Import Upstream version 1.1~pre3
This commit is contained in:
Guus Sliepen
parent
02de1cd2f1
commit
34d5939212
136 changed files with 13943 additions and 4867 deletions
|
|
@ -23,16 +23,16 @@ texi2html: tinc.texi
|
|||
texi2html -split=chapter tinc.texi
|
||||
|
||||
tincd.8.html: tincd.8
|
||||
w3mman2html $< > $@
|
||||
w3mman2html $? > $@
|
||||
|
||||
tincctl.8.html: tincctl.8
|
||||
w3mman2html $< > $@
|
||||
w3mman2html $? > $@
|
||||
|
||||
tinc-gui.8.html: tinc-gui.8
|
||||
w3mman2html $< > $@
|
||||
w3mman2html $? > $@
|
||||
|
||||
tinc.conf.5.html: tinc.conf.5
|
||||
w3mman2html $< > $@
|
||||
w3mman2html $? > $@
|
||||
|
||||
substitute = sed \
|
||||
-e s,'@PACKAGE\@',"$(PACKAGE)",g \
|
||||
|
|
@ -41,18 +41,18 @@ substitute = sed \
|
|||
-e s,'@localstatedir\@',"$(localstatedir)",g
|
||||
|
||||
tincd.8: tincd.8.in
|
||||
$(substitute) $< > $@
|
||||
$(substitute) $? > $@
|
||||
|
||||
tincctl.8: tincctl.8.in
|
||||
$(substitute) $< > $@
|
||||
$(substitute) $? > $@
|
||||
|
||||
tinc-gui.8: tinc-gui.8.in
|
||||
$(substitute) $< > $@
|
||||
$(substitute) $? > $@
|
||||
|
||||
tinc.conf.5: tinc.conf.5.in
|
||||
$(substitute) $< > $@
|
||||
$(substitute) $? > $@
|
||||
|
||||
tincinclude.texi: tincinclude.texi.in
|
||||
$(substitute) $< > $@
|
||||
$(substitute) $? > $@
|
||||
|
||||
tinc.texi: tincinclude.texi
|
||||
|
|
|
|||
152
doc/Makefile.in
152
doc/Makefile.in
|
|
@ -1,9 +1,9 @@
|
|||
# Makefile.in generated by automake 1.11.1 from Makefile.am.
|
||||
# Makefile.in generated by automake 1.11.6 from Makefile.am.
|
||||
# @configure_input@
|
||||
|
||||
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
|
||||
# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation,
|
||||
# Inc.
|
||||
# 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free Software
|
||||
# Foundation, Inc.
|
||||
# This Makefile.in is free software; the Free Software Foundation
|
||||
# gives unlimited permission to copy and/or distribute it,
|
||||
# with or without modifications, as long as this notice is preserved.
|
||||
|
|
@ -15,6 +15,23 @@
|
|||
|
||||
@SET_MAKE@
|
||||
VPATH = @srcdir@
|
||||
am__make_dryrun = \
|
||||
{ \
|
||||
am__dry=no; \
|
||||
case $$MAKEFLAGS in \
|
||||
*\\[\ \ ]*) \
|
||||
echo 'am--echo: ; @echo "AM" OK' | $(MAKE) -f - 2>/dev/null \
|
||||
| grep '^AM OK$$' >/dev/null || am__dry=yes;; \
|
||||
*) \
|
||||
for am__flg in $$MAKEFLAGS; do \
|
||||
case $$am__flg in \
|
||||
*=*|--*) ;; \
|
||||
*n*) am__dry=yes; break;; \
|
||||
esac; \
|
||||
done;; \
|
||||
esac; \
|
||||
test $$am__dry = yes; \
|
||||
}
|
||||
pkgdatadir = $(datadir)/@PACKAGE@
|
||||
pkgincludedir = $(includedir)/@PACKAGE@
|
||||
pkglibdir = $(libdir)/@PACKAGE@
|
||||
|
|
@ -38,7 +55,8 @@ ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
|
|||
am__aclocal_m4_deps = $(top_srcdir)/m4/attribute.m4 \
|
||||
$(top_srcdir)/m4/curses.m4 $(top_srcdir)/m4/libevent.m4 \
|
||||
$(top_srcdir)/m4/lzo.m4 $(top_srcdir)/m4/openssl.m4 \
|
||||
$(top_srcdir)/m4/zlib.m4 $(top_srcdir)/configure.in
|
||||
$(top_srcdir)/m4/readline.m4 $(top_srcdir)/m4/zlib.m4 \
|
||||
$(top_srcdir)/configure.in
|
||||
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
|
||||
$(ACLOCAL_M4)
|
||||
mkinstalldirs = $(install_sh) -d
|
||||
|
|
@ -59,6 +77,11 @@ TEXI2PDF = $(TEXI2DVI) --pdf --batch
|
|||
MAKEINFOHTML = $(MAKEINFO) --html
|
||||
AM_MAKEINFOHTMLFLAGS = $(AM_MAKEINFOFLAGS)
|
||||
DVIPS = dvips
|
||||
am__can_run_installinfo = \
|
||||
case $$AM_UPDATE_INFO_DIR in \
|
||||
n|no|NO) false;; \
|
||||
*) (install-info --version) >/dev/null 2>&1;; \
|
||||
esac
|
||||
am__installdirs = "$(DESTDIR)$(infodir)" "$(DESTDIR)$(man5dir)" \
|
||||
"$(DESTDIR)$(man8dir)"
|
||||
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
|
||||
|
|
@ -82,6 +105,12 @@ am__nobase_list = $(am__nobase_strip_setup); \
|
|||
am__base_list = \
|
||||
sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
|
||||
sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
|
||||
am__uninstall_files_from_dir = { \
|
||||
test -z "$$files" \
|
||||
|| { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
|
||||
|| { echo " ( cd '$$dir' && rm -f" $$files ")"; \
|
||||
$(am__cd) "$$dir" && rm -f $$files; }; \
|
||||
}
|
||||
man5dir = $(mandir)/man5
|
||||
man8dir = $(mandir)/man8
|
||||
NROFF = nroff
|
||||
|
|
@ -140,6 +169,7 @@ PACKAGE_URL = @PACKAGE_URL@
|
|||
PACKAGE_VERSION = @PACKAGE_VERSION@
|
||||
PATH_SEPARATOR = @PATH_SEPARATOR@
|
||||
RANLIB = @RANLIB@
|
||||
READLINE_LIBS = @READLINE_LIBS@
|
||||
SET_MAKE = @SET_MAKE@
|
||||
SHELL = @SHELL@
|
||||
STRIP = @STRIP@
|
||||
|
|
@ -304,9 +334,7 @@ uninstall-html-am:
|
|||
|
||||
uninstall-info-am:
|
||||
@$(PRE_UNINSTALL)
|
||||
@if test -d '$(DESTDIR)$(infodir)' && \
|
||||
(install-info --version && \
|
||||
install-info --version 2>&1 | sed 1q | grep -i -v debian) >/dev/null 2>&1; then \
|
||||
@if test -d '$(DESTDIR)$(infodir)' && $(am__can_run_installinfo); then \
|
||||
list='$(INFO_DEPS)'; \
|
||||
for file in $$list; do \
|
||||
relfile=`echo "$$file" | sed 's|^.*/||'`; \
|
||||
|
|
@ -379,11 +407,18 @@ maintainer-clean-aminfo:
|
|||
done
|
||||
install-man5: $(man_MANS)
|
||||
@$(NORMAL_INSTALL)
|
||||
test -z "$(man5dir)" || $(MKDIR_P) "$(DESTDIR)$(man5dir)"
|
||||
@list=''; test -n "$(man5dir)" || exit 0; \
|
||||
{ for i in $$list; do echo "$$i"; done; \
|
||||
l2='$(man_MANS)'; for i in $$l2; do echo "$$i"; done | \
|
||||
sed -n '/\.5[a-z]*$$/p'; \
|
||||
@list1=''; \
|
||||
list2='$(man_MANS)'; \
|
||||
test -n "$(man5dir)" \
|
||||
&& test -n "`echo $$list1$$list2`" \
|
||||
|| exit 0; \
|
||||
echo " $(MKDIR_P) '$(DESTDIR)$(man5dir)'"; \
|
||||
$(MKDIR_P) "$(DESTDIR)$(man5dir)" || exit 1; \
|
||||
{ for i in $$list1; do echo "$$i"; done; \
|
||||
if test -n "$$list2"; then \
|
||||
for i in $$list2; do echo "$$i"; done \
|
||||
| sed -n '/\.5[a-z]*$$/p'; \
|
||||
fi; \
|
||||
} | while read p; do \
|
||||
if test -f $$p; then d=; else d="$(srcdir)/"; fi; \
|
||||
echo "$$d$$p"; echo "$$p"; \
|
||||
|
|
@ -412,16 +447,21 @@ uninstall-man5:
|
|||
sed -n '/\.5[a-z]*$$/p'; \
|
||||
} | sed -e 's,.*/,,;h;s,.*\.,,;s,^[^5][0-9a-z]*$$,5,;x' \
|
||||
-e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,'`; \
|
||||
test -z "$$files" || { \
|
||||
echo " ( cd '$(DESTDIR)$(man5dir)' && rm -f" $$files ")"; \
|
||||
cd "$(DESTDIR)$(man5dir)" && rm -f $$files; }
|
||||
dir='$(DESTDIR)$(man5dir)'; $(am__uninstall_files_from_dir)
|
||||
install-man8: $(man_MANS)
|
||||
@$(NORMAL_INSTALL)
|
||||
test -z "$(man8dir)" || $(MKDIR_P) "$(DESTDIR)$(man8dir)"
|
||||
@list=''; test -n "$(man8dir)" || exit 0; \
|
||||
{ for i in $$list; do echo "$$i"; done; \
|
||||
l2='$(man_MANS)'; for i in $$l2; do echo "$$i"; done | \
|
||||
sed -n '/\.8[a-z]*$$/p'; \
|
||||
@list1=''; \
|
||||
list2='$(man_MANS)'; \
|
||||
test -n "$(man8dir)" \
|
||||
&& test -n "`echo $$list1$$list2`" \
|
||||
|| exit 0; \
|
||||
echo " $(MKDIR_P) '$(DESTDIR)$(man8dir)'"; \
|
||||
$(MKDIR_P) "$(DESTDIR)$(man8dir)" || exit 1; \
|
||||
{ for i in $$list1; do echo "$$i"; done; \
|
||||
if test -n "$$list2"; then \
|
||||
for i in $$list2; do echo "$$i"; done \
|
||||
| sed -n '/\.8[a-z]*$$/p'; \
|
||||
fi; \
|
||||
} | while read p; do \
|
||||
if test -f $$p; then d=; else d="$(srcdir)/"; fi; \
|
||||
echo "$$d$$p"; echo "$$p"; \
|
||||
|
|
@ -450,9 +490,7 @@ uninstall-man8:
|
|||
sed -n '/\.8[a-z]*$$/p'; \
|
||||
} | sed -e 's,.*/,,;h;s,.*\.,,;s,^[^8][0-9a-z]*$$,8,;x' \
|
||||
-e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,'`; \
|
||||
test -z "$$files" || { \
|
||||
echo " ( cd '$(DESTDIR)$(man8dir)' && rm -f" $$files ")"; \
|
||||
cd "$(DESTDIR)$(man8dir)" && rm -f $$files; }
|
||||
dir='$(DESTDIR)$(man8dir)'; $(am__uninstall_files_from_dir)
|
||||
tags: TAGS
|
||||
TAGS:
|
||||
|
||||
|
|
@ -523,10 +561,15 @@ install-am: all-am
|
|||
|
||||
installcheck: installcheck-am
|
||||
install-strip:
|
||||
$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
|
||||
install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
|
||||
`test -z '$(STRIP)' || \
|
||||
echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install
|
||||
if test -z '$(STRIP)'; then \
|
||||
$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
|
||||
install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
|
||||
install; \
|
||||
else \
|
||||
$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
|
||||
install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
|
||||
"INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
|
||||
fi
|
||||
mostlyclean-generic:
|
||||
|
||||
clean-generic:
|
||||
|
|
@ -565,8 +608,11 @@ install-dvi: install-dvi-am
|
|||
|
||||
install-dvi-am: $(DVIS)
|
||||
