Guus Sliepen <[email protected]> writes: > On Sat, Aug 31, 2013 at 10:27:55AM -0700, Nikolaus Rath wrote: > >> What I want to do is be able to talk to a tinc server on port 443 >> (https) using just TCP, so that the client has the best possible chance >> of making it through any overly restrictive firewalls imposed by some >> WiFi hotspots. >> >> However, I still want to be able to serve regular https on the same >> server. Thus the idea of adding some iptables rule on the server that >> identify tinc packets and locally redirect those to the regular tinc >> port (while everything else reaches the webserver as usual). >> >> So I think as long as my rule is specific enough to distinguish tinc and >> TLS, I should be good. > > In that case, you can just match the "0 " at the start of the connection, you > don't have to look further.
Hmm. It seems it's a bit more complicated than that. Unless I'm mistaken, a tinc client waits for the tinc server to send his greeting before it sends his own -- but TLS does the opposite. So unless I forward every connection on :443 to tinc by default, I cannot do matching on the first packet. But trying to let tinc handle every connection would result in TLS error in the browser... > Instead of using iptables, you could also have a > look at sslh: > > http://www.rutschle.net/tech/sslh.shtml I'll take a look, thanks. Best, -Nikolaus -- »Time flies like an arrow, fruit flies like a Banana.« PGP fingerprint: 5B93 61F8 4EA2 E279 ABF6 02CF A9AD B7F8 AE4E 425C _______________________________________________ tinc mailing list [email protected] http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
