reddec / tinc-boot

Bootstrap your Tinc node quickly and easy

Tinc-Boot

Idea to create a easy-to-use wrapper over tinc vpn.

Quick start (linux only)

skip to installation

Automatic

node 1

sudo tinc-boot run

node 2

follow command from previous operation

Custom token

node 1

sudo tinc-boot -t MYSECRET run 

node 2

sudo tinc-boot run -t MYSECRET --join http://<node1>:8665

Firewall

Use (--ufw) to open port on ufw-based systems automatically

tinc-boot run --ufw ...

Required opened default ports:

• <port>/udp,<port>/tcp - port defined as --tinc-port or generated in tinc.conf
• 8665/tcp - port defined as -p --port for boot protocol
• 18655/tcp (tinc interface) - internal port for communication. Only for interface defined in tinc.conf

Overview

Tinc VPN - is full-mesh, auto-healing, time-proofed VPN system without single point of failure, with high-throughput and serious cryptography. All nodes in a Tinc network are fully equal. New nodes discovering full topology through any entry point. Node may interact with each other even if they don't have direct connections.

Tinc is a great and have a lot of features. It's ideal for a complicated situations (China, Russia and others). I really admire the project.

But... it's pain to configure and maintain.

Pain to create a new node. Pain to add new node to network.

Minimal configuration for a first public node:

• 2 files (tinc.conf, hostfile),
• 1 script (tinc-up),
• 2 directories (net, hosts),
• 1 command execution (key generation).

(let's not count service initialization and other common stuff)

Second node adds key exchange (+1 operation if we will use rsync, or +2 operations if manually).

Next new public nodes require increasing number of additional operations (+N operations, where N is a number of public nodes).

To be honest, to just to connect to the network an only single key exchange operation required: with any public node. Than tincd will discover all other nodes.

But after your node disconnect/reboot and in case of death of your entry node you will be no more able to connect to other alive nodes (because they don't know your key and your node don't know theirs).

Tinc-boot - is a all-in-one tool with zero dependency (except tinc of course), that aims to achieve:

1. one-line node initialization
2. automatic keys distribution
3. simplified procedure to add new node to existent net

With simple UI (available on your VPN address with port 1655 by default)

Donating always welcome

• ETH: 0xA4eD4fB5805a023816C9B55C52Ae056898b6BdBC
• BTC: bc1qlj4v32rg8w0sgmtk8634uc36evj6jn3d5drnqy

Installation

• (recommended) look at releases page and download
• one line shell command:

curl -L https://github.com/reddec/tinc-boot/releases/latest/download/tinc-boot_linux_amd64.tar.gz | sudo tar -xz -C /usr/local/bin/ tinc-boot

• build from source go get -v github.com/reddec/tinc-boot/cmd/...

• Ansible galaxy: ansible-galaxy install reddec.tinc_boot

• From bintray repository for most debian-based distribution (trusty, xenial, bionic, buster, wheezy):

sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 379CE192D401AB61
echo "deb https://dl.bintray.com/reddec/debian {distribution} main" | sudo tee -a /etc/apt/sources.list
sudo apt install tinc-boot

Independent maintainers

• Arch Linux in AUR package tinc-boot-git: yaourt -S tinc-boot-git

Support

• Community Discord
• Contact me

Build requirements

• go 1.13+

Documentation

• Available by --help for all commands
• Available in MANUAL.md

Runtime requirements

• Linux
• tincd 1.10.xx
• bash
• (recommended) systemd

Tested operation systems

• Ubuntu 18.04 x64
• Archlinux (Q1 2019) x64
• Manjaro (Q1 2019) x64

Should work on all major linux systems, except generated helpers useful only for systemd-based OS.

Quick start

Download/build binary to /usr/local/bin/tinc-boot.

First node

sudo tinc-boot gen --standalone -a <PUBLIC ADDRESS>

and follow recommendations

Explanation

• --standalone means that it's a first node, no need for keys exchange
• -a <address> sets public address of node (if exists); could be used several times

Will generate all required files under /etc/tinc/dnet.

