<div dir="ltr">Matt,<div><br></div><div>I see. I suppose if that's right there's something I'm overlooking but it seems not quite right to me. I'll try to elaborate.</div><div><br></div><div>The BranchA host file, that all other nodes receive states a <a href="http://10.1.0.0/16">10.1.0.0/16</a> network, stating that 10.1.x.x lives at BranchA and that routing is required to reach it (because router mode is the default mode when no mode is specified).</div>
<div>BranchA actually configures its virtual adapter as <a href="http://10.1.54.1/8">10.1.54.1/8</a> claiming that all of 10.x.x.x is LAN, therefore reachable without any routing.</div><div><br></div><div>The same story goes for all other branches. They have host files stating that some 10.N.x.x/16 network is "over there" and requires routing to reach, then they configure their local virtual adapter with 10.x.x.x/8 which is in conflict with the above and states that 10.N.x.x is within local broadcast range.</div>
<div><br></div><div>There may be some reason I'm missing why this configuration is correct despite what looks like a contradiction. Somehow it's working anyway with most of your nodes. However I would try changing each node's tinc-up netmask to match its corresponding host file and see how that goes.</div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Jan 27, 2014 at 10:50 AM, Matthew Tolle <span dir="ltr"><<a href="mailto:matt@night.com" target="_blank">matt@night.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word"><div><br></div><div>Hi Donald,</div><div><br></div><div>I was following the example provided here:</div><div><br></div><div><a href="http://www.tinc-vpn.org/documentation-1.1/Example-configuration.html#Example-configuration" target="_blank">http://www.tinc-vpn.org/documentation-1.1/Example-configuration.html#Example-configuration</a></div>
<div><br></div><div>Is there a better way to do it?</div><div><br></div><div>-Matt</div><div><div class="h5"><div><br></div><br><div><div>On Jan 25, 2014, at 8:54 AM, Donald Pearson <<a href="mailto:donaldwhpearson@gmail.com" target="_blank">donaldwhpearson@gmail.com</a>> wrote:</div>
<br><blockquote type="cite"><div dir="ltr">I admit it's been a long time since I've used tinc so I'm pretty rusty, but your config does seem a little odd to me.<div><br></div><div>You are in router mode, and defining /16 networks for each location, but then bringing up the tinc interface for something with a /8. From the perspective of that interface then every 10.x.x.x address is a "peer" on a LAN that can be reached via switching, not routing.</div>
<div><br></div><div>Maybe that has nothing to do with it though, and it is curious that only one endpoint is impacted.</div><div><br></div><div>Does your vpn not work if you use a /16 in your tinc-up script?</div></div><div class="gmail_extra">
<br><br><div class="gmail_quote">On Tue, Jan 21, 2014 at 10:59 AM, Matthew Tolle <span dir="ltr"><<a href="mailto:matt@night.com" target="_blank">matt@night.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word"><div><br></div><div>Hi Donald,</div><div><br></div><div>Thanks for the idea. I didn't even think about MAC conflicts. I checked all the servers that participate in the tinc network and they are different. The tunnel link all look like this: </div>
<div><br></div><div>home Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00</div><div><br></div><div>Those links are POINTOPOINT connections so I think that's ok. I don't think I need to makeup and set a MAC address for each of those do I?</div>
<div><br></div><div>I'll poke around and check the other servers at node2 site to see if there are any conflicts there.. but I doubt there is. </div><div><br></div><div>-Matt</div><div><div><br><div><div>On Jan 21, 2014, at 7:05 AM, Donald Pearson <<a href="mailto:donaldwhpearson@gmail.com" target="_blank">donaldwhpearson@gmail.com</a>> wrote:</div>
<br><blockquote type="cite"><div dir="ltr">My 1st guess would be IP or MAC address conflicts.</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Jan 21, 2014 at 1:07 AM, Matthew Tolle <span dir="ltr"><<a href="mailto:matt@night.com" target="_blank">matt@night.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
Howdy Folks,<br>
<br>
I've got a 5 node setup here. My server "home" is the primary server that all other servers connect to. The configs on all the servers look like this:<br>
<br>