@$(NORMAL_INSTALL)
|
||||
test -z "$(dvidir)" || $(MKDIR_P) "$(DESTDIR)$(dvidir)"
|
||||
@list='$(DVIS)'; test -n "$(dvidir)" || list=; \
|
||||
if test -n "$$list"; then \
|
||||
echo " $(MKDIR_P) '$(DESTDIR)$(dvidir)'"; \
|
||||
$(MKDIR_P) "$(DESTDIR)$(dvidir)" || exit 1; \
|
||||
fi; \
|
||||
for p in $$list; do \
|
||||
if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
|
||||
echo "$$d$$p"; \
|
||||
|
|
@ -581,18 +627,22 @@ install-html: install-html-am
|
|||
|
||||
install-html-am: $(HTMLS)
|
||||
@$(NORMAL_INSTALL)
|
||||
test -z "$(htmldir)" || $(MKDIR_P) "$(DESTDIR)$(htmldir)"
|
||||
@list='$(HTMLS)'; list2=; test -n "$(htmldir)" || list=; \
|
||||
if test -n "$$list"; then \
|
||||
echo " $(MKDIR_P) '$(DESTDIR)$(htmldir)'"; \
|
||||
$(MKDIR_P) "$(DESTDIR)$(htmldir)" || exit 1; \
|
||||
fi; \
|
||||
for p in $$list; do \
|
||||
if test -f "$$p" || test -d "$$p"; then d=; else d="$(srcdir)/"; fi; \
|
||||
$(am__strip_dir) \
|
||||
if test -d "$$d$$p"; then \
|
||||
d2=$$d$$p; \
|
||||
if test -d "$$d2"; then \
|
||||
echo " $(MKDIR_P) '$(DESTDIR)$(htmldir)/$$f'"; \
|
||||
$(MKDIR_P) "$(DESTDIR)$(htmldir)/$$f" || exit 1; \
|
||||
echo " $(INSTALL_DATA) '$$d$$p'/* '$(DESTDIR)$(htmldir)/$$f'"; \
|
||||
$(INSTALL_DATA) "$$d$$p"/* "$(DESTDIR)$(htmldir)/$$f" || exit $$?; \
|
||||
echo " $(INSTALL_DATA) '$$d2'/* '$(DESTDIR)$(htmldir)/$$f'"; \
|
||||
$(INSTALL_DATA) "$$d2"/* "$(DESTDIR)$(htmldir)/$$f" || exit $$?; \
|
||||
else \
|
||||
list2="$$list2 $$d$$p"; \
|
||||
list2="$$list2 $$d2"; \
|
||||
fi; \
|
||||
done; \
|
||||
test -z "$$list2" || { echo "$$list2" | $(am__base_list) | \
|
||||
|
|
@ -604,9 +654,12 @@ install-info: install-info-am
|
|||
|
||||
install-info-am: $(INFO_DEPS)
|
||||
@$(NORMAL_INSTALL)
|
||||
test -z "$(infodir)" || $(MKDIR_P) "$(DESTDIR)$(infodir)"
|
||||
@srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; \
|
||||
list='$(INFO_DEPS)'; test -n "$(infodir)" || list=; \
|
||||
if test -n "$$list"; then \
|
||||
echo " $(MKDIR_P) '$(DESTDIR)$(infodir)'"; \
|
||||
$(MKDIR_P) "$(DESTDIR)$(infodir)" || exit 1; \
|
||||
fi; \
|
||||
for file in $$list; do \
|
||||
case $$file in \
|
||||
$(srcdir)/*) file=`echo "$$file" | sed "s|^$$srcdirstrip/||"`;; \
|
||||
|
|
@ -624,8 +677,7 @@ install-info-am: $(INFO_DEPS)
|
|||
echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(infodir)'"; \
|
||||
$(INSTALL_DATA) $$files "$(DESTDIR)$(infodir)" || exit $$?; done
|
||||
@$(POST_INSTALL)
|
||||
@if (install-info --version && \
|
||||
install-info --version 2>&1 | sed 1q | grep -i -v debian) >/dev/null 2>&1; then \
|
||||
@if $(am__can_run_installinfo); then \
|
||||
list='$(INFO_DEPS)'; test -n "$(infodir)" || list=; \
|
||||
for file in $$list; do \
|
||||
relfile=`echo "$$file" | sed 's|^.*/||'`; \
|
||||
|
|
@ -639,8 +691,11 @@ install-pdf: install-pdf-am
|
|||
|
||||
install-pdf-am: $(PDFS)
|
||||
@$(NORMAL_INSTALL)
|
||||
test -z "$(pdfdir)" || $(MKDIR_P) "$(DESTDIR)$(pdfdir)"
|
||||
@list='$(PDFS)'; test -n "$(pdfdir)" || list=; \
|
||||
if test -n "$$list"; then \
|
||||
echo " $(MKDIR_P) '$(DESTDIR)$(pdfdir)'"; \
|
||||
$(MKDIR_P) "$(DESTDIR)$(pdfdir)" || exit 1; \
|
||||
fi; \
|
||||
for p in $$list; do \
|
||||
if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
|
||||
echo "$$d$$p"; \
|
||||
|
|
@ -652,8 +707,11 @@ install-ps: install-ps-am
|
|||
|
||||
install-ps-am: $(PSS)
|
||||
@$(NORMAL_INSTALL)
|
||||
test -z "$(psdir)" || $(MKDIR_P) "$(DESTDIR)$(psdir)"
|
||||
@list='$(PSS)'; test -n "$(psdir)" || list=; \
|
||||
if test -n "$$list"; then \
|
||||
echo " $(MKDIR_P) '$(DESTDIR)$(psdir)'"; \
|
||||
$(MKDIR_P) "$(DESTDIR)$(psdir)" || exit 1; \
|
||||
fi; \
|
||||
for p in $$list; do \
|
||||
if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
|
||||
echo "$$d$$p"; \
|
||||
|
|
@ -713,31 +771,31 @@ texi2html: tinc.texi
|
|||
texi2html -split=chapter tinc.texi
|
||||
|
||||
tincd.8.html: tincd.8
|
||||
w3mman2html $< > $@
|
||||
w3mman2html $? > $@
|
||||
|
||||
tincctl.8.html: tincctl.8
|
||||
w3mman2html $< > $@
|
||||
w3mman2html $? > $@
|
||||
|
||||
tinc-gui.8.html: tinc-gui.8
|
||||
w3mman2html $< > $@
|
||||
w3mman2html $? > $@
|
||||
|
||||
tinc.conf.5.html: tinc.conf.5
|
||||
w3mman2html $< > $@
|
||||
w3mman2html $? > $@
|
||||
|
||||
tincd.8: tincd.8.in
|
||||
$(substitute) $< > $@
|
||||
$(substitute) $? > $@
|
||||
|
||||
tincctl.8: tincctl.8.in
|
||||
$(substitute) $< > $@
|
||||
$(substitute) $? > $@
|
||||
|
||||
tinc-gui.8: tinc-gui.8.in
|
||||
$(substitute) $< > $@
|
||||
$(substitute) $? > $@
|
||||
|
||||
tinc.conf.5: tinc.conf.5.in
|
||||
$(substitute) $< > $@
|
||||
$(substitute) $? > $@
|
||||
|
||||
tincinclude.texi: tincinclude.texi.in
|
||||
$(substitute) $< > $@
|
||||
$(substitute) $? > $@
|
||||
|
||||
tinc.texi: tincinclude.texi
|
||||
|
||||
|
|
|
|||
Binary file not shown.
2056
doc/texinfo.tex
2056
doc/texinfo.tex
File diff suppressed because it is too large
Load diff
|
|
@ -1,4 +1,4 @@
|
|||
.Dd 2010-01-16
|
||||
.Dd 2012-09-27
|
||||
.Dt TINC.CONF 5
|
||||
.\" Manual page created by:
|
||||
.\" Ivo Timmermans
|
||||
|
|
@ -14,22 +14,12 @@ The files in the
|
|||
directory contain runtime and security information for the tinc daemon.
|
||||
|
||||
.Sh NETWORKS
|
||||
It is perfectly ok for you to run more than one tinc daemon.
|
||||
However, in its default form,
|
||||
you will soon notice that you can't use two different configuration files without the
|
||||
.Fl c
|
||||
option.
|
||||
|
||||
.Pp
|
||||
We have thought of another way of dealing with this: network names.
|
||||
This means that you call
|
||||
.Nm
|
||||
with the
|
||||
To distinguish multiple instances of tinc running on one computer,
|
||||
you can use the
|
||||
.Fl n
|
||||
option, which will assign a name to this daemon.
|
||||
|
||||
option to assign a network name to each tinc daemon.
|
||||
.Pp
|
||||
The effect of this is that the daemon will set its configuration root to
|
||||
The effect of this option is that the daemon will set its configuration root to
|
||||
.Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa / ,
|
||||
where
|
||||
.Ar NETNAME
|
||||
|
|
@ -37,14 +27,14 @@ is your argument to the
|
|||
.Fl n
|
||||
option.
|
||||
You'll notice that messages appear in syslog as coming from
|
||||
.Nm tincd. Ns Ar NETNAME .
|
||||
|
||||
.Nm tincd. Ns Ar NETNAME ,
|
||||
and on Linux, unless specified otherwise, the name of the virtual network interface will be the same as the network name.
|
||||
.Pp
|
||||
However, it is not strictly necessary that you call tinc with the
|
||||
It is recommended that you use network names even if you run only one instance of tinc.
|
||||
However, you can choose not to use the
|
||||
.Fl n
|
||||
option.
|
||||
In this case, the network name would just be empty,
|
||||
and it will be used as such.
|
||||
In this case, the network name would just be empty, and
|
||||
.Nm tinc
|
||||
now looks for files in
|
||||
.Pa @sysconfdir@/tinc/ ,
|
||||
|
|
@ -55,12 +45,6 @@ the configuration file should be
|
|||
and the host configuration files are now expected to be in
|
||||
.Pa @sysconfdir@/tinc/hosts/ .
|
||||
|
||||
.Pp
|
||||
But it is highly recommended that you use this feature of
|
||||
.Nm tinc ,
|
||||
because it will be so much clearer whom your daemon talks to.
|
||||
Hence, we will assume that you use it.
|
||||
|
||||
.Sh NAMES
|
||||
Each tinc daemon should have a name that is unique in the network which it will be part of.
|
||||
The name will be used by other tinc daemons for identification.
|
||||
|
|
@ -72,25 +56,38 @@ file.
|
|||
To make things easy,
|
||||
choose something that will give unique and easy to remember names to your tinc daemon(s).
|
||||
You could try things like hostnames, owner surnames or location names.
|
||||
However, you are only allowed to use alphanumerical characters (a-z, A-Z, and 0-9) and underscores (_) in the name.
|
||||
|
||||
.Sh INITIAL CONFIGURATION
|
||||
If you have not configured tinc yet, you can easily create a basic configuration using the following command:
|
||||
.Bd -literal -offset indent
|
||||
.Nm tincctl Fl n Ar NETNAME Li init Ar NAME
|
||||
.Ed
|
||||
|
||||
.Pp
|
||||
You can further change the configuration as needed either by manually editing the configuration files,
|
||||
or by using
|
||||
.Xr tincctl 8 .
|
||||
|
||||
.Sh PUBLIC/PRIVATE KEYS
|
||||
You should use
|
||||
.Ic tincd -K
|
||||
to generate public/private keypairs.
|
||||
It will generate two keys.
|
||||
The private key should be stored in a separate file
|
||||
.Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /rsa_key.priv
|
||||
\-\- where
|
||||
.Ar NETNAME
|
||||
stands for the network (see
|
||||
.Sx NETWORKS )
|
||||
above.
