jonathan Duncan
 | 
October 23, 2015
Tags
Smarty header pin graphic

I was given the task of setting up a tinc VPN so that we could test performance for comparison against other VPN systems. This task took much longer than it should have. For that reason, I am making this post to help me and others remember how to do it again in the future.


Installing tinc is straightforward enough. You can download the latest release and build it or install it from your favorite package manager.

The configuration for tinc lives in /etc/tinc. The configuration is what seems to be the hard part of getting tinc to work.

Here is what my final directory structure looked like:

/etc
	/smartynet
		/hosts
			master
			client
		rsa_key.priv
		tinc-down
		tinc-up
		tinc.conf

For this testing setup, I used two hosts. One of them I called master , and the other I called client. It is good to keep in mind that tinc uses a peer-to-peer model, not client/server.

To do the configuration, you will need to be root or at least use sudo for elevated privileges in order to work in the /etc directory.

Step 1

Setup the directory structure on both machines:

# mkdir -p /etc/tinc/smartynet/hosts/

Step 2

Create the /etc/tinc/smartynet/tinc.conf file on both machines.

# ------- master -------
Name = master
Device = /dev/net/tun
# ------- client -------
Name = client
Device = /dev/net/tun
ConnectTo = master

Note: ConnectTo is optional. If this field is not specified, tinc will still listen for connections but will not try to connect to any other node.

Step 3

Create the public and private keypair on both machines:

# tincd -n smartynet -K

This command will create the keys and put them in the following files for you:

/etc/tinc/smartynet/rsa_key.priv
/etc/tinc/smartynet/hosts/master # on the master host
-- or --
/etc/tinc/smartynet/hosts/client # on the client host

Step 4

Add host addresses to the host files that tinc created:

# ------- master -------
# /etc/tinc/smartynet/hosts/master
Address = 198.198.198.198
Subnet = 10.0.7.1/32
# Public key goes below here
# ------- client -------
# /etc/tinc/smartynet/hosts/client
Subnet = 10.0.7.2/32
# Public key goes below here

Note: The Address in the master host file should be the public address of the host machine.

Step 5

Copy host files to the other hosts.

From the master you will copy the /etc/tinc/smartynet/hosts/master file to the client machine, and put it in exactly the same location: /etc/tinc/smartynet/hosts/master.

From the client you will copy the /etc/tinc/smartynet/hosts/client file to the master machine, and put it in exactly the same location: /etc/tinc/smartynet/hosts/client.

Note: Make sure to copy the entire contents of the host files, including the public key that tinc put in them.

Step 6

Create network interface control scripts. There are two files I used that react when tinc switches from online to offline. The files are nearly identical on both hosts, except for the interface address.

# /etc/tinc/smartynet/tinc-up
ifconfig $INTERFACE 10.0.7.1 netmask 255.255.255.0
# /etc/tinc/smartynet/tinc-down
ifconfig $INTERFACE down

Note: remember to change the IP address in the tinc-up script to match the address found in the host file.

Once the interface control scripts are created, change their mode to be executable:

# chmod u+x /etc/tinc/smartynet/tinc-*

Step 7

Start the VPN.

One thing you may need to do before running the VPN is to disable any firewall, or even take the time to punch a hole in it specifically for VPN traffic. I just disabled ufw while I was testing. The VPN did not work for me while the firewall was on.

# ufw disable

You may now commence primary ignition on both hosts:

# tincd -n smartynet -d3

Note: The optional -d switch sets the debug level.

The tinc VPN should now be running. You should be able to run ifconfig and see the new interface that was created for the VPN traffic. You should also be able to ping and even ssh from one host to the other using the private IP addresses that you chose.


For reference, here are all of the files I used for both hosts:

------- files on master -------

======= /etc/tinc/smartynet/tinc.conf =======
Name = master
Device = /dev/net/tun

======= /etc/tinc/smartynet/tinc-up =======
ifconfig $INTERFACE 10.0.7.1 netmask 255.255.255.0

======= /etc/tinc/smartynet/tinc-down =======
ifconfig $INTERFACE down

======= /etc/tinc/smartynet/hosts/master =======
Address = 198.198.198.198
Subnet = 10.0.7.1/32

-----BEGIN RSA PUBLIC KEY-----
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-----END RSA PUBLIC KEY-----

======= /etc/tinc/smartynet/hosts/client =======
Subnet = 10.0.7.2/32

-----BEGIN RSA PUBLIC KEY-----
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-----END RSA PUBLIC KEY-----

------- files on client -------

======= /etc/tinc/smartynet/tinc.conf =======
Name = client
Device = /dev/net/tun
ConnectTo = master

======= /etc/tinc/smartynet/tinc-up =======
ifconfig $INTERFACE 10.0.7.2 netmask 255.255.255.0

======= /etc/tinc/smartynet/tinc-down =======
ifconfig $INTERFACE down

======= /etc/tinc/smartynet/hosts/master =======
Address = 198.198.198.198
Subnet = 10.0.7.1/32

-----BEGIN RSA PUBLIC KEY-----
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-----END RSA PUBLIC KEY-----

======= /etc/tinc/smartynet/hosts/client =======
Subnet = 10.0.7.2/32

-----BEGIN RSA PUBLIC KEY-----
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-----END RSA PUBLIC KEY-----

Take a look at the official tinc manual for many more details on how to use this tool.

Subscribe to our blog!
Learn more about RSS feeds here.
rss feed icon
Subscribe Now
Read our recent posts
Improving user/customer experience in every industry with clean address data
Arrow Icon
You finally track down an essential addition to your collector’s set of [insert item of your choice], and you're hyped to buy it until the chaos begins. The cart is hidden in a fly-out on the side, cluttered with blocky, overwhelming text. You spend way too long just trying to find the "Proceed to Checkout" button. 👎 That’s bad UI (user interface): messy, confusing design that makes navigation a chore. You make it to the checkout and start entering your info, but the site keeps rejecting your address.
Dashboard essentials for Smarty users
Arrow Icon
The Smarty dashboard is your central hub for managing address verification, geocoding, and property data services. Whether you're just starting or looking to optimize your current setup, understanding the dashboard's full capabilities can significantly streamline your address data operations. We recently held a webinar in which we reviewed all of the Smarty dashboard's items and features. Missed it? That's OK; we've got all the information right here. You can expect to read about:Accessing your dashboardSetting up your account for successUnderstanding your active subscriptionsManaging API keys effectivelyStreamlining billing and financial managementStaying informed with smart notificationsTeam management and access controlsWeb toolsMaking the most of free trialsKey takeawaysLet’s get going!Accessing your dashboardGetting to your dashboard is straightforward.
Take charge of your API usage with Smarty’s key management features
Arrow Icon
Ever wondered, “Where did all my lookups go?!” Without proper API management, you may burn through your lookups quicker, experience runaway code, and encounter unexpected usage. That’s why Smarty created usage by key (included in all annual plans) and limit by key (included in some plans; you can add them by contacting sales) for its APIs. Why key management mattersCommon API usage challenges (problems to solve):Unexpected spikes in lookupsDifficulty tracking specific key usageWhich keys are calling which Smarty licenseNeed for better control over API consumptionDifficulty allocating Smarty lookups across an organizationWith Smarty's key management features, you gain more control by having better visibility of your usage, eliminating the element of surprise (you know, the bad kind, like when you’re suddenly out of lookups).

Ready to get started?