{"id":13340692,"url":"https://github.com/cjessett/tinc-config","last_synced_at":"2025-03-11T18:31:38.374Z","repository":{"id":48878405,"uuid":"178953000","full_name":"cjessett/tinc-config","owner":"cjessett","description":"Tinc VPN configuration for accessing a server behind a firewall","archived":false,"fork":false,"pushed_at":"2019-04-03T00:01:06.000Z","size":68,"stargazers_count":5,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2024-10-24T06:28:58.581Z","etag":null,"topics":["aws","ec2","firewall","iot","raspberry-pi","tinc","vpn"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cjessett.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-04-01T21:54:59.000Z","updated_at":"2023-05-16T19:17:14.000Z","dependencies_parsed_at":"2022-09-14T18:20:55.681Z","dependency_job_id":null,"html_url":"https://github.com/cjessett/tinc-config","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cjessett%2Ftinc-config","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cjessett%2Ftinc-config/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cjessett%2Ftinc-config/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cjessett%2Ftinc-config/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cjessett","download_url":"https://codeload.github.com/cjessett/tinc-config/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243090419,"owners_count":20234802,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","ec2","firewall","iot","raspberry-pi","tinc","vpn"],"created_at":"2024-07-29T19:23:54.852Z","updated_at":"2025-03-11T18:31:38.045Z","avatar_url":"https://github.com/cjessett.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Tinc Configuration\n\n[Tinc](https://www.tinc-vpn.org/) allows us to access a server behind a firewall with a non-static IP address by creating a VPN with a another server that has a static IP address. Here we will use an EC2 instance as the host and a Raspberry Pi behind any home network.\n\n![tinc-net](./tinc-net.png)\n\n## Install tinc\n```\nsudo apt-get update\nsudo apt-get install tinc\n```\n\n### Configuration\nTinc uses a netname to distinguish one VPN from another. We will call our VPN `pi-net`.\n\nEach server has 3 components:\n- Config files: `tinc.conf`, `tinc-up`, and `tinc-down`.\n- Public/private key pairs\n- Host config files: contain public keys and addresses\n\n\n## Cloud Server\nAWS EC2 with static IP (Elastic), an __open port 655__, and `tinc` installed.\n\nCreate the configuration directory\n```\nsudo mkdir -p /etc/tinc/pi-net/hosts\n```\n\nCreate a config file `/etc/tinc/pi-net/tinc.conf` with the following:\n```\nName = cloud\nAddressFamily = ipv4\nInterface = tun0\n```\n\nThis creates a node called `cloud`. \n\nNext, create the `cloud` hosts configuration `/etc/tinc/pi-net/hosts/cloud`\n```\nAddress = \u003ccloud_public_ip\u003e\nSubnet = 10.0.0.1/32\n```\n\nNow generate the public/private keypair for this host with the following command:\n```\nsudo tincd -n pi-net -K4096\n```\n\nThis creates the private key (`/etc/tinc/pi-net/rsa_key.priv`) and appends the public key to the cloud hosts configuration file that we recently created (`/etc/tinc/pi-net/hosts/cloud`).\n\nNow, we create the `tinc-up` script `/etc/tinc/pi-net/tinc-up`\n```\n#!/bin/sh\nifconfig $INTERFACE 10.0.0.1 netmask 255.255.255.0\n```\nwhich will run when our VPN is started.\n\nAnd the `tinc-down` script `/etc/tinc/pi-net/tinc-down`\n```\n#!/bin/sh\nifconfig $INTERFACE down\n```\nto remove the network interface when the VPN is stopped.\n\nFinally, make the network scripts executable:\n```\nsudo chmod +x /etc/tinc/pi-net/tinc-*\n```\n\n## Home Server\nRaspberry Pi with the latest version of Raspbian\n\nCreate the configuration directory.\n```\nsudo mkdir -p /etc/tinc/pi-net/hosts\n```\n\nAnd the config file `/etc/tinc/pi-net/tinc.conf`\n```\nName = pi\nAddressFamily = ipv4\nInterface = tun0\nConnectTo = cloud\n```\n\nHere, we have named the node behind the firewall `pi` and configured it to connect to the `cloud` node.\n\nNext, create the hosts configuration `/etc/tinc/pi-net/hosts/pi`\n```\nSubnet = 10.0.0.2/32\n```\n\nAnd generate key pairs:\n```\nsudo tincd -n pi-net -K4096\n```\n\nStartup script `/etc/tinc/pi-net/tinc-up`\n```\nifconfig $INTERFACE 10.0.0.2 netmask 255.255.255.0\n```\n\nThis IP address is how the node will be accessed on the VPN.\n\nAnd the interface stop script `/etc/tinc/pi-net/tinc-down`\n```\nifconfig $INTERFACE down\n```\n\nLastly, make the network scripts executable:\n```\nsudo chmod +x /etc/tinc/pi-net/tinc-*\n```\n\n## Exchange keys between nodes\n\nNow we need to copy the host configuration file from `pi` to `cloud` and vice versa, from `cloud` to `pi`. \n\nSo that each node has the same files in `/etc/tinc/pi-net/hosts`.\n\nOne way to achieve this is `scp`, for example:\n\n### `pi` ==\u003e `local machine` ==\u003e `cloud`\nFrom `pi`, copy the `pi` host config to your local machine\n```\nsudo scp /etc/tinc/pi-net/hosts/pi user@local_machine_ip:/tmp\n```\n\nThen, copy it to `cloud` from your __local machine__:\n```\nscp /tmp/pi user@cloud_public_ip:/tmp\n```\n\nFinally, on `cloud` put in the appropriate directory:\n```\ncd /etc/tinc/pi-net/hosts; sudo cp /tmp/pi ./\n```\n\n### `cloud` ==\u003e `local machine` ==\u003e `pi`\nFrom `cloud`, copy the `cloud` host config to your local machine\n```\nsudo scp /etc/tinc/pi-net/hosts/cloud user@local_machine_ip:/tmp\n```\n\nThen, copy it to `pi` from your __local machine__:\n```\nscp /tmp/cloud user@pi_public_ip:/tmp\n```\n\nFinally, on `pi` put in the appropriate directory:\n```\ncd /etc/tinc/pi-net/hosts; sudo cp /tmp/cloud ./\n```\n\n## Test configuration\n\nOn each node, start `tinc` in debug mode\n```\nsudo tincd -n pi-net -D -d3\n```\n\nFrom another terminal on `cloud` ping the `pi`:\n```\nping 10.0.0.2\n```\n\nThe ping should work fine, and you should see some debug output in the other windows about the connection on the VPN.\n\nNow, you can use the VPN interfaces to do any other network communication like application connections, copying files, and SSH. \n\nQuit the daemon with `CTRL + \\`\n\n## Configure Tinc To Startup on Boot\n\nOn __each node__ create `/etc/tinc/nets.boot`\n```\n# This file contains all names of the networks to be started on system startup.\npi-net\n```\n\nStart tinc with the `service` command\n```\nsudo service tinc@pi-net start\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcjessett%2Ftinc-config","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcjessett%2Ftinc-config","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcjessett%2Ftinc-config/lists"}