|
||||
The public key should be stored in the host configuration file
|
||||
.Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /hosts/ Ns Va NAME
|
||||
\-\- where
|
||||
.Va NAME
|
||||
stands for the name of the local tinc daemon (see
|
||||
.Sx NAMES ) .
|
||||
The
|
||||
.Nm tincctl Li init
|
||||
command will have generated both RSA and ECDSA public/private keypairs.
|
||||
The private keys should be stored in files named
|
||||
.Pa rsa_key.priv
|
||||
and
|
||||
.Pa ecdsa_key.priv
|
||||
in the directory
|
||||
.Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /
|
||||
The public keys should be stored in the host configuration file
|
||||
.Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /hosts/ Ns Va NAME .
|
||||
|
||||
The RSA keys are used for backwards compatibility with tinc version 1.0.
|
||||
If you are upgrading from version 1.0 to 1.1, you can keep the old configuration files,
|
||||
but you will need to create ECDSA keys using the following command:
|
||||
.Bd -literal -offset indent
|
||||
.Nm tincctl Fl n Ar NETNAME Li generate-ecdsa-keys
|
||||
.Ed
|
||||
|
||||
.Sh SERVER CONFIGURATION
|
||||
The server configuration of the daemon is done in the file
|
||||
|
|
@ -117,6 +114,11 @@ Although all configuration options for the local host listed in this document ca
|
|||
it is recommended to put host specific configuration options in the host configuration file,
|
||||
as this makes it easy to exchange with other nodes.
|
||||
|
||||
.Pp
|
||||
You can edit the config file manually, but it is recommended that you use
|
||||
.Xr tincctl 8
|
||||
to change configuration variables for you.
|
||||
|
||||
.Pp
|
||||
Here are all valid variables, listed in alphabetical order.
|
||||
The default value is given between parentheses.
|
||||
|
|
@ -129,14 +131,24 @@ If
|
|||
is selected, then depending on the operating system both IPv4 and IPv6 or just
|
||||
IPv6 listening sockets will be created.
|
||||
|
||||
.It Va BindToAddress Li = Ar address Bq experimental
|
||||
.It Va BindToAddress Li = Ar address Op Ar port
|
||||
If your computer has more than one IPv4 or IPv6 address,
|
||||
.Nm tinc
|
||||
will by default listen on all of them for incoming connections.
|
||||
It is possible to bind only to a single address with this variable.
|
||||
|
||||
Multiple
|
||||
.Va BindToAddress
|
||||
variables may be specified,
|
||||
in which case listening sockets for each specified address are made.
|
||||
.Pp
|
||||
This option may not work on all platforms.
|
||||
If no
|
||||
.Ar port
|
||||
is specified, the socket will be bound to the port specified by the
|
||||
.Va Port
|
||||
option, or to port 655 if neither is given.
|
||||
To only bind to a specific port but not to a specific address, use
|
||||
.Li *
|
||||
for the
|
||||
.Ar address .
|
||||
|
||||
.It Va BindToInterface Li = Ar interface Bq experimental
|
||||
If your computer has more than one network interface,
|
||||
|
|
@ -146,6 +158,28 @@ It is possible to bind only to a single interface with this variable.
|
|||
|
||||
.Pp
|
||||
This option may not work on all platforms.
|
||||
Also, on some platforms it will not actually bind to an interface,
|
||||
but rather to the address that the interface has at the moment a socket is created.
|
||||
|
||||
.It Va Broadcast Li = no | mst | direct Po mst Pc Bq experimental
|
||||
This option selects the way broadcast packets are sent to other daemons.
|
||||
NOTE: all nodes in a VPN must use the same
|
||||
.Va Broadcast
|
||||
mode, otherwise routing loops can form.
|
||||
|
||||
.Bl -tag -width indent
|
||||
.It no
|
||||
Broadcast packets are never sent to other nodes.
|
||||
|
||||
.It mst
|
||||
Broadcast packets are sent and forwarded via the VPN's Minimum Spanning Tree.
|
||||
This ensures broadcast packets reach all nodes.
|
||||
|
||||
.It direct
|
||||
Broadcast packets are sent directly to all nodes that can be reached directly.
|
||||
Broadcast packets received from other nodes are never forwarded.
|
||||
If the IndirectData option is also set, broadcast packets will only be sent to nodes which we have a meta connection to.
|
||||
.El
|
||||
|
||||
.It Va ConnectTo Li = Ar name
|
||||
Specifies which other tinc daemon to connect to on startup.
|
||||
|
|
@ -165,6 +199,16 @@ If you don't specify a host with
|
|||
won't try to connect to other daemons at all,
|
||||
and will instead just listen for incoming connections.
|
||||
|
||||
.It Va DecrementTTL Li = yes | no Po no Pc Bq experimental
|
||||
When enabled,
|
||||
.Nm tinc
|
||||
will decrement the Time To Live field in IPv4 packets, or the Hop Limit field in IPv6 packets,
|
||||
before forwarding a received packet to the virtual network device or to another node,
|
||||
and will drop packets that have a TTL value of zero,
|
||||
in which case it will send an ICMP Time Exceeded packet back.
|
||||
.Pp
|
||||
Do not use this option if you use switch mode and want to use IPv6.
|
||||
|
||||
.It Va Device Li = Ar device Po Pa /dev/tap0 , Pa /dev/net/tun No or other depending on platform Pc
|
||||
The virtual network device to use.
|
||||
.Nm tinc
|
||||
|
|
@ -177,30 +221,75 @@ instead of
|
|||
The info pages of the tinc package contain more information
|
||||
about configuring the virtual network device.
|
||||
|
||||
.It Va DeviceType Li = tun | tunnohead | tunifhead | tap Po only supported on BSD platforms Pc
|
||||
.It Va DeviceType Li = Ar type Pq platform dependent
|
||||
The type of the virtual network device.
|
||||
Tinc will normally automatically select the right type, and this option should not be used.
|
||||
However, in case tinc does not seem to correctly interpret packets received from the virtual network device,
|
||||
using this option might help.
|
||||
Tinc will normally automatically select the right type of tun/tap interface, and this option should not be used.
|
||||
However, this option can be used to select one of the special interface types, if support for them is compiled in.
|
||||
.Bl -tag -width indent
|
||||
|
||||
.It tun
|
||||
.It dummy
|
||||
Use a dummy interface.
|
||||
No packets are ever read or written to a virtual network device.
|
||||
Useful for testing, or when setting up a node that only forwards packets for other nodes.
|
||||
|
||||
.It raw_socket
|
||||
Open a raw socket, and bind it to a pre-existing
|
||||
.Va Interface
|
||||
(eth0 by default).
|
||||
All packets are read from this interface.
|
||||
Packets received for the local node are written to the raw socket.
|
||||
However, at least on Linux, the operating system does not process IP packets destined for the local host.
|
||||
|
||||
.It multicast
|
||||
Open a multicast UDP socket and bind it to the address and port (separated by spaces) and optionally a TTL value specified using
|
||||
.Va Device .
|
||||
Packets are read from and written to this multicast socket.
|
||||
This can be used to connect to UML, QEMU or KVM instances listening on the same multicast address.
|
||||
Do NOT connect multiple
|
||||
.Nm tinc
|
||||
daemons to the same multicast address, this will very likely cause routing loops.
|
||||
Also note that this can cause decrypted VPN packets to be sent out on a real network if misconfigured.
|
||||
|
||||
.It uml Pq not compiled in by default
|
||||
Create a UNIX socket with the filename specified by
|
||||
.Va Device ,
|
||||
or
|
||||
.Pa @localstatedir@/run/ Ns Ar NETNAME Ns Pa .umlsocket
|
||||
if not specified.
|
||||
.Nm tinc
|
||||
will wait for a User Mode Linux instance to connect to this socket.
|
||||
|
||||
.It vde Pq not compiled in by default
|
||||
Uses the libvdeplug library to connect to a Virtual Distributed Ethernet switch,
|
||||
using the UNIX socket specified by
|
||||
.Va Device ,
|
||||
or
|
||||
.Pa @localstatedir@/run/vde.ctl
|
||||
if not specified.
|
||||
.El
|
||||
|
||||
Also, in case tinc does not seem to correctly interpret packets received from the virtual network device,
|
||||
it can be used to change the way packets are interpreted:
|
||||
|
||||
.Bl -tag -width indent
|
||||
|
||||
.It tun Pq BSD and Linux
|
||||
Set type to tun.
|
||||
Depending on the platform, this can either be with or without an address family header (see below).
|
||||
|
||||
.It tunnohead
|
||||
.It tunnohead Pq BSD
|
||||
Set type to tun without an address family header.
|
||||
Tinc will expect packets read from the virtual network device to start with an IP header.
|
||||
On some platforms IPv6 packets cannot be read from or written to the device in this mode.
|
||||
|
||||
.It tunifhead
|
||||
.It tunifhead Pq BSD
|
||||
Set type to tun with an address family header.
|
||||
Tinc will expect packets read from the virtual network device
|
||||
to start with a four byte header containing the address family,
|
||||
followed by an IP header.
|
||||
This mode should support both IPv4 and IPv6 packets.
|
||||
|
||||
.It tap
|
||||
.It tap Pq BSD and Linux
|
||||
Set type to tap.
|
||||
Tinc will expect packets read from the virtual network device
|
||||
to start with an Ethernet header.
|
||||
|
|
@ -247,7 +336,7 @@ This is less efficient, but allows the kernel to apply its routing and firewall
|
|||
and can also help debugging.
|
||||
.El
|
||||
|
||||
.It Va GraphDumpFile Li = Ar filename Bq experimental
|
||||
.It Va GraphDumpFile Li = Ar filename
|
||||
If this option is present,
|
||||
.Nm tinc
|
||||
will dump the current network graph to the file
|
||||
|
|
@ -268,7 +357,7 @@ a lookup if your DNS server is not responding.
|
|||
|
||||
.Pp
|
||||
This does not affect resolving hostnames to IP addresses from the
|
||||
host configuration files.
|
||||
host configuration files, but whether hostnames should be resolved while logging.
|
||||
|
||||
.It Va IffOneQueue Li = yes | no Po no Pc Bq experimental
|
||||
(Linux only) Set IFF_ONE_QUEUE flag on TUN/TAP devices.
|
||||
|
|
@ -286,6 +375,18 @@ This option controls the period the encryption keys used to encrypt the data are
|
|||
It is common practice to change keys at regular intervals to make it even harder for crackers,
|
||||
even though it is thought to be nearly impossible to crack a single key.
|
||||
|
||||
.It Va LocalDiscovery Li = yes | no Pq no
|
||||
When enabled,
|
||||
.Nm tinc
|
||||
will try to detect peers that are on the same local network.
|
||||
This will allow direct communication using LAN addresses, even if both peers are behind a NAT
|
||||
and they only ConnectTo a third node outside the NAT,
|
||||
which normally would prevent the peers from learning each other's LAN address.
|
||||
|
||||
.Pp
|
||||
Currently, local discovery is implemented by sending broadcast packets to the LAN during path MTU discovery.
|
||||
This feature may not work in all possible situations.
|
||||
|
||||
.It Va MACExpire Li = Ar seconds Pq 600
|
||||
This option controls the amount of time MAC addresses are kept before they are removed.
|
||||
This only has effect when
|
||||
|
|
@ -327,6 +428,19 @@ while no routing table is managed.
|
|||
.It Va Name Li = Ar name Bq required
|
||||
This is the name which identifies this tinc daemon.
|
||||
It must be unique for the virtual private network this daemon will connect to.
|
||||
The Name may only consist of alphanumeric and underscore characters.
|
||||
|
||||
If
|
||||
.Va Name
|
||||
starts with a
|
||||
.Li $ ,
|
||||
then the contents of the environment variable that follows will be used.
|
||||
In that case, invalid characters will be converted to underscores.
|
||||
If
|
||||
.Va Name
|
||||
is
|
||||
.Li $HOST ,
|
||||
but no such environment variable exist, the hostname will be read using the gethostnname() system call.
|
||||
|
||||
.It Va PingInterval Li = Ar seconds Pq 60
|
||||
The number of seconds of inactivity that
|
||||
|
|
@ -356,11 +470,46 @@ or
|
|||
specified in the configuration file.
