<div dir="ltr">I have done it... added on both routers a new firewall zone covering the tinc interface, policy in accept, out accept, fwd accept, interzone forwarding from/to LAN.... when I do it, I am not even able to ping the routers between them, even though the PING PONG is ok in the tinc debug....<br></div><div class="gmail_extra"><br><div class="gmail_quote">2018-05-24 20:28 GMT+02:00 Naemr . <span dir="ltr"><<a href="mailto:naemrr@gmail.com" target="_blank">naemrr@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto">did you add a forwarding allow rule from tinc interface to lan and vise versa on both ends? even with firewall off default is to not forward till told to do so. </div><br><div class="gmail_quote"><div><div class="h5"><div dir="ltr">On Thu, May 24, 2018, 10:07 AM Davide L <<a href="mailto:davide.lovreglio@gmail.com" target="_blank">davide.lovreglio@gmail.com</a>> wrote:<br></div></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"><div dir="ltr">
<div>Dear all,</div><div><br></div><div>I am trying to configure a basic
TINC vpn between two sites using OpenWRT routers. The link seems to
work, the ping between the two routers is ok, but I can't ping hosts
between the subnets behind the routers.</div><div><br></div><div>This is the configuration:</div><div><br></div><div>======== SITE 1 (CLIENT) - polimnia (subnet <a href="http://192.168.4.0/24" rel="noreferrer" target="_blank">192.168.4.0/24</a>, gw 192.168.4.1)<br></div><div><br></div><div>tinc.conf</div><div>-------------</div><div>Name = polimnia<br>ConnectTo = calliope</div><div><br></div><div>hosts/polimnia</div><div>---------------------</div><div>Subnet = <a href="http://172.16.0.4/32" rel="noreferrer" target="_blank">172.16.0.4/32</a><br>Subnet = <a href="http://192.168.4.0/24" rel="noreferrer" target="_blank">192.168.4.0/24</a></div><div></div><div><br></div><div><br></div><div>tinc-up script</div><div>-------------------</div><div>
#!/bin/sh
<br></div><div>ip link set $INTERFACE up<br>ip addr add <a href="http://172.16.0.4/24" rel="noreferrer" target="_blank">172.16.0.4/24</a> dev $INTERFACE<br>ip route add <a href="http://192.168.2.0/24" rel="noreferrer" target="_blank">192.168.2.0/24</a> dev $INTERFACE</div><div><br></div><div>
<div>======== SITE 2 (SERVER) - calliope (subnet <a href="http://192.168.2.0/24" rel="noreferrer" target="_blank">192.168.2.0/24</a>, gw 192.168.2.1)<br></div><div><br></div><div>tinc.conf</div><div>-------------</div><div>Name = calliope<br></div><div><br></div><div>hosts/calliope</div><div>---------------------</div>Address = [ip public address] ........<br>Subnet = <a href="http://172.16.0.2/32" rel="noreferrer" target="_blank">172.16.0.2/32</a><br>Subnet = <a href="http://192.168.2.0/24" rel="noreferrer" target="_blank">192.168.2.0/24</a><div><br></div><div>tinc-up script</div><div>-------------------</div><div>#!/bin/sh<br>ip link set $INTERFACE up<br>ip addr add <a href="http://172.16.0.2/24" rel="noreferrer" target="_blank">172.16.0.2/24</a> dev $INTERFACE<br>ip route add <a href="http://192.168.4.0/24" rel="noreferrer" target="_blank">192.168.4.0/24</a> dev $INTERFACE</div>
</div><div><br></div><div>==============================<wbr>===========================</div><div><br></div><div>When
I run both tincd daemons in verbose mode, the connection starts
correctly and the two routers can reach each others, but not the hosts
in the subnets.</div><div><br></div><div>I tried deactivating the firewalls on both routers, thus I don't think it is a firewall issue.</div><div><br></div><div>The line
"ip route add" is in both tinc-up script, so it should work....</div><div><br></div><div>I don't know how to solve the problem.</div><div><br></div><div>Thank you in advance for any help.</div><div class="m_-8461583661812922629m_-6885527729233730213gmail-yj6qo m_-8461583661812922629m_-6885527729233730213gmail-ajU"><div id="m_-8461583661812922629m_-6885527729233730213gmail-:15x" class="m_-8461583661812922629m_-6885527729233730213gmail-ajR"><img class="m_-8461583661812922629m_-6885527729233730213gmail-ajT" src="https://ssl.gstatic.com/ui/v1/icons/mail/images/cleardot.gif"></div></div><span class="m_-8461583661812922629m_-6885527729233730213gmail-HOEnZb m_-8461583661812922629m_-6885527729233730213gmail-adL"><font color="#888888"><div>Davide</div></font></span>
<br></div></div></div>
______________________________<wbr>_________________<br>
tinc mailing list<br>
<a href="mailto:tinc@tinc-vpn.org" rel="noreferrer" target="_blank">tinc@tinc-vpn.org</a><br>
<a href="https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc" rel="noreferrer noreferrer" target="_blank">https://www.tinc-vpn.org/cgi-<wbr>bin/mailman/listinfo/tinc</a><br>
</blockquote></div>
<br>______________________________<wbr>_________________<br>
tinc mailing list<br>
<a href="mailto:tinc@tinc-vpn.org">tinc@tinc-vpn.org</a><br>
<a href="https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc" rel="noreferrer" target="_blank">https://www.tinc-vpn.org/cgi-<wbr>bin/mailman/listinfo/tinc</a><br>
<br></blockquote></div><br></div>