<div dir="ltr">Couple thoughts.<div><br></div><div>In my case, I was running tinc in switch mode on a pair of linux hosts. All the hosts within each site's /25 range behaved as peers on a Lan, as far as they were concerned there was no routing involved. So if you want to have a shared subnet across the sites, you'll need to run in switch mode which I didn't see in your configs.</div>
<div> </div><div style>The other way to do it is a routed vpn, which is what Rob described.</div><div><br></div><div style>If you go the routed route, the other thing that comes to mind is windows hosts don't permit routing by default. That's something that's separate from anything like windows firewall. Windows calls it "tcp/ip forwarding" and it's configured in the registry.</div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, May 2, 2013 at 8:18 PM, Rob Townley <span dir="ltr"><<a href="mailto:rob.townley@gmail.com" target="_blank">rob.townley@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>If you are new to tinc, i would start with <a href="http://10.0.0.1/32" target="_blank">10.0.0.1/32</a> and <a href="http://10.0.0.2/32" target="_blank">10.0.0.2/32</a><br>
</div><div>When there are two gateways into the same LAN, two with the same subnet would work, but start simple. Start really simple. <br>
</div><br>Once you have both working with /32, then you might want to try <a href="http://10.0.1.1/24" target="_blank">10.0.1.1/24</a> and <a href="http://10.0.2.2/24" target="_blank">10.0.2.2/24</a> <br><div><div><div><div>
<div><div><br>i wonder how well tinc will parse spaces in folder names. <br>
Maybe it works fine, but i would not do it anymore. <br>One way to get rid of spaces on windows is to use the sysinternals tool junction.exe<br><br>junction.exe C:\APPS32\ C:\Program Files (x86\, <br>junction.exe C:\APPS64\ C:\Program Files\<br>
<br>then C:\APPS32\ works whereever C:\Program Files (x86)\ resides. <br><div class="im">PrivateKeyFile = c:\Program Files (x86)\tinc\vpn\rsa_key.priv<br><br></div>It is better if private keys are in a non world readable folder, C:\Program Files (x86)\ can be read by any one. <br>
<br><br><br></div></div></div></div></div></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, May 2, 2013 at 6:02 PM, Andrew Armstrong <span dir="ltr"><<a href="mailto:phplasma@gmail.com" target="_blank">phplasma@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div bgcolor="#FFFFFF"><div>Thanks Donald. I'm confused as to why my previous 10/8 range would not work in this case?</div>
<div><br></div><div>Surely I'm just asking tinc for a huge address range but only using two addresses, (similar to your example), yet mine does not work.</div>
<div><br>Sent from my iPhone</div><div><div><div><br>On 03/05/2013, at 1:49 AM, Donald Pearson <<a href="mailto:donaldwhpearson@gmail.com" target="_blank">donaldwhpearson@gmail.com</a>> wrote:<br><br></div>
<div></div><blockquote type="cite">
<div><div dir="ltr">As an example, one of the setups I ran was 2 sites, reach with a local /24. Tinc subnets were configured on each side with a /25 inside of the local /24. Any devices that you would wish to participate in the VPN, you'd provision with an IP inside of the /25. Otherwise provision it inside of the /24. The devices themselves would still use a /24 mask but the VPN would only expose half of that range due to it's /25 configuration.<div>
<br></div><div>In that way for any one site, all local devices could communicate with all other local devices, and 1/2 of the IP range of the remote site through the VPN.</div></div><div class="gmail_extra"><br><br>
<div class="gmail_quote">On Thu, May 2, 2013 at 11:04 AM, Guus Sliepen <span dir="ltr"><<a href="mailto:guus@tinc-vpn.org" target="_blank">guus@tinc-vpn.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><div>On Fri, May 03, 2013 at 12:51:34AM +1000, Andrew Armstrong wrote:<br>
<br>
> Thanks Guus, I will try this shortly. Can you elaborate on when an actual<br>
> subnet of (say) <a href="http://10.0.0.0/8" target="_blank">10.0.0.0/8</a> would ever be used (or things other than a /32<br>
> address).<br>
<br>
</div></div>You typically use things other than a /32 when you have a LAN connected to a<br>
node running tinc, and you want to make the whole LAN part of the VPN.<br>
<br>
See for example the configuration described in the manual:<br>
<br>
<a href="http://tinc-vpn.org/documentation/tinc_4.html#Example-configuration" target="_blank">http://tinc-vpn.org/documentation/tinc_4.html#Example-configuration</a><br>
<div><div><br>
--<br>
Met vriendelijke groet / with kind regards,<br>
Guus Sliepen <<a href="mailto:guus@tinc-vpn.org" target="_blank">guus@tinc-vpn.org</a>><br>
</div></div><br>_______________________________________________<br>
tinc mailing list<br>
<a href="mailto:tinc@tinc-vpn.org" target="_blank">tinc@tinc-vpn.org</a><br>
<a href="http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc" target="_blank">http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc</a><br>
<br></blockquote></div><br></div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>tinc mailing list</span><br><span><a href="mailto:tinc@tinc-vpn.org" target="_blank">tinc@tinc-vpn.org</a></span><br>
<span><a href="http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc" target="_blank">http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc</a></span><br>
</div></blockquote></div></div></div>
<br>_______________________________________________<br>
tinc mailing list<br>
<a href="mailto:tinc@tinc-vpn.org" target="_blank">tinc@tinc-vpn.org</a><br>
<a href="http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc" target="_blank">http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc</a><br>
<br></blockquote></div><br></div>
</div></div><br>_______________________________________________<br>
tinc mailing list<br>
<a href="mailto:tinc@tinc-vpn.org">tinc@tinc-vpn.org</a><br>
<a href="http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc" target="_blank">http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc</a><br>
<br></blockquote></div><br></div>