# cat /etc/tinc/home/hosts/node1<br>
Subnet = <a href="http://10.2.0.0/16" target="_blank">10.2.0.0/16</a><br>
Address = 192.168.2.1<br>
<br>
<RSA KEY><br>
<br>
# cat /etc/tinc/home/hosts/node2<br>
Subnet = <a href="http://10.3.0.0/16" target="_blank">10.3.0.0/16</a><br>
Address = 192.168.3.1<br>
<br>
<RSA KEY><br>
<br>
Etc. All the hosts are setup the same.<br>
<br>
# /sbin/tinc -n home dump subnets<br>
<a href="http://10.1.0.0/16" target="_blank">10.1.0.0/16</a> owner home<br>
<a href="http://10.2.0.0/16" target="_blank">10.2.0.0/16</a> owner node1<br>
<a href="http://10.3.0.0/16" target="_blank">10.3.0.0/16</a> owner node2<br>
<a href="http://10.4.0.0/16" target="_blank">10.4.0.0/16</a> owner node3<br>
<a href="http://10.5.0.0/16" target="_blank">10.5.0.0/16</a> owner node4<br>
<br>
# cat /etc/tinc/home/tinc-up<br>
ifconfig $INTERFACE 10.2.0.10 netmask 255.0.0.0<br>
ifconfig $INTERFACE up<br>
<br>
# cat tinc.conf<br>
Name = node1<br>
ConnectTo = home<br>
Mode = router<br>
AddressFamily = ipv4<br>
PingInterval = 600<br>
PingTimeout = 15<br>
<br>
4 out of 5 nodes work just fine. Node 2 however has issues. It does work fine for 5-30m and then pauses my connection to it. It's still up. I can't ping it over the "pause time" with 0% packet loss. Any TCP connection over the link just pauses for a while. The odd thing is it doesn't timeout. In an SSH session to the box over the tinc link I'll type "ps -ef" and 10m later I'll get the response. SSH should timeout way before then so I'm not sure what's going on. It's not like that all the time. I get maybe 15-30m when it's working just fine and then 10m of network pause. While my SSH session is paused I can see that the app on the server is talking to my primary node over the tunnel. That seems odd.<br>
<br>
The app on the node side seems happy and can reach everything it needs to. No sign of issue there. It only seems to be an issue over the tinc tunnel. It kind of feels like maybe something is routing the IP space in a different direction for a period of time and then it comes back. If that were the case my TCP ssh connection would timeout well before the connection returns to life.<br>
<br>
Has anyone seen anything like this? I've poked at a bunch of things to try and pinpoint the issue. So far no love.<br>
<br>
The routing table looks fine and the same on all of them:<br>
<br>
Kernel IP routing table<br>
Destination Gateway Genmask Flags Metric Ref Use Iface<br>
0.0.0.0 192.168.3.1 0.0.0.0 UG 0 0 0 eth0<br>
10.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 home<br>
192.168.3.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0<br>
<br>
Nothing else in node2's area uses 10. space.<br>
<br>
Any ideas I would appreciate it.<br>
<br>
Thanks,<br>
<br>
-Matt<br>
_______________________________________________<br>
tinc mailing list<br>
<a href="mailto:tinc@tinc-vpn.org" target="_blank">tinc@tinc-vpn.org</a><br>
<a href="http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc" target="_blank">http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc</a><br>
</blockquote></div><br></div>
_______________________________________________<br>tinc mailing list<br><a href="mailto:tinc@tinc-vpn.org" target="_blank">tinc@tinc-vpn.org</a><br><a href="http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc" target="_blank">http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc</a><br>
</blockquote></div><br></div></div></div><br>_______________________________________________<br>
tinc mailing list<br>
<a href="mailto:tinc@tinc-vpn.org" target="_blank">tinc@tinc-vpn.org</a><br>
<a href="http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc" target="_blank">http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc</a><br>
<br></blockquote></div><br></div>
_______________________________________________<br>tinc mailing list<br><a href="mailto:tinc@tinc-vpn.org" target="_blank">tinc@tinc-vpn.org</a><br><a href="http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc" target="_blank">http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc</a><br>
</blockquote></div><br></div></div></div><br>_______________________________________________<br>
tinc mailing list<br>
<a href="mailto:tinc@tinc-vpn.org">tinc@tinc-vpn.org</a><br>
<a href="http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc" target="_blank">http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc</a><br>
<br></blockquote></div><br></div>