|
||||
|
||||
.It Va ProcessPriority Li = low | normal | high
|
||||
When this option is used the priority of the tincd process will be adjusted.
|
||||
When this option is used the priority of the
|
||||
.Nm tincd
|
||||
process will be adjusted.
|
||||
Increasing the priority may help to reduce latency and packet loss on the VPN.
|
||||
|
||||
.It Va Proxy Li = socks4 | socks5 | http | exec Ar ... Bq experimental
|
||||
Use a proxy when making outgoing connections.
|
||||
The following proxy types are currently supported:
|
||||
.Bl -tag -width indent
|
||||
.It socks4 Ar address Ar port Op Ar username
|
||||
Connects to the proxy using the SOCKS version 4 protocol.
|
||||
Optionally, a
|
||||
.Ar username
|
||||
can be supplied which will be passed on to the proxy server.
|
||||
Only IPv4 connections can be proxied using SOCKS 4.
|
||||
.It socks5 Ar address Ar port Op Ar username Ar password
|
||||
Connect to the proxy using the SOCKS version 5 protocol.
|
||||
If a
|
||||
.Ar username
|
||||
and
|
||||
.Ar password
|
||||
are given, basic username/password authentication will be used,
|
||||
otherwise no authentication will be used.
|
||||
.It http Ar address Ar port
|
||||
Connects to the proxy and sends a HTTP CONNECT request.
|
||||
.It exec Ar command
|
||||
Executes the given
|
||||
.Ar command
|
||||
which should set up the outgoing connection.
|
||||
The environment variables
|
||||
.Ev NAME ,
|
||||
.Ev NODE ,
|
||||
.Ev REMOTEADDRES
|
||||
and
|
||||
.Ev REMOTEPORT
|
||||
are available.
|
||||
.El
|
||||
|
||||
.It Va ReplayWindow Li = Ar bytes Pq 16
|
||||
This is the size of the replay tracking window for each remote node, in bytes.
|
||||
vhis is the size of the replay tracking window for each remote node, in bytes.
|
||||
The window is a bitfield which tracks 1 packet per bit, so for example
|
||||
the default setting of 16 will track up to 128 packets in the window. In high
|
||||
bandwidth scenarios, setting this to a higher value can reduce packet loss from
|
||||
|
|
@ -406,7 +555,7 @@ Since host configuration files only contain public keys,
|
|||
no secrets are revealed by sending out this information.
|
||||
.Bl -tag -width indent
|
||||
|
||||
.It Va Address Li = Ar address Oo port Oc Bq recommended
|
||||
.It Va Address Li = Ar address Oo Ar port Oc Bq recommended
|
||||
The IP address or hostname of this tinc daemon on the real network.
|
||||
This will only be used when trying to make an outgoing connection to this tinc daemon.
|
||||
Optionally, a port can be specified to use for this address.
|
||||
|
|
@ -497,12 +646,11 @@ variables can be specified.
|
|||
Subnets can either be single MAC, IPv4 or IPv6 addresses,
|
||||
in which case a subnet consisting of only that single address is assumed,
|
||||
or they can be a IPv4 or IPv6 network address with a prefixlength.
|
||||
Shorthand notations are not supported.
|
||||
For example, IPv4 subnets must be in a form like 192.168.1.0/24,
|
||||
where 192.168.1.0 is the network address and 24 is the number of bits set in the netmask.
|
||||
Note that subnets like 192.168.1.1/24 are invalid!
|
||||
Read a networking HOWTO/FAQ/guide if you don't understand this.
|
||||
IPv6 subnets are notated like fec0:0:0:1:0:0:0:0/64.
|
||||
IPv6 subnets are notated like fec0:0:0:1::/64.
|
||||
MAC addresses are notated like 0:1a:2b:3c:4d:5e.
|
||||
|
||||
.Pp
|
||||
|
|
@ -609,6 +757,10 @@ When a subnet becomes (un)reachable, this is set to the subnet.
|
|||
When a subnet becomes (un)reachable, this is set to the subnet weight.
|
||||
.El
|
||||
|
||||
.Pp
|
||||
Do not forget that under UNIX operating systems, you have to make the scripts executable, using the command
|
||||
.Nm chmod Li a+x Pa script .
|
||||
|
||||
.Sh FILES
|
||||
The most important files are:
|
||||
.Bl -tag -width indent
|
||||
|
|
@ -636,8 +788,9 @@ its connection to the virtual network device.
|
|||
|
||||
.Sh SEE ALSO
|
||||
.Xr tincd 8 ,
|
||||
.Xr tincctl 8 ,
|
||||
.Pa http://www.tinc-vpn.org/ ,
|
||||
.Pa http://www.linuxdoc.org/LDP/nag2/ .
|
||||
.Pa http://www.tldp.org/LDP/nag2/ .
|
||||
|
||||
.Pp
|
||||
The full documentation for
|
||||
|
|
|
|||
815
doc/tinc.info
815
doc/tinc.info
File diff suppressed because it is too large
Load diff
500
doc/tinc.texi
500
doc/tinc.texi
|
|
@ -15,7 +15,7 @@
|
|||
|
||||
This is the info manual for @value{PACKAGE} version @value{VERSION}, a Virtual Private Network daemon.
|
||||
|
||||
Copyright @copyright{} 1998-2011 Ivo Timmermans,
|
||||
Copyright @copyright{} 1998-2012 Ivo Timmermans,
|
||||
Guus Sliepen <guus@@tinc-vpn.org> and
|
||||
Wessel Dankers <wsl@@tinc-vpn.org>.
|
||||
|
||||
|
|
@ -39,7 +39,7 @@ permission notice identical to this one.
|
|||
@vskip 0pt plus 1filll
|
||||
This is the info manual for @value{PACKAGE} version @value{VERSION}, a Virtual Private Network daemon.
|
||||
|
||||
Copyright @copyright{} 1998-2011 Ivo Timmermans,
|
||||
Copyright @copyright{} 1998-2012 Ivo Timmermans,
|
||||
Guus Sliepen <guus@@tinc-vpn.org> and
|
||||
Wessel Dankers <wsl@@tinc-vpn.org>.
|
||||
|
||||
|
|
@ -187,7 +187,7 @@ packets.
|
|||
@cindex release
|
||||
For an up to date list of supported platforms, please check the list on
|
||||
our website:
|
||||
@uref{http://www.tinc-vpn.org/platforms}.
|
||||
@uref{http://www.tinc-vpn.org/platforms/}.
|
||||
|
||||
@c
|
||||
@c
|
||||
|
|
@ -262,7 +262,7 @@ alias char-major-10-200 tun
|
|||
@subsection Configuration of FreeBSD kernels
|
||||
|
||||
For FreeBSD version 4.1 and higher, tun and tap drivers are included in the default kernel configuration.
|
||||
Using tap devices is recommended.
|
||||
The tap driver can be loaded with @code{kldload if_tap}, or by adding @code{if_tap_load="YES"} to @file{/boot/loader.conf}.
|
||||
|
||||
|
||||
@c ==================================================================
|
||||
|
|
@ -276,6 +276,7 @@ which adds a tap device to OpenBSD which should work with tinc,
|
|||
but with recent versions of OpenBSD,
|
||||
a tun device can act as a tap device by setting the link0 option with ifconfig.
|
||||
|
||||
|
||||
@c ==================================================================
|
||||
@node Configuration of NetBSD kernels
|
||||
@subsection Configuration of NetBSD kernels
|
||||
|
|
@ -466,7 +467,7 @@ available. Make sure you install the development AND runtime versions
|
|||
of this package.
|
||||
|
||||
If you have to install libevent manually, you can get the source code
|
||||
from @url{http://monkey.org/~provos/libevent/}. Instructions on how to configure,
|
||||
from @url{http://libevent.org/}. Instructions on how to configure,
|
||||
build and install this package are included within the package. Please
|
||||
make sure you build development and runtime libraries (which is the
|
||||
default).
|
||||
|
|
@ -492,7 +493,7 @@ system startup scripts and sample configurations.
|
|||
If you cannot use one of the precompiled packages, or you want to compile tinc
|
||||
for yourself, you can use the source. The source is distributed under
|
||||
the GNU General Public License (GPL). Download the source from the
|
||||
@uref{http://www.tinc-vpn.org/download, download page}, which has
|
||||
@uref{http://www.tinc-vpn.org/download/, download page}, which has
|
||||
the checksums of these files listed; you may wish to check these with
|
||||
md5sum before continuing.
|
||||
|
||||
|
|
@ -533,7 +534,7 @@ The documentation that comes along with your distribution will tell you how to d
|
|||
|
||||
In order to build tinc on Darwin, you need to install the MacOS/X Developer Tools
|
||||
from @uref{http://developer.apple.com/tools/macosxtools.html} and
|
||||
a recent version of Fink from @uref{http://fink.sourceforge.net/}.
|
||||
a recent version of Fink from @uref{http://www.finkproject.org/}.
|
||||
|
||||
After installation use fink to download and install the following packages:
|
||||
autoconf25, automake, dlcompat, m4, openssl, zlib and lzo.
|
||||
|
|
@ -638,7 +639,6 @@ tinc 655/udp TINC
|
|||
* Multiple networks::
|
||||
* How connections work::
|
||||
* Configuration files::
|
||||
* Generating keypairs::
|
||||
* Network interfaces::
|
||||
* Example configuration::
|
||||
@end menu
|
||||
|
|
@ -661,13 +661,19 @@ you will not find the answers in this documentation.
|
|||
Make sure you have an adequate understanding of networks in general.
|
||||
@cindex Network Administrators Guide
|
||||
A good resource on networking is the
|
||||
@uref{http://www.linuxdoc.org/LDP/nag2/, Linux Network Administrators Guide}.
|
||||
@uref{http://www.tldp.org/LDP/nag2/, Linux Network Administrators Guide}.
|
||||
|
||||
If you have everything clearly pictured in your mind,
|
||||
proceed in the following order:
|
||||
First, generate the configuration files (@file{tinc.conf}, your host configuration file, @file{tinc-up} and perhaps @file{tinc-down}).
|
||||
Then generate the keypairs.
|
||||
Finally, distribute the host configuration files.
|
||||
First, create the initial configuration files and public/private keypairs using the following command:
|
||||
@example
|
||||
tincctl -n @var{NETNAME} init @var{NAME}
|
||||
@end example
|
||||
Second, use @samp{tincctl -n @var{NETNAME} config ...} to further configure tinc.
|
||||
Finally, export your host configuration file using @samp{tincctl -n @var{NETNAME} export} and send it to those
|
||||
people or computers you want tinc to connect to.
|
||||
They should send you their host configuration file back, which you can import using @samp{tincctl -n @var{NETNAME} import}.
|
||||
|
||||
These steps are described in the subsections below.
|
||||
|
||||
|
||||
|
|
@ -677,30 +683,29 @@ These steps are described in the subsections below.
|
|||
|
||||
@cindex multiple networks
|
||||
@cindex netname
|
||||
|
||||
In order to allow you to run more than one tinc daemon on one computer,
|
||||
for instance if your computer is part of more than one VPN,
|
||||
you can assign a @var{netname} to your VPN.
|
||||
It is not required if you only run one tinc daemon,
|
||||
it doesn't even have to be the same on all the sites of your VPN,
|
||||
it doesn't even have to be the same on all the nodes of your VPN,
|
||||
but it is recommended that you choose one anyway.
|
||||
|
||||
We will asume you use a netname throughout this document.
|
||||
This means that you call tincd with the -n argument,
|
||||
which will assign a netname to this daemon.
|
||||
This means that you call tincctl with the -n argument,
|
||||
which will specify the netname.
|
||||
|
||||
The effect of this is that the daemon will set its configuration
|
||||
root to @file{@value{sysconfdir}/tinc/@var{netname}/}, where @var{netname} is your argument to the -n
|
||||
option. You'll notice that it appears in syslog as @file{tinc.@var{netname}}.
