Possible to run a tinc node in bridge-only mode?

[cat big]

Hi tinc users,

I have two Tinc nodes (A, B) running on trusted computers. Between A and B
there's no direct internet connection. So I have to set up the third node X
to bridge them:

 [ A ] ======= [ X ] ======= [ B ]
trusted      untrusted       trusted

X is on a cloud service like AWS thus it's on an untrusted third party.
Once it's is compromised the attacker can access to the entire VPN through
it.

To prevent such attack, it's possible to deploy firewall rules to drop all
the direct packages from X. However when the network scales up, it's
inefficient to deploy such rules to all the machines.

So my question is: is it possible to set up the tinc node on X as a
bridge-only node? "Bridge-only" means X only serves as a bridge between the
connected nodes. It forwards the traffic but can't read the traffic or send
message to other nodes in the VPN.

Any input would be appreciated. Thanks!


h4x3rotab
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.tinc-vpn.org/pipermail/tinc/attachments/20190520/e0455bb2/attachment.html>