Tinc is a rare animal, an actual peer-to-peer VPN that (for *NIX users) is easy to setup, not widely used and so (as far as I am aware) not blocked by anyone, including the GFW (Great Firewall of China).
My main OS is Debian, so this example of a very simple tinc configuration will follow Debian standards in getting two Tinc VPN nodes talking to one another -- typically, one would be your Desktop, and the other would be a server with a public IP address running Squid.
apt-get install tincThis is all that /etc/tinc contains after install:
Tinc can run multiple daemons, each handling a separate Tinc network on a separate subnet. To have each tinc network started automatically, simply add the network name to a list of same in nets.boot
Each tinc network is represented by a separate directory under /etc/tinc/. Each Tinc network also requires a hosts subdirectory where the public keys for other peers in this network are held. For the simplest possible configuration, here are the main decisions to make:
Let's first configure your desktop:
Create the requisite directory structure:
mkdir -p /etc/tinc/myvpn/hostsAnd create the two configuration files for this network:
vi /etc/tinc/myvpn/tinc-upcontaining something like this
modprobe tun10.99.3.1 is the private tinc IP address of the node you are currently configuring. And
ifconfig myvpn 10.99.3.1 netmask 255.255.0.0
vi /etc/tinc/myvpn/tinc.confcontaining this:
Name = mydesk
Device = /dev/net/tun
Port = 19001
ConnectTo = myremote
The Port line is optional, if omitted tinc will listen on the default port 655.
Create your keys for the myvpn network (each separate tinc network/subnet has different keys) for the desktop node by running this on it:
tincd -K -n myvpn(If things are correctly configured you should be able to just accept the defaults.) This is the pair of keys you just created:
/etc/tinc/myvpn/rsa_key.privThe former is your private key, the latter is your public key. Now edit the public key:
vi /etc/tinc/myvpn/hosts/mydeskDO NOT modify the key, but add this config block ABOVE the key:
Subnet = 10.9.3.1/32
Address = x.x.x.x 19001
The top line is the VPN private IP of the node, the bottom line is the real world (public, but not necessarily) IP and port where OTHER peers in this tinc network will find the machine. You will be sharing this file with all other peers in this network, and this config block tells them where to find this node.
IMPORTANT, EASILY OVERLOOKED STEP: fix permissions:
chown -R root: /etc/tinc/tinc-* are scripts that must be executable, otherwise your configuration will subtly break. Now start tinc:
chmod a+rx /etc/tinc/myvpn/tinc-*
systemctl start tinc.service
If all goes well, ifconfig should show a myvpn device with IP 10.9.3.1.
Configure the remote machine:
It is the same as the above desktop config, with these exceptions:
Putting it together:
Once tinc is running on the server, copy the public tinc key of each machine into the tinc hosts directory of the other machine.
Make sure port 19001 is open in the firewall on the myremote end.
Restart tinc on both ends:
systemctl restart tinc.service
and you should now be able to ping the tinc IP of the other machine from both ends.
This delivers to you a secure connection between desktop and a remote machine. If you would like to proxy browser traffic from mydesk through myremote, just install squid on myremote and enable connections from the tinc subnet. In your browser, set the proxy IP to the myremote tinc IP, port 3128 (default squid port), and select a proxy type of socks v5.