|
||||
The effect of this option is that tinc will set its configuration
|
||||
root to @file{@value{sysconfdir}/tinc/@var{netname}/}, where @var{netname} is your argument to the -n option.
|
||||
You will also notice that log messages it appears in syslog as coming from @file{tinc.@var{netname}},
|
||||
and on Linux, unless specified otherwise, the name of the virtual network interface will be the same as the network name.
|
||||
|
||||
However, it is not strictly necessary that you call tinc with the -n
|
||||
option. In this case, the network name would just be empty, and it will
|
||||
be used as such. tinc now looks for files in @file{@value{sysconfdir}/tinc/}, instead of
|
||||
@file{@value{sysconfdir}/tinc/@var{netname}/}; the configuration file should be @file{@value{sysconfdir}/tinc/tinc.conf},
|
||||
and the host configuration files are now expected to be in @file{@value{sysconfdir}/tinc/hosts/}.
|
||||
|
||||
But it is highly recommended that you use this feature of tinc, because
|
||||
it will be so much clearer whom your daemon talks to. Hence, we will
|
||||
assume that you use it.
|
||||
option. If you don not use it, the network name will just be empty, and
|
||||
tinc will look for files in @file{@value{sysconfdir}/tinc/} instead of
|
||||
@file{@value{sysconfdir}/tinc/@var{netname}/};
|
||||
the configuration file will then be @file{@value{sysconfdir}/tinc/tinc.conf},
|
||||
and the host configuration files are expected to be in @file{@value{sysconfdir}/tinc/hosts/}.
|
||||
|
||||
|
||||
@c ==================================================================
|
||||
|
|
@ -727,6 +732,25 @@ If you wish, you can view a tinc daemon without a `ConnectTo' value as a server,
|
|||
and one which does specify such a value as a client.
|
||||
It does not matter if two tinc daemons have a `ConnectTo' value pointing to each other however.
|
||||
|
||||
Connections specified using `ConnectTo' are so-called meta-connections.
|
||||
Tinc daemons exchange information about all other daemon they know about via these meta-connections.
|
||||
After learning about all the daemons in the VPN,
|
||||
tinc will create other connections as necessary in order to communicate with them.
|
||||
For example, if there are three daemons named A, B and C, and A has @samp{ConnectTo = B} in its tinc.conf file,
|
||||
and C has @samp{ConnectTo = B} in its tinc.conf file, then A will learn about C from B,
|
||||
and will be able to exchange VPN packets with C without the need to have @samp{ConnectTo = C} in its tinc.conf file.
|
||||
|
||||
It could be that some daemons are located behind a Network Address Translation (NAT) device, or behind a firewall.
|
||||
In the above scenario with three daemons, if A and C are behind a NAT,
|
||||
B will automatically help A and C punch holes through their NAT,
|
||||
in a way similar to the STUN protocol, so that A and C can still communicate with each other directly.
|
||||
It is not always possible to do this however, and firewalls might also prevent direct communication.
|
||||
In that case, VPN packets between A and C will be forwarded by B.
|
||||
|
||||
In effect, all nodes in the VPN will be able to talk to each other, as long as
|
||||
their is a path of meta-connections between them, and whenever possible, two
|
||||
nodes will communicate with each other directly.
|
||||
|
||||
|
||||
@c ==================================================================
|
||||
@node Configuration files
|
||||
|
|
@ -755,7 +779,10 @@ listed in this document can also be put in
|
|||
put host specific configuration options in the host configuration file, as this
|
||||
makes it easy to exchange with other nodes.
|
||||
|
||||
In this section all valid variables are listed in alphabetical order.
|
||||
You can edit the config file manually, but it is recommended that you use
|
||||
tincctl to change configuration variables for you.
|
||||
|
||||
In the following two subsections all valid variables are listed in alphabetical order.
|
||||
The default value is given between parentheses,
|
||||
other comments are between square brackets.
|
||||
|
||||
|
|
@ -779,12 +806,15 @@ If any is selected, then depending on the operating system
|
|||
both IPv4 and IPv6 or just IPv6 listening sockets will be created.
|
||||
|
||||
@cindex BindToAddress
|
||||
@item BindToAddress = <@var{address}> [experimental]
|
||||
@item BindToAddress = <@var{address}> [<@var{port}>]
|
||||
If your computer has more than one IPv4 or IPv6 address, tinc
|
||||
will by default listen on all of them for incoming connections.
|
||||
It is possible to bind only to a single address with this variable.
|
||||
Multiple BindToAddress variables may be specified,
|
||||
in which case listening sockets for each specified address are made.
|
||||
|
||||
This option may not work on all platforms.
|
||||
If no @var{port} is specified, the socket will be bound to the port specified by the Port option,
|
||||
or to port 655 if neither is given.
|
||||
To only bind to a specific port but not to a specific address, use "*" for the @var{address}.
|
||||
|
||||
@cindex BindToInterface
|
||||
@item BindToInterface = <@var{interface}> [experimental]
|
||||
|
|
@ -794,6 +824,27 @@ possible to bind tinc to a single interface like eth0 or ppp0 with this
|
|||
variable.
|
||||
|
||||
This option may not work on all platforms.
|
||||
Also, on some platforms it will not actually bind to an interface,
|
||||
but rather to the address that the interface has at the moment a socket is created.
|
||||
|
||||
@cindex Broadcast
|
||||
@item Broadcast = <no | mst | direct> (mst) [experimental]
|
||||
This option selects the way broadcast packets are sent to other daemons.
|
||||
@emph{NOTE: all nodes in a VPN must use the same Broadcast mode, otherwise routing loops can form.}
|
||||
|
||||
@table @asis
|
||||
@item no
|
||||
Broadcast packets are never sent to other nodes.
|
||||
|
||||
@item mst
|
||||
Broadcast packets are sent and forwarded via the VPN's Minimum Spanning Tree.
|
||||
This ensures broadcast packets reach all nodes.
|
||||
|
||||
@item direct
|
||||
Broadcast packets are sent directly to all nodes that can be reached directly.
|
||||
Broadcast packets received from other nodes are never forwarded.
|
||||
If the IndirectData option is also set, broadcast packets will only be sent to nodes which we have a meta connection to.
|
||||
@end table
|
||||
|
||||
@cindex ConnectTo
|
||||
@item ConnectTo = <@var{name}>
|
||||
|
|
@ -807,6 +858,15 @@ If you don't specify a host with ConnectTo,
|
|||
tinc won't try to connect to other daemons at all,
|
||||
and will instead just listen for incoming connections.
|
||||
|
||||
@cindex DecrementTTL
|
||||
@item DecrementTTL = <yes | no> (no) [experimental]
|
||||
When enabled, tinc will decrement the Time To Live field in IPv4 packets, or the Hop Limit field in IPv6 packets,
|
||||
before forwarding a received packet to the virtual network device or to another node,
|
||||
and will drop packets that have a TTL value of zero,
|
||||
in which case it will send an ICMP Time Exceeded packet back.
|
||||
|
||||
Do not use this option if you use switch mode and want to use IPv6.
|
||||
|
||||
@cindex Device
|
||||
@item Device = <@var{device}> (@file{/dev/tap0}, @file{/dev/net/tun} or other depending on platform)
|
||||
The virtual network device to use.
|
||||
|
|
@ -817,32 +877,72 @@ Note that you can only use one device per daemon.
|
|||
See also @ref{Device files}.
|
||||
|
||||
@cindex DeviceType
|
||||
@item DeviceType = <tun|tunnohead|tunifhead|tap> (only supported on BSD platforms)
|
||||
@item DeviceType = <@var{type}> (platform dependent)
|
||||
The type of the virtual network device.
|
||||
Tinc will normally automatically select the right type, and this option should not be used.
|
||||
However, in case tinc does not seem to correctly interpret packets received from the virtual network device,
|
||||
using this option might help.
|
||||
Tinc will normally automatically select the right type of tun/tap interface, and this option should not be used.
|
||||
However, this option can be used to select one of the special interface types, if support for them is compiled in.
|
||||
|
||||
@table @asis
|
||||
@item tun
|
||||
@cindex dummy
|
||||
@item dummy
|
||||
Use a dummy interface.
|
||||
No packets are ever read or written to a virtual network device.
|
||||
Useful for testing, or when setting up a node that only forwards packets for other nodes.
|
||||
|
||||
@cindex raw_socket
|
||||
@item raw_socket
|
||||
Open a raw socket, and bind it to a pre-existing
|
||||
@var{Interface} (eth0 by default).
|
||||
All packets are read from this interface.
|
||||
Packets received for the local node are written to the raw socket.
|
||||
However, at least on Linux, the operating system does not process IP packets destined for the local host.
|
||||
|
||||
@cindex multicast
|
||||
@item multicast
|
||||
Open a multicast UDP socket and bind it to the address and port (separated by spaces) and optionally a TTL value specified using @var{Device}.
|
||||
Packets are read from and written to this multicast socket.
|
||||
This can be used to connect to UML, QEMU or KVM instances listening on the same multicast address.
|
||||
Do NOT connect multiple tinc daemons to the same multicast address, this will very likely cause routing loops.
|
||||
Also note that this can cause decrypted VPN packets to be sent out on a real network if misconfigured.
|
||||
|
||||
@cindex UML
|
||||
@item uml (not compiled in by default)
|
||||
Create a UNIX socket with the filename specified by
|
||||
@var{Device}, or @file{@value{localstatedir}/run/@var{netname}.umlsocket}
|
||||
if not specified.
|
||||
Tinc will wait for a User Mode Linux instance to connect to this socket.
|
||||
|
||||
@cindex VDE
|
||||
@item vde (not compiled in by default)
|
||||
Uses the libvdeplug library to connect to a Virtual Distributed Ethernet switch,
|
||||
using the UNIX socket specified by
|
||||
@var{Device}, or @file{@value{localstatedir}/run/vde.ctl}
|
||||
if not specified.
|
||||
@end table
|
||||
|
||||
Also, in case tinc does not seem to correctly interpret packets received from the virtual network device,
|
||||
it can be used to change the way packets are interpreted:
|
||||
|
||||
@table @asis
|
||||
@item tun (BSD and Linux)
|
||||
Set type to tun.
|
||||
Depending on the platform, this can either be with or without an address family header (see below).
|
||||
|
||||
@cindex tunnohead
|
||||
@item tunnohead
|
||||
@item tunnohead (BSD)
|
||||
Set type to tun without an address family header.
|
||||
Tinc will expect packets read from the virtual network device to start with an IP header.
|
||||
On some platforms IPv6 packets cannot be read from or written to the device in this mode.
|
||||
|
||||
@cindex tunifhead
|
||||
@item tunifhead
|
||||
@item tunifhead (BSD)
|
||||
Set type to tun with an address family header.
|
||||
Tinc will expect packets read from the virtual network device
|
||||
to start with a four byte header containing the address family,
|
||||
followed by an IP header.
|
||||
This mode should support both IPv4 and IPv6 packets.
|
||||
|
||||
@item tap
|
||||
@item tap (BSD and Linux)
|
||||
Set type to tap.
|
||||
Tinc will expect packets read from the virtual network device
|
||||
to start with an Ethernet header.
|
||||
|
|
@ -891,7 +991,7 @@ and can also help debugging.
|
|||
@end table
|
||||
|
||||
@cindex GraphDumpFile
|
||||
@item GraphDumpFile = <@var{filename}> [experimental]
|
||||
@item GraphDumpFile = <@var{filename}>
|
||||
If this option is present,
|
||||
tinc will dump the current network graph to the file @var{filename}
|
||||
every minute, unless there were no changes to the graph.
|
||||
|
|
@ -908,7 +1008,7 @@ tinc's efficiency, even stopping the daemon for a few seconds everytime
|
|||
it does a lookup if your DNS server is not responding.
|
||||
|
||||
This does not affect resolving hostnames to IP addresses from the
|
||||
configuration file.
|
||||
configuration file, but whether hostnames should be resolved while logging.
