Definitely considered that. Running different VPNs and even running different instances of the daemon on different ports. But, as you rightly pointed out: *additional complexity*.
It basically comes down to: what if you have a bad actor who needs
credentials revoked immediately?
We have a way of doing this already, but it can take up to 5 minutes to
cycle through every machine on the network - and some machines, which
are off, have a delay.
It would be nice to just disable the key at some central point and then
authentication / encryption / decryption just *break* for that bad actor.
Michael Munger, dCAP, MCPS, MCNPS, MBSS
*Microsoft Certified Professional*
*Microsoft Certified Small Business Specialist*
*Digium Certified Asterisk Professional*
*High Powered Help, Inc.*
p: 678-905-8569
w: hph.io <https://hph.io> e: [email protected] <mailto:[email protected]>
On 10/02/2018 05:18 PM, Frank Myhr wrote:
> On 02/10/2018 17:02, Michael Munger wrote:
> > there might be another way to skin that cat.
>
> Additional complexity, but you could set up *four* tinc VPNs:
> 1) admin VPN
> 2) site A VPN
> 3) site B VPN
> 4) site C VPN
>
> Each of your client machines would then participate in 2 VPNs: the
> admin VPN and the appropriate site VPN. Each site VPN is NOT a subnet
> of the admin VPN, but its own separate network.
>
> Or maybe I'm missing something...?
>
> Best regards,
> Frank
> _______________________________________________
> tinc mailing list
> [email protected]
> https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
pEpkey.asc
Description: application/pgp-keys
_______________________________________________ tinc mailing list [email protected] https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
