<div dir="ltr">Thanks Guus. Appreciate the help.<div>What's the purpose of SUBNET msg? Is it even useful in switch mode? </div><div><br></div><div>I tweaked the code to disable SUBNET msg, because I thought they weren't useful when it comes to switch mode. </div><div>Which caused the UDP connection got blocked apparently. If I re-enable SUBNET msg, the udp connection starts </div><div>to work fine. I don't see any forwarding traffic any more.</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Oct 12, 2017 at 6:00 AM, <span dir="ltr"><<a href="mailto:tinc-request@tinc-vpn.org" target="_blank">tinc-request@tinc-vpn.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Send tinc mailing list submissions to<br>
<a href="mailto:tinc@tinc-vpn.org">tinc@tinc-vpn.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc" rel="noreferrer" target="_blank">https://www.tinc-vpn.org/cgi-<wbr>bin/mailman/listinfo/tinc</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:tinc-request@tinc-vpn.org">tinc-request@tinc-vpn.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:tinc-owner@tinc-vpn.org">tinc-owner@tinc-vpn.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of tinc digest..."<br>
<br>Today's Topics:<br>
<br>
1. Re: UDP connections on tinc (Guus Sliepen)<br>
<br><br>---------- Forwarded message ----------<br>From: Guus Sliepen <<a href="mailto:guus@tinc-vpn.org">guus@tinc-vpn.org</a>><br>To: <a href="mailto:tinc@tinc-vpn.org">tinc@tinc-vpn.org</a><br>Cc: <br>Bcc: <br>Date: Wed, 11 Oct 2017 19:20:06 +0200<br>Subject: Re: UDP connections on tinc<br>On Tue, Oct 10, 2017 at 10:48:22AM -0400, Heng Wang wrote:<br>
<br>
> We are using tinc 1.0.24 with switch mode. Some questions regarding to the<br>
> UDP connections on tinc.<br>
><br>
> As far as I understand tinc is building meta connections with "ConnectTo",<br>
> and "ADD_EDGE" packet. With the help of EDGE info two nodes who don't have<br>
> direct meta connection are able to communicate through direct UDP<br>
> connection.<br>
<br>
Correct.<br>
<br>
> I understand we can dump the meta connection using USR2 signal. However is<br>
> there a way to know if a direct UDP connection exists between two nodes?<br>
<br>
If you do USR2 you also get a list of nodes. There's quite a lot of<br>
information for each node. Look at the min mtu value, if it is greater<br>
than 0, you have a direct UDP connection to that node. However, UDP<br>
connections are made on-demand, so if you haven't sent anything to that<br>
node yet, it will likely still be 0.<br>
<br>
> UDP connection will fall back to the meta connection(with next-hop..) if<br>
> the direct UDP fails, but what are the possible reasons for its failure?<br>
<br>
It could be a NAT device that doesn't allow UDP hole punching, or a<br>
firewall that blocks tinc's UDP packets. These problems might exist at<br>
either peer, or somewhere inbetween.<br>
<br>
> Currently we have a connection like below:<br>
><br>
> A-->H<br>
> G-->H<br>
> D-->A<br>
> E-->A<br>
> F-->A<br>
> If we try to send packets directly from G to D, seems the direct UDP<br>
> connection always fails and it is going to path G-->H-->A-->D, however<br>
> somehow it got broadcasted during the process, because I can see that<br>
> message on E and F. Does this even make sense?<br>
<br>
Yes, if it gets broadcast in switch mode, that means that tinc didn't<br>
know which node had the destination address. Just like a real physical<br>
Ethernet switch, if you send packets to a MAC address that it doesn't<br>
know, it will broadcast it on all ports. So it could be that you are<br>
sending a packet to the wrong IP address, or that it's the right IP<br>
address but the node that should have that IP address is misconfigured<br>
somehow, or it could be that that node is offline.<br>
<br>
--<br>
Met vriendelijke groet / with kind regards,<br>
Guus Sliepen <<a href="mailto:guus@tinc-vpn.org">guus@tinc-vpn.org</a>><br>
<br>______________________________<wbr>_________________<br>
tinc mailing list<br>
<a href="mailto:tinc@tinc-vpn.org">tinc@tinc-vpn.org</a><br>
<a href="https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc" rel="noreferrer" target="_blank">https://www.tinc-vpn.org/cgi-<wbr>bin/mailman/listinfo/tinc</a><br>
<br></blockquote></div><br></div>