Thanks all for your messages; ListenAddress is in fact the thing I am looking for, thank you. To Jookia's point about firewalls, I of course use a firewall to protect ports but in the name of defending in depth, I'd rather not expose a listening port in the first place if it is never to be used.
Many other daemons use 'bind address' terminology in their documentation when talking about listen-only sockets; I think it would be a good idea to add a line to the man page next to 'BindAddress' pointing out 'ListenAddress' so less attentive users (like myself) don't get caught out by it. -- Jonny Tyers On Sun, 18 Nov 2018 at 09:40, Jookia <[email protected]> wrote: > > On Sat, Nov 17, 2018 at 11:20:47PM +0000, Jonny Tyers wrote: > > I want tinc to listen locally on loopback, so that port 655 is not > > exposed on any system interfaces. Can't tinc make outbound connections > > when listening on loopback? I can't see any reason why it should. This > > system will never have other tinc daemons connect to it, it will only > > ever connect to other tinc daemons in order to establish a VPN > > connection. > > > > -- > > Jonny Tyers > > Binding to loopback means you can make any outbound on inbound > connections you'd like- on loopback. Since loopback doesn't route to the > Internet, there's no way to make outbound connections. > > Why are you worried about exposing port 655 on any system interfaces? > You should be using a firewall to make it not exposed externally. > If you're worried about it being exposed internally, loopback has the > same issue as any user or application can connect to it. > > Jookia. > _______________________________________________ > tinc mailing list > [email protected] > https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc _______________________________________________ tinc mailing list [email protected] https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
