<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 20/5/19 2:36 am, cat big wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAGB2s7uUnYL1fe+14y6_Fe8W-j2m1Ct3k=yWgDvx=EUUaLxXTQ@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div dir="ltr">Hi tinc users,<br>
<br>
I have two Tinc nodes (A, B) running on trusted computers.
Between A and B there's no direct internet connection. So I
have to set up the third node X to bridge them:
<div><br>
<font face="monospace, monospace"> [ A ] ======= [ X ] </font><span
style="font-family:monospace,monospace">=======</span><span
style="font-family:monospace,monospace"> [</span><font
face="monospace, monospace"> B ]<br>
trusted untrusted trusted<br>
</font><br>
</div>
<div>X is on a cloud service like AWS thus it's on an
untrusted third party. Once it's is compromised the attacker
can access to the entire VPN through it.<br>
</div>
<div><br>
</div>
<div>To prevent such attack, it's possible to deploy firewall
rules to drop all the direct packages from X. However when
the network scales up, it's inefficient to deploy such rules
to all the machines.<br>
</div>
<div><br>
</div>
<div>So my question is: is it possible to set up the tinc node
on X as a bridge-only node? "Bridge-only" means X only
serves as a bridge between the connected nodes. It forwards
the traffic but can't read the traffic or send message to
other nodes in the VPN.</div>
<div><br>
</div>
<div>Any input would be appreciated. Thanks!</div>
</div>
</div>
</blockquote>
<p><br>
</p>
<p>Maybe you can use iptables on X to simply forward traffic
arriving from A on to B (and vice-versa) at the packet level,
rather than running tinc. Effectively X is a proxy with no
knowledge of what it's forwarding and hence no possibility of
injecting traffic.<br>
</p>
<p>I've never tried, but a quick google shows <a
href="http://gsoc-blog.ecklm.com/iptables-redirect-vs.-dnat-vs.-tproxy/">http://gsoc-blog.ecklm.com/iptables-redirect-vs.-dnat-vs.-tproxy/</a>
for example may be helpful.</p>
<p><br>
</p>
<p><br>
</p>
<p>Hamish<br>
</p>
<p><br>
</p>
</body>
</html>