Turn node to boot node

sudo tinc-boot bootnode --service --token <SECRETTOKEN>

and follow recommendations

Explanation

• --service generates systemd file to /etc/systemd/system/tinc-boot-{net}.service
• --dir location of tinc configuration
• --token set's authorization token that will be used by clients

Create another node and join to net

sudo tinc-boot gen --token <SECRETTOKEN> <PUBLIC ADDRESS>:8655

Don't forget add -a <NODE ADDRESS> if applicable

and follow recommendations

How it works

• Обзор (RU)
• Overview (EN)

Windows

Non-primary platform, limited support, but should work

Tested only for x64

See proof on Youtube

Requirements:

1. Tinc for Windows: download on official site
2. Install TAP driver!:

• Go to C:\Program Files(x86)\tinc\tap-win64
• As administrator run addtap.bat

3. Rename generated network adapter to the name of the network (dnet by-default)

Usage:

1. Launch command line As administrator
2. Navigate to the directory with tinc-boot.exe
3. With black-magic, tinc-boot.exe /help command and instructions for normal OS (*Nix) generate config

tinc-boot's Issues

Random private subnet

random will be generated once in 172.0.0.0/8
!!!!
RFC1918: 172.16.0.0 - 172.31.255.255 (172.16/12 prefix)

I run tinc-boot and got: 172.173.202.125
you can get someone else's public address and this is a problem

Minor Issues

Greetings!

I encountered another issue on the windows port. It seems that whenever you make a slight change to the virtual adapter, the webpage interface rejects the connection.
(In my case I just wanted to change the interface metric...)

Also is there a debug mode available? Reason I ask is I am not entirely sure if the nodes are fully connecting or not.

Cheers!

Possible Windows Port?

Greetings!

I am presently working on creating a Tinc network and found your project and thought it could be an amazing fit. The issue is that there are nodes that operate on windows.

I didn't see the page mentioning any setup for other operating systems outside Linux, which leads me to presume there isn't a way to apply this project to nodes running off of windows.

Could it be possible down the line to port to windows, or not as of right now?

Cheers!

'go get' fails

I just now tried to build this using go get, but I received the error below. I haven't tried to debug it, but I figured I'd let you know.

$ go get -v github.com/reddec/tinc-boot/cmd/...
github.com/reddec/tinc-boot/domain/monitor
# github.com/reddec/tinc-boot/domain/monitor
/usr/local/src/golang/src/github.com/reddec/tinc-boot/domain/monitor/service.go:58:37: stream.Handler undefined (type *events.wsStreamer has no field or method Handler)
/usr/local/src/golang/src/github.com/reddec/tinc-boot/domain/monitor/service.go:64:9: stream.Close undefined (type *events.wsStreamer has no field or method Close)

Bintray discontinued

The Bintray service is no longer available. Please move the debian packages to another hosting service.

customize the subnet

Hi there,
is there any option to set a specific subnet?
I would like to use 10.0.0.0/16 as a subnet and choose a static ip for each node rather than random
thanks

Seems has some bug after use customized network name

When use customized network name like "snet" rather than the default "dnet", it can create successfully with the standalone mode, but when try to add other node to it via command tinc-boot gen --network="snet" --token xxxxxx, it will failed with error "http://example.com:8665 can't open /etc/tinc/dnet/hosts/xxxx: no such file or directory". Seems the variable "network" didn't work properly.

Error when creating bootnode.

Greetings!

I was following the guide, and everything was looking positive until I tried to convert the node into a boot node. This is the error I got.

I am using a compiled windows version of tinc-boot to do this. Am I doing something wrong?

Support for tinc v1.1

Hi
I really like the idea of tinc-boot, but would like to get it to work with tinc 1.1pre*

Tinc network goes down when bootnode is not available

Hi, I created Tinc VPN with tinc-boot. The setup consists of 3 VM's, out of which one acts as the bootnode. Running Tinc in switch mode because I need to run Keepalived over Tinc. Everything works fine when bootnode is running, but once it goes down no node can reach each other. How can I solve this single point of failure?
Steps followed:

1. tinc-boot standalone on VM1
2. tinc-boot bootnode on VM1
3. tinc-boot gen --token :8655 on other machines.

local path

please consider to add tinc-boot run from a local dir, without hardcoded path,
so it's possible to use only the two executable in the same folder, tinc-boot.exe and tincd.exe, to make things works, in portable fashion.

"tincd": executable file not found in $PATH