1 [[!meta title="bridging Ethernet segments using tinc under Linux"]]
3 ## Example: bridging Ethernet segments using tinc under Linux
5 Normally, in the default router mode, tinc will only tunnel IPv4 and IPv6
6 unicast packets. However, since 1.0pre5 there is an option to let the tinc
7 daemon act as a switch or a hub (using the Mode configuration variable). This
8 mode is necessary for tinc to pass non-IP based protocols (NetBEUI, AppleTalk,
9 IPX, etcetera), and to allow broadcast-based functionality in some applications
10 (Windows 'Network Neighborhood' without a WINS server, among others) to be
11 usable on a VPN created with tinc.
13 In switch and hub mode, broadcast packets are broadcast to other daemons and
14 (in switch mode) MAC addresses are dynamically learned from other tinc daemons
15 in order to route packets. With these mode tinc can be used to act as a bridge
16 between two or more Ethernet segments.
20 The network setup is as follows:
22 * Internal network, on both sides, is 192.168.0.0/16
23 * The host's own IP address on the internal network is 192.168.10.20
25 The gateway of each segment has an external interface, eth0, and an internal
26 interface eth1. Furthermore a bridge interface will be created with name
27 "bridge", and the internal interface will be made a slave of this bridge. The
28 virtual network interface used by tinc will also be a slave. Configuration of
29 the kernel In addition to the standard kernel configuration described in the
30 Configuring the kernel section of the manual, a bridge device needs to be added
31 to your kernel configuration.
33 To add the bridge device to the Linux 2.4.0 and higher kernels, select the
34 option under 'Networking options' called 802.1d Ethernet Bridging. You may
35 either compile this option as a module or build it into the kernel.
36 Configuration of the interfaces Switch and hub modes require that both sides of
37 a tinc VPN be contained within the same subnet (in this example, the subnet is
38 192.168.0.0/16). This is no different from the configuration that would be
39 required if tinc was replaced with an actual switch or hub.
41 > host# brctl addbr bridge
42 > host# ifconfig bridge 192.168.10.20 netmask 255.255.0.0
44 > host# ifconfig eth1 0.0.0.0
45 > host# brctl addif bridge eth1
46 > host# ifconfig eth1 up
48 > After starting tinc:
51 > bridge name bridge id STP enabled interfaces
52 > bridge 8000.005004003002 yes eth1
56 > eth0 Link encap:Ethernet HWaddr 00:20:30:40:50:60
57 > inet addr:123.234.123.42 Bcast:123.234.123.255 Mask:255.255.255.0
58 > UP BROADCAST RUNNING MTU:1500 Metric:1
61 > eth1 Link encap:Ethernet HWaddr 00:11:22:33:44:55
62 > UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
65 > lo Link encap:Local Loopback
66 > inet addr:127.0.0.1 Mask:255.0.0.0
67 > UP LOOPBACK RUNNING MTU:3856 Metric:1
70 > bridge Link encap:Ethernet HWaddr 00:11:22:33:44:55
71 > inet addr:192.168.10.20 Bcast:192.168.255.255 Mask:255.255.0.0
72 > UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
74 > vpn Link encap:Ethernet HWaddr 00:11:22:33:44:55
75 > UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
79 > Kernel IP routing table
80 > Destination Gateway Genmask Flags Metric Ref Use Iface
81 > 123.234.123.0 * 255.255.255.0 U 0 0 0 eth0
82 > 192.168.0.0 * 255.255.0.0 U 0 0 0 bridge
83 > default 123.234.123.1 0.0.0.0 UG 0 0 0 eth0
85 ### Configuration of tinc
87 Note that switch' and hub' mode do not utilize the Subnet variable in the host
88 files. Instead, any packet received by the bridge interface will be passed to
89 the TUN/TAP device for processing. If your tinc instance is running in hub
90 mode, all packets are forwarded to the remote tinc instance. In switch mode,
91 tinc maintains an ARP cache to determine whether any received packet should be
92 forwarded to the remote tinc instance.
94 > host# cat /etc/tinc/vpn/tinc.conf
98 > ConnectTo = segment2
100 > host# cat /etc/tinc/vpn/tinc-up
103 > ifconfig vpn 0.0.0.0
104 > brctl addif bridge vpn
107 > host# ls /etc/tinc/vpn/hosts
108 > segment1 segment2 ...
110 > host# cat /etc/tinc/vpn/hosts/segment1
111 > Address = 123.234.123.42
112 > -----BEGIN RSA PUBLIC KEY-----
114 > -----END RSA PUBLIC KEY-----
116 > host# cat /etc/tinc/vpn/hosts/segment2
117 > Address = 200.201.202.203
118 > -----BEGIN RSA PUBLIC KEY-----
120 > -----END RSA PUBLIC KEY-----
122 ### Additional Configuration
124 If the Ethernet interface added to the bridge was used for the default route,
125 you will need to re-add the default route.
127 If you want to be able to filter packets on your bridge interface, you will
128 need to a kernel with [ebtables](http://ebtables.sourceforge.net/) support.
129 More information For more information on Linux bridging, see the [bridge-utils
130 homepage](http://www.linuxfoundation.org/en/Net:Bridge).