<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>You asked for the easier way to to achieve.</p>
<p>To me , easy means you take care of a little, and the rest
happens "automagically".</p>
<p><br>
</p>
<p>To make an example:<br>
</p>
<p><br>
</p>
<p>I have a network made of</p>
<p>{raspi, odroid XU, personal computer} >> {GW raspi exposed
to the internet} >> router+DDNS >> {amazon ec
instance, my laptop}<br>
</p>
<br>
The home router points port 443 to this GW raspberry and does DDNS,
plus translates port 80 to the other raspi.
<p>Amazon instance and the laptop , from the internet , are
connecting via the exposed port.</p>
<p><br>
</p>
<p>Now, If I followed an approach with routing, <i>this would have
been a nightmare</i>, because the amazon instance would have
changed</p>
<p>ip , and the laptop is a roadrunner, so I should have check the
IP everytime, before of putting a new static route.<br>
</p>
<p><br>
</p>
<p>Setting everything as a switch and using tap device, I don't
really need any of that. Until there is ONE path, all machines may
see each others</p>
<p>with no HOP. <br>
</p>
<p>Which is why, to me, when you are having complexity, the switch
mode and tap is much more "easy way to achieve".<br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 05/01/2017 02:50 PM, Bright Zhao
wrote:<br>
</div>
<blockquote
cite="mid:BDABA123-CC48-485A-8AD4-ABBCEC511C15@gmail.com"
type="cite">
<pre wrap="">You’re talking about Layer 2 bridging by Tinc? The use case here is layer 3 routing, but anyway, thanks for your feedback.
</pre>
<blockquote type="cite">
<pre wrap="">On 1 May 2017, at 8:09 PM, LowEel <a class="moz-txt-link-rfc2396E" href="mailto:loweel@gmx.de"><loweel@gmx.de></a> wrote:
I cannot understand why you say the configuration for B will be tricky.
If you select the switch mode, and some machine can initiate a
connection to some other machine, until
there is a path, the whole net will behave as all the tap device were
connected to a single switch.
Is not a vpn in the strict ipsec meaning, you should see it more like an
encrypted VLAN.
If so, the /etc/tinc/vpn1/hosts/B can have Subnet =X/32; but the /etc/tinc/vpn2/hosts/B can exclude Subnet =X/32 since it’s the client side for C.
Let me know if there’s any other simple way to achieve this.
_______________________________________________
</pre>
</blockquote>
</blockquote>
<br>
</body>
</html>