Guus Sliepen schrieb: > Tinc does not understand STP, but it ensures that the tinc network itself is > loop free. So, you can see your VPN as a dumb switch, with each node being > one > port of that switch. I think that if you bridge the VPN interface to LAN > interfaces, and the bridge itself supports STP, then everything should be > fine.
Thanks, thats exactly what i need to know. > There is an option in the latest version in the git repository that might > help: > > Forwarding = kernel > > This will disable tinc's internal forwarding, and will send all received > packets directly to the VPN interface. Most likely the kernel will try to > send > it back to the VPN interface, since the packets are not for the local node, > but > it would have to get past the firewall first. > > But, there is no guarantee other nodes will send all packets via your central > node. So this is more of a debugging tool than a security feature. That is a great aid for debugging. > Also, it does not tell you which node the packets came from. A solution to > that > could be to add a VLAN or MPLS tag (with a unique ID for each node) to packets > sent to the VPN interface. However, that is not implemented yet. > > As for filtering in tinc: I really do not want to duplicate pf or netfilter in > tinc. It would also be primarily of use for forwarded packets, not for ingress > or egress packets. The best way to keep the clients safe is to educate them > how > to set up their firewalls. Thanks a lot for the tips! _______________________________________________ tinc mailing list [email protected] http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
