I’m a real glutton for punishment. I decided to upgrade my parents’ router to OpenWRT. The upgrade went smoothly except for one thing: The VPN I had established between my firewall and theirs.
This was a big enough headache that I even ended up switching my firewall from pfSense to OPNsense (Something I had been contemplating doing for a while anyway) hoping it would make things easier. It didn’t. In the end I abandoned OpenVPN entirely and instead went with Tinc.
Tinc is cool because it’s full mesh peer-to-peer instead of the traditional client / server model. If your equipment supports it, I’d definitely choose it over OpenVPN, especially if multiple sites are involved. A basic rundown of its configuration can be found here.
I used this site as a reference for how to set up tinc. Essentially you decide on a network name, create private & public keys for each host, and configure each host to connect to each other via a config file & folder structure.
Tinc general configuration
On each device create an /etc/tinc/<network name>/hosts directory structure
mkdir -p /etc/tinc/<network name>/hosts
tincd -n <network name> -K 4096
To configure TINC we need some additional configuration files inside the /etc/tinc/<network name> directory
- tinc.conf
- tinc-up (script for bringing up the interface)
- hosts/<hostname> (one for each location)
tinc.conf can be as simple as this:
Name = <name of host>
ConnectTo = <name of other host>
#Add each host with an additional ConnectTo line
There needs to be a corresponding file in the hosts directory for each host. Example host file:
Address = <External IP of host>
Subnet = <Subnet other host will share>
#Add more subnets with additional Subnet lines
The host file also need’s the host’s public key. Append it to the end of the file:
cat /etc/tinc/<network name>/rsa_key.pub >> /etc/tinc/<network name>/hosts/<host name>
It’s easiest to generate the host files on each respective host, then copy them to all the other hosts.
The last step is to create the tinc-up script
#!/bin/sh
ip link set $INTERFACE up
ip addr add 172.16.0.1/24 dev $INTERFACE
Modify the IP used on each host so they don’t overlap. The private network here is what’s used for inter-host communication.
Make the script executable:
chmod 755 /etc/tinc/<network name>/tinc-up
OPNSense specific configuration
I got this working through an enhanced tinc package for OPNsense located here. I will copypasta the content from that site here for easier reference:
Installation
The version might change, adjust it if fetch fails
fetch https://raw.githubusercontent.com/EugenMayer/tinc-opnsense/master/dist/os-tincdcustom-latest.txz
pkg install os-tincdcustom-latest.txz
1. your network
- copy the
/usr/local/etc/tinc/example folder to /usr/local/etc/tinc/yournetwork
- enter
yournetwork into /usr/local/etc/tinc/nets.boot to let this network be started on boot
- create keypairs by runng
tincd -n <yournetwork> -K
2. your network configuration and tun device
- Edit
/usr/local/etc/tinc/yournetwork/tinc.conf set the server you want to connect to and how this server is to be named
- Edit
/usr/local/etc/tinc/yournetwork/tinc-up and adjust the network/netbitmask
3. finally the host configuration
- enter the
/usr/local/etc/tinc/yournetwork/hosts folder and rename the files according to what you have chosen for youservername and theotherservername – they must match!
- enter the public key of the “this server” you find under /usr/local/etc/tinc/yournetwork/ into the according
thisservernamefile and adjust the subnet this server offers (or subnets)
- enter the public key of the “other server” into the according
theotherservername file and adjust the subnet the other server offers (or subnets)
4. OPNsense Interface/Gateway/Route/FW configuration
Please see this answer for a brief description
- You need to create a Gateway, which is configured to go through tinc0 with “dynamic” (do not enter an IP on Gateway field)
- You need to add a route to <remote subnet> through this gateway
- Add your tinc0 interface in the Interface section. You can configure a ipv4 address or you don’t, does not matter. If you do, use your tinc-up configured address. Doing this enabled you to create FW Rules for the Tinc interface – which we will need.
- Add a firewall on the Tinc interface to allow communication to local & remote subnets
- Alternatively, add a single rule for the Tinc interface to allow any/any access (lazy, less secure)
- Don’t forget to create a firewall rule allowing the port you’ve configured tinc to run on access from the internet.
OpenWRT specific configuration
Openwrt follows the general tinc configuration exactly. Make the appropriate folders and config files in /etc/tinc/<network name>/ and then test your configuration:
tincd -n <network name>
Once connection is established and working:
Create interface for your VPN (network / interfaces / add new interface) Select the name of your tinc network name from the list.
Next bridge your VPN to the LAN by going to Network / Firewall and editing your LAN zone. Select your VPN interface created earlier from the list and hit save & apply.
Run on startup
I could not find clear documentation on getting this to work on startup. There is a startup script for tinc but it doesn’t appear to launch my tinc config. I ended up modifying /etc/init.d/tinc and adding these lines to the start() and stop() functions. You could also just write your own simple init script to accomplish this.
start() {
...
/usr/sbin/tincd -n <network name>
}
stop() {
...
kill `pidof tincd`
}
Troubleshooting
Tincdcustom service won’t start in OPNSense
Starting from the GUI just does nothing, starting from CLI reveals this unhelpful error:
configctl tincdcustom status
Error (1)
From the OPNSense docs I determined which command I can run to see exactly why. The command is located in this configd configuration file: /usr/local/opnsense/service/conf/actions.d/actions_tincdcustom.conf
command:/usr/local/etc/rc.d/tincdcustom start
Doing that command manually revealed what the problem was:
/usr/local/etc/rc.d/tincdcustom start
Please create /usr/local/etc/tinc/nets.boot.
I had skipped step 1.2 of the tincdcustom instalaltion guide:
enter yournetwork into /usr/local/etc/tinc/nets.boot to let this network be started on boot
Once I added a single word – the name of the network I want to start on bootup – to /usr/local/etc/tinc/nets.boot – the daemon started and worked properly.
Running Tinc in verbose mode
Coming from the tinc documentation, I ran tinc in verbose mode on both of my hosts to troubleshoot why a connection wasn’t happening. It was very helpful.
tincd -n netname -d5 -D