|
||||
|
||||
@cindex Interface
|
||||
@item Interface = <@var{interface}>
|
||||
|
|
@ -917,6 +1017,16 @@ Depending on the operating system and the type of device this may or may not act
|
|||
Under Windows, this variable is used to select which network interface will be used.
|
||||
If you specified a Device, this variable is almost always already correctly set.
|
||||
|
||||
@cindex LocalDiscovery
|
||||
@item LocalDiscovery = <yes | no> (no)
|
||||
When enabled, tinc will try to detect peers that are on the same local network.
|
||||
This will allow direct communication using LAN addresses, even if both peers are behind a NAT
|
||||
and they only ConnectTo a third node outside the NAT,
|
||||
which normally would prevent the peers from learning each other's LAN address.
|
||||
|
||||
Currently, local discovery is implemented by sending broadcast packets to the LAN during path MTU discovery.
|
||||
This feature may not work in all possible situations.
|
||||
|
||||
@cindex Mode
|
||||
@item Mode = <router|switch|hub> (router)
|
||||
This option selects the way packets are routed to other daemons.
|
||||
|
|
@ -963,6 +1073,11 @@ This only has effect when Mode is set to "switch".
|
|||
This is a symbolic name for this connection.
|
||||
The name should consist only of alfanumeric and underscore characters (a-z, A-Z, 0-9 and _).
|
||||
|
||||
If Name starts with a $, then the contents of the environment variable that follows will be used.
|
||||
In that case, invalid characters will be converted to underscores.
|
||||
If Name is $HOST, but no such environment variable exist,
|
||||
the hostname will be read using the gethostnname() system call.
|
||||
|
||||
@cindex PingInterval
|
||||
@item PingInterval = <@var{seconds}> (60)
|
||||
The number of seconds of inactivity that tinc will wait before sending a
|
||||
|
|
@ -1000,6 +1115,33 @@ specified in the configuration file.
|
|||
When this option is used the priority of the tincd process will be adjusted.
|
||||
Increasing the priority may help to reduce latency and packet loss on the VPN.
|
||||
|
||||
@cindex Proxy
|
||||
@item Proxy = socks4 | socks4 | http | exec @var{...} [experimental]
|
||||
Use a proxy when making outgoing connections.
|
||||
The following proxy types are currently supported:
|
||||
|
||||
@table @asis
|
||||
@cindex socks4
|
||||
@item socks4 <@var{address}> <@var{port}> [<@var{username}>]
|
||||
Connects to the proxy using the SOCKS version 4 protocol.
|
||||
Optionally, a @var{username} can be supplied which will be passed on to the proxy server.
|
||||
|
||||
@cindex socks5
|
||||
@item socks4 <@var{address}> <@var{port}> [<@var{username}> <@var{password}>]
|
||||
Connect to the proxy using the SOCKS version 5 protocol.
|
||||
If a @var{username} and @var{password} are given, basic username/password authentication will be used,
|
||||
otherwise no authentication will be used.
|
||||
|
||||
@cindex http
|
||||
@item http <@var{address}> <@var{port}>
|
||||
Connects to the proxy and sends a HTTP CONNECT request.
|
||||
|
||||
@cindex exec
|
||||
@item exec <@var{command}>
|
||||
Executes the given command which should set up the outgoing connection.
|
||||
The environment variables @env{NAME}, @env{NODE}, @env{REMOTEADDRES} and @env{REMOTEPORT} are available.
|
||||
@end table
|
||||
|
||||
@cindex ReplayWindow
|
||||
@item ReplayWindow = <bytes> (16)
|
||||
This is the size of the replay tracking window for each remote node, in bytes.
|
||||
|
|
@ -1132,19 +1274,18 @@ Multiple subnet lines can be specified for each daemon.
|
|||
Subnets can either be single MAC, IPv4 or IPv6 addresses,
|
||||
in which case a subnet consisting of only that single address is assumed,
|
||||
or they can be a IPv4 or IPv6 network address with a prefixlength.
|
||||
Shorthand notations are not supported.
|
||||
For example, IPv4 subnets must be in a form like 192.168.1.0/24,
|
||||
where 192.168.1.0 is the network address and 24 is the number of bits set in the netmask.
|
||||
Note that subnets like 192.168.1.1/24 are invalid!
|
||||
Read a networking HOWTO/FAQ/guide if you don't understand this.
|
||||
IPv6 subnets are notated like fec0:0:0:1:0:0:0:0/64.
|
||||
IPv6 subnets are notated like fec0:0:0:1::/64.
|
||||
MAC addresses are notated like 0:1a:2b:3c:4d:5e.
|
||||
|
||||
@cindex CIDR notation
|
||||
Prefixlength is the number of bits set to 1 in the netmask part; for
|
||||
example: netmask 255.255.255.0 would become /24, 255.255.252.0 becomes
|
||||
/22. This conforms to standard CIDR notation as described in
|
||||
@uref{ftp://ftp.isi.edu/in-notes/rfc1519.txt, RFC1519}
|
||||
@uref{http://www.ietf.org/rfc/rfc1519.txt, RFC1519}
|
||||
|
||||
A Subnet can be given a weight to indicate its priority over identical Subnets
|
||||
owned by different nodes. The default weight is 10. Lower values indicate
|
||||
|
|
@ -1254,50 +1395,115 @@ When a subnet becomes (un)reachable, this is set to the subnet.
|
|||
@node How to configure
|
||||
@subsection How to configure
|
||||
|
||||
@subsubheading Step 1. Creating the main configuration file
|
||||
@subsubheading Step 1. Creating initial configuration files.
|
||||
|
||||
The main configuration file will be called @file{@value{sysconfdir}/tinc/@var{netname}/tinc.conf}.
|
||||
Adapt the following example to create a basic configuration file:
|
||||
The initial directory structure, configuration files and public/private keypairs are created using the following command:
|
||||
|
||||
@example
|
||||
Name = @var{yourname}
|
||||
Device = @file{/dev/tap0}
|
||||
tincctl -n @var{netname} init @var{name}
|
||||
@end example
|
||||
|
||||
Then, if you know to which other tinc daemon(s) yours is going to connect,
|
||||
add `ConnectTo' values.
|
||||
|
||||
@subsubheading Step 2. Creating your host configuration file
|
||||
|
||||
If you added a line containing `Name = yourname' in the main configuarion file,
|
||||
you will need to create a host configuration file @file{@value{sysconfdir}/tinc/@var{netname}/hosts/yourname}.
|
||||
Adapt the following example to create a host configuration file:
|
||||
(You will need to run this as root, or use "sudo".)
|
||||
This will create the configuration directory @file{@value{sysconfdir}/tinc/@var{netname}.},
|
||||
and inside it will create another directory named @file{hosts/}.
|
||||
In the configuration directory, it will create the file @file{tinc.conf} with the following contents:
|
||||
|
||||
@example
|
||||
Address = your.real.hostname.org
|
||||
Subnet = 192.168.1.0/24
|
||||
Name = @var{name}
|
||||
@end example
|
||||
|
||||
You can also use an IP address instead of a hostname.
|
||||
The `Subnet' specifies the address range that is local for @emph{your part of the VPN only}.
|
||||
If you have multiple address ranges you can specify more than one `Subnet'.
|
||||
You might also need to add a `Port' if you want your tinc daemon to run on a different port number than the default (655).
|
||||
It will also create private RSA and ECDSA keys, which will be stored in the files @file{rsa_key.priv} and @file{ecdsa_key.priv}.
|
||||
It will also create a host configuration file @file{hosts/@var{name}},
|
||||
which will contain the corresponding public RSA and ECDSA keys.
|
||||
|
||||
Finally, on UNIX operating systems, it will create an executable script @file{tinc-up},
|
||||
which will initially not do anything except warning that you should edit it.
|
||||
|
||||
@c ==================================================================
|
||||
@node Generating keypairs
|
||||
@section Generating keypairs
|
||||
@subsubheading Step 2. Modifying the initial configuration.
|
||||
|
||||
@cindex key generation
|
||||
Now that you have already created the main configuration file and your host configuration file,
|
||||
you can easily create a public/private keypair by entering the following command:
|
||||
Unless you want to use tinc in switch mode,
|
||||
you should now configure which range of addresses you will use on the VPN.
|
||||
Let's assume you will be part of a VPN which uses the address range 192.168.0.0/16,
|
||||
and you yourself have a smaller portion of that range: 192.168.2.0/24.
|
||||
Then you should run the following command:
|
||||
|
||||
@example
|
||||
tincctl -n @var{netname} generate-keys
|
||||
tincctl -n @var{netname} config add subnet 192.168.2.0/24
|
||||
@end example
|
||||
|
||||
Tinc will generate a public and a private key and ask you where to put them.
|
||||
Just press enter to accept the defaults.
|
||||
This will add a Subnet statement to your host configuration file.
|
||||
Try opening the file @file{@value{sysconfdir}/tinc/@var{netname}/hosts/@var{name}} in an editor.
|
||||
You should now see a file containing the public RSA and ECDSA keys (which looks like a bunch of random characters),
|
||||
and the following line at the bottom:
|
||||
|
||||
@example
|
||||
Subnet = 192.168.2.0/24
|
||||
@end example
|
||||
|
||||
If you will use more than one address range, you can add more Subnets.
|
||||
For example, if you also use the IPv6 subnet fec0:0:0:2::/64, you can add it as well:
|
||||
|
||||
@example
|
||||
tincctl -n @var{netname} config add subnet fec0:0:0:2::/24
|
||||
@end example
|
||||
|
||||
This will add another line to the file @file{hosts/@var{name}}.
|
||||
If you make a mistake, you can undo it by simply using @samp{config del} instead of @samp{config add}.
|
||||
|
||||
If you want other tinc daemons to create meta-connections to your daemon,
|
||||
you should add your public IP address or hostname to your host configuration file.
|
||||
For example, if your hostname is foo.example.org, run:
|
||||
|
||||
@example
|
||||
tincctl -n @var{netname} config add address foo.example.org
|
||||
@end example
|
||||
|
||||
If you already know to which daemons your daemon should make meta-connections,
|
||||
you should configure that now as well.
|
||||
Suppose you want to connect to a daemon named "bar", run:
|
||||
|
||||
@example
|
||||
tincctl -n @var{netname} config add connectto bar
|
||||
@end example
|
||||
|
||||
Note that you specify the Name of the other daemon here, not an IP address or hostname!
|
||||
When you start tinc, and it tries to make a connection to "bar",
|
||||
it will look for a host configuration file named @file{hosts/bar},
|
||||
and will read Address statements and public keys from that file.
|
||||
|
||||
@subsubheading Step 2. Exchanging configuration files.
|
||||
|
||||
If your daemon has a ConnectTo = bar statement in its @file{tinc.conf} file,
|
||||
or if bar has a ConnectTo your daemon, then you both need each other's host configuration files.
|
||||
You should send @file{hosts/@var{name}} to bar, and bar should send you his file which you should move to @file{hosts/bar}.
|
||||
If you are on a UNIX platform, you can easily send an email containing the necessary information using the following command
|
||||
(assuming the owner of bar has the email address bar@@example.org):
|
||||
|
||||
@example
|
||||
tincctl -n @var{netname} export | mail -s "My config file" bar@@example.org
|
||||
@end example
|
||||
|
||||
If the owner of bar does the same to send his host configuration file to you,
|
||||
you can probably pipe his email through the following command,
|
||||
or you can just start this command in a terminal and copy&paste the email:
|
||||
|
||||
@example
|
||||
tincctl -n @var{netname} import
|
||||
@end example
|
||||
|
||||
If you are the owner of bar yourself, and you have SSH access to that computer,
|
||||
you can also swap the host configuration files using the following commands:
|
||||
|
||||
@example
|
||||
tincctl -n @var{netname} export | ssh bar.example.org tincctl -n @var{netname} import
|
||||
ssh bar.example.org tincctl -n @var{netname} export | tincctl -n @var{netname} import
|
||||
@end example
|
||||
|
||||
You should repeat this for all nodes you ConnectTo, or which ConnectTo you.
|
||||
However, remember that you do not need to ConnectTo all nodes in the VPN;
|
||||
it is only necessary to create one or a few meta-connections,
|
||||
after the connections are made tinc will learn about all the other nodes in the VPN,
|
||||
and will automatically make other connections as necessary.
|
||||
|
||||
|
||||
@c ==================================================================
|
||||
|
|
@ -1320,21 +1526,31 @@ You can configure the network interface by putting ordinary ifconfig, route, and
|
|||
to a script named @file{@value{sysconfdir}/tinc/@var{netname}/tinc-up}.
|
||||
When tinc starts, this script will be executed. When tinc exits, it will execute the script named
|
||||
@file{@value{sysconfdir}/tinc/@var{netname}/tinc-down}, but normally you don't need to create that script.
|
||||
You can manually open the script in an editor, or use the following command:
|
||||
|
||||
An example @file{tinc-up} script:
|
||||
@example
|
||||
tincctl -n @var{netname} edit tinc-up
|
||||
@end example
|
||||
|
||||
An example @file{tinc-up} script, that would be appropriate for the scenario in the previous section, is:
|
||||
|
||||
@example
|
||||
#!/bin/sh
|
||||
ifconfig $INTERFACE 192.168.1.1 netmask 255.255.0.0
|
||||
ifconfig $INTERFACE 192.168.2.1 netmask 255.255.0.0
|
||||
ip addr add fec0:0:0:2::/48 dev $INTERFACE
|
||||
@end example
|
||||
|
||||
This script gives the interface an IP address and a netmask.
|
||||
The kernel will also automatically add a route to this interface, so normally you don't need
|
||||
The first command gives the interface an IPv4 address and a netmask.
|
||||
The kernel will also automatically add an IPv4 route to this interface, so normally you don't need
|
||||
to add route commands to the @file{tinc-up} script.
|
||||
The kernel will also bring the interface up after this command.
|
||||
@cindex netmask
|
||||
The netmask is the mask of the @emph{entire} VPN network, not just your
|
||||
own subnet.
|
||||
The second command gives the interface an IPv6 address and netmask,
|
||||
which will also automatically add an IPv6 route.
|
||||
If you only want to use "ip addr" commands on Linux, don't forget that it doesn't bring the interface up, unlike ifconfig,
|
||||
so you need to add @samp{ip link set $INTERFACE up} in that case.
|
||||
|
||||
The exact syntax of the ifconfig and route commands differs from platform to platform.
|
||||
You can look up the commands for setting addresses and adding routes in @ref{Platform specific information},
|
||||
|
|
@ -1374,6 +1590,9 @@ the real interface is also shown as a comment, to give you an idea of
|
|||
how these example host is set up. All branches use the netname `company'
|
||||
for this particular VPN.
|
||||
|
||||
Each branch is set up using the @samp{tincctl init} and @samp{tincctl config} commands,
|
||||
here we just show the end results:
|
||||
|
||||
@subsubheading For Branch A
|
||||
|
||||
@emph{BranchA} would be configured like this:
|
||||
|
|
@ -1381,6 +1600,8 @@ for this particular VPN.
|
|||
In @file{@value{sysconfdir}/tinc/company/tinc-up}:
|
||||
|
||||
@example
|
||||
#!/bin/sh
|
||||
|
||||
# Real interface of internal network:
|
||||
# ifconfig eth0 10.1.54.1 netmask 255.255.0.0
|
||||
|
||||
|
|
@ -1391,7 +1612,6 @@ and in @file{@value{sysconfdir}/tinc/company/tinc.conf}:
|
|||
|
||||
@example
|
||||
Name = BranchA
|
||||
Device = /dev/tap0
|
||||
@end example
|
||||
|
||||
On all hosts, @file{@value{sysconfdir}/tinc/company/hosts/BranchA} contains:
|
||||
|
|
@ -1405,9 +1625,9 @@ Address = 1.2.3.4
|
|||
-----END RSA PUBLIC KEY-----
|
||||
@end example
|
||||
|
||||
Note that the IP addresses of eth0 and tap0 are the same.
|
||||
Note that the IP addresses of eth0 and the VPN interface are the same.
|
||||
This is quite possible, if you make sure that the netmasks of the interfaces are different.
|
||||
It is in fact recommended to give both real internal network interfaces and tap interfaces the same IP address,
|
||||
It is in fact recommended to give both real internal network interfaces and VPN interfaces the same IP address,
|
||||
since that will make things a lot easier to remember and set up.
|
||||
|
||||
|
||||
|
|
@ -1416,6 +1636,8 @@ since that will make things a lot easier to remember and set up.
|
|||
In @file{@value{sysconfdir}/tinc/company/tinc-up}:
|
||||
|
||||
@example
|
||||
#!/bin/sh
|
||||
|
||||
# Real interface of internal network:
|
||||
# ifconfig eth0 10.2.43.8 netmask 255.255.0.0
|
||||
|
||||
|
|
@ -1430,7 +1652,7 @@ ConnectTo = BranchA
|
|||
@end example
|
||||
|
||||
Note here that the internal address (on eth0) doesn't have to be the
|
||||
same as on the tap0 device. Also, ConnectTo is given so that this node will
|
||||
same as on the VPN interface. Also, ConnectTo is given so that this node will
|
||||
always try to connect to BranchA.
|
||||
|
||||
On all hosts, in @file{@value{sysconfdir}/tinc/company/hosts/BranchB}:
|
||||
|
|
@ -1450,6 +1672,8 @@ Address = 2.3.4.5
|
|||
In @file{@value{sysconfdir}/tinc/company/tinc-up}:
|
||||
|
||||
@example
|
||||
#!/bin/sh
|
||||
|
||||
# Real interface of internal network:
|
||||
# ifconfig eth0 10.3.69.254 netmask 255.255.0.0
|
||||
|
||||
|
|
@ -1461,7 +1685,6 @@ and in @file{@value{sysconfdir}/tinc/company/tinc.conf}:
|
|||
@example
|
||||
Name = BranchC
|
||||
ConnectTo = BranchA
|
||||
Device = /dev/tap1
|
||||
@end example
|
||||
|
||||
C already has another daemon that runs on port 655, so they have to
|
||||
|
|
@ -1486,6 +1709,8 @@ Port = 2000
|
|||
In @file{@value{sysconfdir}/tinc/company/tinc-up}:
|
||||
|
||||
@example
|
||||
#!/bin/sh
|
||||
|
||||
# Real interface of internal network:
|
||||
# ifconfig eth0 10.4.3.32 netmask 255.255.0.0
|
||||
|
||||
|
|
@ -1497,14 +1722,10 @@ and in @file{@value{sysconfdir}/tinc/company/tinc.conf}:
|
|||
@example
|
||||
Name = BranchD
|
||||
ConnectTo = BranchC
|
||||
Device = /dev/net/tun
|
||||
@end example
|
||||
|
||||
D will be connecting to C, which has a tincd running for this network on
|
||||
port 2000. It knows the port number from the host configuration file.
|
||||
Also note that since D uses the tun/tap driver, the network interface
|
||||
will not be called `tun' or `tap0' or something like that, but will
|
||||
have the same name as netname.
|
||||
|
||||
On all hosts, in @file{@value{sysconfdir}/tinc/company/hosts/BranchD}:
|
||||
|
||||
|
|
@ -1519,16 +1740,11 @@ Address = 4.5.6.7
|
|||
|
||||
@subsubheading Key files
|
||||
|
||||
A, B, C and D all have generated a public/private keypair with the following command:
|
||||
A, B, C and D all have their own public/private keypairs:
|
||||
|
||||
@example
|
||||
tincctl -n company generate-keys
|
||||
@end example
|
||||
|
||||
The private key is stored in @file{@value{sysconfdir}/tinc/company/rsa_key.priv},
|
||||
the public key is put into the host configuration file in the @file{@value{sysconfdir}/tinc/company/hosts/} directory.
|
||||
During key generation, tinc automatically guesses the right filenames based on the -n option and
|
||||
the Name directive in the @file{tinc.conf} file (if it is available).
|
||||
The private RSA key is stored in @file{@value{sysconfdir}/tinc/company/rsa_key.priv},
|
||||
the private ECDSA key is stored in @file{@value{sysconfdir}/tinc/company/ecdsa_key.priv},
|
||||
and the public RSA and ECDSA keys are put into the host configuration file in the @file{@value{sysconfdir}/tinc/company/hosts/} directory.
|
||||
|
||||
@subsubheading Starting
|
||||
|
||||
|
|
@ -1545,7 +1761,7 @@ their daemons, tinc will try connecting until they are available.
|
|||
If everything else is done, you can start tinc by typing the following command:
|
||||
|
||||
@example
|
||||
tincd -n @var{netname}
|
||||
tincctl -n @var{netname} start
|
||||
@end example
|
||||
|
||||
@cindex daemon
|
||||
|
|
@ -1600,6 +1816,12 @@ Store a cookie in @var{filename} which allows tincctl to authenticate.
|
|||
If unspecified, the default is
|
||||
@file{@value{localstatedir}/run/tinc.@var{netname}.pid}.
|
||||
|
||||
@item -o, --option=[@var{HOST}.]@var{KEY}=@var{VALUE}
|
||||
Without specifying a @var{HOST}, this will set server configuration variable @var{KEY} to @var{VALUE}.
|
||||
If specified as @var{HOST}.@var{KEY}=@var{VALUE},
|
||||
this will set the host configuration variable @var{KEY} of the host named @var{HOST} to @var{VALUE}.
|
||||
This option can be used more than once to specify multiple configuration variables.
|
||||
|
||||
@item -L, --mlock
|
||||
Lock tinc into main memory.
|
||||
This will prevent sensitive data like shared private keys to be written to the system swap files/partitions.
|
||||
|
|
@ -1868,6 +2090,7 @@ tincctl -n @var{netname} reload
|
|||
|
||||
@menu
|
||||
* tincctl runtime options::
|
||||
* tincctl environment variables::
|
||||
* tincctl commands::
|
||||
* tincctl examples::
|
||||
* tincctl top::
|
||||
|
|
@ -1900,6 +2123,16 @@ Output version information and exit.
|
|||
|
||||
@end table
|
||||
|
||||
@c ==================================================================
|
||||
@node tincctl environment variables
|
||||
@section tincctl environment variables
|
||||
|
||||
@table @env
|
||||
@cindex NETNAME
|
||||
@item NETNAME
|
||||
If no netname is specified on the command line with the @option{-n} option,
|
||||
the value of this environment variable is used.
|
||||
@end table
|
||||
|
||||
@c ==================================================================
|
||||
@node tincctl commands
|
||||
|
|
@ -1908,8 +2141,43 @@ Output version information and exit.
|
|||
@c from the manpage
|
||||
@table @code
|
||||
|
||||
@item start
|
||||
Start @samp{tincd}.
|
||||
@item init [@var{name}]
|
||||
Create initial configuration files and RSA and ECDSA keypairs with default length.
|
||||
If no @var{name} for this node is given, it will be asked for.
|
||||
|
||||
@item config [get] @var{variable}
|
||||
Print the current value of configuration variable @var{variable}.
|
||||
If more than one variable with the same name exists,
|
||||
the value of each of them will be printed on a separate line.
|
||||
|
||||
@item config [set] @var{variable} @var{value}
|
||||
Set configuration variable @var{variable} to the given @var{value}.
|
||||
All previously existing configuration variables with the same name are removed.
|
||||
To set a variable for a specific host, use the notation @var{host}.@var{variable}.
|
||||
|
||||
@item config add @var{variable} @var{value}
|
||||
As above, but without removing any previously existing configuration variables.
|
||||
|
||||
@item config del @var{variable} [@var{value}]
|
||||
Remove configuration variables with the same name and @var{value}.
|
||||
If no @var{value} is given, all configuration variables with the same name will be removed.
|
||||
|
||||
@item edit @var{filename}
|
||||
Start an editor for the given configuration file.
|
||||
You do not need to specify the full path to the file.
|
||||
|
||||
@item export
|
||||
Export the host configuration file of the local node to standard output.
|
||||
|
||||
@item export-all
|
||||
Export all host configuration files to standard output.
|
||||
|
||||
@item import [--force]
|
||||
Import host configuration file(s) from standard input.
|
||||
Already existing host configuration files are not overwritten unless the option --force is used.
|
||||
|
||||
@item start [tincd options]
|
||||
Start @samp{tincd}, optionally with the given extra options.
|
||||
|
||||
@item stop
|
||||
Stop @samp{tincd}.
|
||||
|
|
@ -1943,8 +2211,15 @@ Dump a list of all known subnets in the VPN.
|
|||
@item dump connections
|
||||
Dump a list of all meta connections with ourself.
|
||||
|
||||
@item dump graph
|
||||
@item dump graph | digraph
|
||||
Dump a graph of the VPN in dotty format.
|
||||
Nodes are colored according to their reachability:
|
||||
red nodes are unreachable, orange nodes are indirectly reachable, green nodes are directly reachable.
|
||||
Black nodes are either directly or indirectly reachable, but direct reachability has not been tried yet.
|
||||
|
||||
@item info @var{node} | @var{subnet} | @var{address}
|
||||
Show information about a particular @var{node}, @var{subnet} or @var{address}.
|
||||
If an @var{address} is given, any matching subnet will be shown.
|
||||
|
||||
@item purge
|
||||
Purges all information remembered about unreachable nodes.
|
||||
|
|
@ -1952,6 +2227,10 @@ Purges all information remembered about unreachable nodes.
|
|||
@item debug @var{level}
|
||||
Sets debug level to @var{level}.
|
||||
|
||||
@item log [@var{level}]
|
||||
Capture log messages from a running tinc daemon.
|
||||
An optional debug level can be given that will be applied only for log messages sent to tincctl.
|
||||
|
||||
@item retry
|
||||
Forces tinc to try to connect to all uplinks immediately.
|
||||
Usually tinc attempts to do this itself,
|
||||
|
|
@ -1986,6 +2265,16 @@ tincctl -n vpn pcap | tcpdump -r -
|
|||
tincctl -n vpn top
|
||||
@end example
|
||||
|
||||
Example of configuring tinc using tincctl:
|
||||
|
||||
@example
|
||||
tincctl -n vpn init foo
|
||||
tincctl -n vpn config Subnet 192.168.1.0/24
|
||||
tincctl -n vpn config bar.Address bar.example.com
|
||||
tincctl -n vpn config ConnectTo bar
|
||||
tincctl -n vpn export | gpg --clearsign | mail -s "My config" vpnmaster@@example.com
|
||||
@end example
|
||||
|
||||
@c ==================================================================
|
||||
@node tincctl top
|
||||
@section tincctl top
|
||||
|
|
@ -2531,7 +2820,6 @@ For IPv4 addresses:
|
|||
@tab @code{netsh interface ip set address} @var{interface} @code{static} @var{address} @var{netmask}
|
||||
@end multitable
|
||||
|
||||
|
||||
For IPv6 addresses:
|
||||
|
||||
@multitable {Darwin (MacOS/X)} {ifconfig route add -bla network address netmask netmask prefixlength interface}
|
||||
|
|
@ -2553,6 +2841,22 @@ For IPv6 addresses:
|
|||
@tab @code{netsh interface ipv6 add address} @var{interface} @code{static} @var{address}/@var{prefixlength}
|
||||
@end multitable
|
||||
|
||||
On some platforms, when running tinc in switch mode, the VPN interface must be set to tap mode with an ifconfig command:
|
||||
|
||||
@multitable {Darwin (MacOS/X)} {ifconfig route add -bla network address netmask netmask prefixlength interface}
|
||||
@item OpenBSD
|
||||
@tab @code{ifconfig} @var{interface} @code{link0}
|
||||
@end multitable
|
||||
|
||||
On Linux, it is possible to create a persistent tun/tap interface which will
|
||||
continue to exist even if tinc quit, although this is normally not required.
|
||||
It can be useful to set up a tun/tap interface owned by a non-root user, so
|
||||
tinc can be started without needing any root privileges at all.
|
||||
|
||||
@multitable {Darwin (MacOS/X)} {ifconfig route add -bla network address netmask netmask prefixlength interface}
|
||||
@item Linux
|
||||
@tab @code{ip tuntap add dev} @var{interface} @code{mode} @var{tun|tap} @code{user} @var{username}
|
||||
@end multitable
|
||||
|
||||
@c ==================================================================
|
||||
@node Routes
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
.Dd 2011-06-25
|
||||
.Dd 2012-10-14
|
||||
.Dt TINCCTL 8
|
||||
.\" Manual page created by:
|
||||
.\" Scott Lamb
|
||||
|
|
@ -37,12 +37,58 @@ Display short list of options.
|
|||
.It Fl -version
|
||||
Output version information and exit.
|
||||
.El
|
||||
.Sh ENVIRONMENT VARIABLES
|
||||
.Bl -tag -width indent
|
||||
.It Ev NETNAME
|
||||
If no netname is specified on the command line with the
|
||||
.Fl n
|
||||
option, the value of this environment variable is used.
|
||||
.El
|
||||
.Sh COMMANDS
|
||||
.zZ
|
||||
.Bl -tag -width indent
|
||||
.It start
|
||||
.It init Op Ar name
|
||||
Create initial configuration files and RSA and ECDSA keypairs with default length.
|
||||
If no
|
||||
.Ar name
|
||||
for this node is given, it will be asked for.
|
||||
.It config Oo get Oc Ar variable
|
||||
Print the current value of configuration variable
|
||||
.Ar variable .
|
||||
If more than one variable with the same name exists,
|
||||
the value of each of them will be printed on a separate line.
|
||||
.It config Oo set Oc Ar variable Ar value
|
||||
Set configuration variable
|
||||
.Ar variable
|
||||
to the given
|
||||
.Ar value .
|
||||
All previously existing configuration variables with the same name are removed.
|
||||
To set a variable for a specific host, use the notation
|
||||
.Ar host Ns Li . Ns Ar variable .
|
||||
.It config add Ar variable Ar value
|
||||
As above, but without removing any previously existing configuration variables.
|
||||
.It config del Ar variable Op Ar value
|
||||
Remove configuration variables with the same name and
|
||||
.Ar value .
|
||||
If no
|
||||
.Ar value
|
||||
is given, all configuration variables with the same name will be removed.
|
||||
.It edit Ar filename
|
||||
Start an editor for the given configuration file.
|
||||
You do not need to specify the full path to the file.
|
||||
.It export
|
||||
Export the host configuration file of the local node to standard output.
|
||||
.It export-all
|
||||
Export all host configuration files to standard output.
|
||||
.It import Op Fl -force
|
||||
Import host configuration file(s) from standard input.
|
||||
Already existing host configuration files are not overwritten unless the option
|
||||
.Fl -force
|
||||
is used.
|
||||
.It start Op tincd options
|
||||
Start
|
||||
.Xr tincd 8 .
|
||||
.Xr tincd 8 ,
|
||||
optionally with the given extra options.
|
||||
.It stop
|
||||
Stop
|
||||
.Xr tincd 8 .
|
||||
|
|
@ -69,6 +115,7 @@ If
|
|||
is omitted, the default length will be 2048 bits.
|
||||
When saving keys to existing files, tinc will not delete the old keys;
|
||||
you have to remove them manually.
|
||||
|
||||
.It dump nodes
|
||||
Dump a list of all known nodes in the VPN.
|
||||
.It dump edges
|
||||
|
|
@ -77,15 +124,25 @@ Dump a list of all known connections in the VPN.
|
|||
Dump a list of all known subnets in the VPN.
|
||||
.It dump connections
|
||||
Dump a list of all meta connections with ourself.
|
||||
.It dump graph
|
||||
.It dump graph | digraph
|
||||
Dump a graph of the VPN in
|
||||
.Xr dotty 1
|
||||
format.
|
||||
Nodes are colored according to their reachability:
|
||||
red nodes are unreachable, orange nodes are indirectly reachable, green nodes are directly reachable.
|
||||
Black nodes are either directly or indirectly reachable, but direct reachability has not been tried yet.
|
||||
.It info Ar node | subnet | address
|
||||
Show information about a particular node, subnet or address.
|
||||
If an address is given, any matching subnet will be shown.
|
||||
.It purge
|
||||
Purges all information remembered about unreachable nodes.
|
||||
.It debug Ar N
|
||||
Sets debug level to
|
||||
.Ar N .
|
||||
.It log Op Ar N
|
||||
Capture log messages from a running tinc daemon.
|
||||
An optional debug level can be given that will be applied only for log messages sent to
|
||||
.Nm tincctl .
|
||||
.It retry
|
||||
Forces
|
||||
.Xr tincd 8
|
||||
|
|
@ -123,7 +180,16 @@ Examples of some commands:
|
|||
tincctl -n vpn dump graph | circo -Txlib
|
||||
tincctl -n vpn pcap | tcpdump -r -
|
||||
tincctl -n vpn top
|
||||
.Pp
|
||||
.Ed
|
||||
Example of configuring tinc using
|
||||
.Nm :
|
||||
.Bd -literal -offset indent
|
||||
tincctl -n vpn init foo
|
||||
tincctl -n vpn config Subnet 192.168.1.0/24
|
||||
tincctl -n vpn config bar.Address bar.example.com
|
||||
tincctl -n vpn config ConnectTo bar
|
||||
tincctl -n vpn export | gpg --clearsign | mail -s "My config" vpnmaster@example.com
|
||||
.Sh TOP
|
||||
The top command connects to a running tinc daemon and repeatedly queries its per-node traffic counters.
|
||||
It displays a list of all the known nodes in the left-most column,
|
||||
|
|
@ -172,7 +238,7 @@ If you find any bugs, report them to tinc@tinc-vpn.org.
|
|||
.Xr tincd 8 ,
|
||||
.Xr tinc.conf 5 ,
|
||||
.Xr dotty 1 ,
|
||||
.Xr pcap-savefile 7 ,
|
||||
.Xr pcap-savefile 5 ,
|
||||
.Xr tcpdump 8 ,
|
||||
.Xr top 1 ,
|
||||
.Pa http://www.tinc-vpn.org/ ,
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
.Dd 2011-06-25
|
||||
.Dd 2012-02-22
|
||||
.Dt TINCD 8
|
||||
.\" Manual page created by:
|
||||
.\" Ivo Timmermans
|
||||
|
|
@ -8,11 +8,12 @@
|
|||
.Nd tinc VPN daemon
|
||||
.Sh SYNOPSIS
|
||||
.Nm
|
||||
.Op Fl cdDKnLRU
|
||||
.Op Fl cdDKnoLRU
|
||||
.Op Fl -config Ns = Ns Ar DIR
|
||||
.Op Fl -no-detach
|
||||
.Op Fl -debug Ns Op = Ns Ar LEVEL
|
||||
.Op Fl -net Ns = Ns Ar NETNAME
|
||||
.Op Fl -option Ns = Ns Ar [HOST.]KEY=VALUE
|
||||
.Op Fl -mlock
|
||||
.Op Fl -logfile Ns Op = Ns Ar FILE
|
||||
.Op Fl -bypass-security
|
||||
|
|
@ -61,6 +62,22 @@ for
|
|||
.Ar NETNAME
|
||||
is the same as not specifying any
|
||||
.Ar NETNAME .
|
||||
.It Fl o, -option Ns = Ns Ar [HOST.]KEY=VALUE
|
||||
Without specifying a
|
||||
.Ar HOST ,
|
||||
this will set server configuration variable
|
||||
.Ar KEY
|
||||
to
|
||||
.Ar VALUE .
|
||||
If specified as
|
||||
.Ar HOST.KEY=VALUE ,
|
||||
this will set the host configuration variable
|
||||
.Ar KEY
|
||||
of the host named
|
||||
.Ar HOST
|
||||
to
|
||||
.Ar VALUE .
|
||||
This option can be used more than once to specify multiple configuration variables.
|
||||
.It Fl L, -mlock
|
||||
Lock tinc into main memory.
|
||||
This will prevent sensitive data like shared private keys to be written to the system swap files/partitions.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue