View source for Tinc VPN configuration example WebUI

<p style="color:red">The information on this page is updated in accordance with the [https://wiki.teltonika-networks.com/view/FW_%26_SDK_Downloads'''00.07.11.3'''] firmware version.</p>


==Introduction==

Tinc is a Virtual Private Network (VPN) daemon that uses tunneling and encryption to create a secure private network between hosts on the Internet. Tinc is Free Software and licensed under the GNU General Public License version 2 or later. Because the VPN appears to the IP level network code as a normal network device, there is no need to adapt any existing software. This allows VPN sites to share information with each other over the Internet without exposing any information to others. This article provides an extensive configuration example with details on how to create a tunnel connection between two tinc instances, both of which are configured on Teltonika routers and gateways.

==Configuration overview and prerequisites==

Prerequisites:
*Two Teltonika routers or gateways of any type.
*At least one router must have a Public Static or Public Dynamic IP address
*At least one end device (PC, Laptop, Tablet, Smartphone) to configure the routers and gateways.
*(Optional) A second end device to configure and test remote LAN access
*Matching configuration name instances should be used on VPN configuration instance and remote host configuration.

==Topology==

[[File:Tinc_VPN_Topology_1.png.png|border|class=tlt-border|center|500x500px]]
This Tinc network configuration will connect two different devices with encrypted connection over the tunnel utilizing RSA keys and allowing LAN-to-LAN communication via the encrypted tunnel.
 
===Installing Tinc VPN package on your devices===
----
Open WebUI -> System -> Package Manager, select and install Tinc VPN package on both devices that are going to be using Tinc VPN to communicate.

 
[[File:Tinc_VPN_WebUI_1.png.png|border|class=tlt-border|center|1000x1000px]]
===Generating VPN key pairs using router CLI===
----
Generating certificates requires connecting to the routers' CLI.

Open '''WebUI -> System -> Maintenance -> CLI'''

How to connect to '''[https://wiki.teltonika-networks.com/view/Command_Line_Interfaces CLI]'''

====Generating Server Certificates====
----
Execute this command to generate keys: 

'''tincd --generate-keys'''

Enter the key names:

Please enter a file to save private RSA key to [/etc/tinc/rsa_key.priv]: '''Server.pem'''   

Please enter a file to save public RSA key to [/etc/tinc/rsa_key.pub]: '''pubServer.pem'''   

[[File:Tinc_VPN_WebUI_Cert_1.png|none|border|left|class=tlt-border|700x700px]]

====Generating Client Certificates====
----
Execute this command to generate keys: 

'''tincd --generate-keys'''

Enter the key names:

Please enter a file to save private RSA key to [/etc/tinc/rsa_key.priv]: '''Client.pem'''

Please enter a file to save public RSA key to [/etc/tinc/rsa_key.pub]: '''pubClient.pem'''   

[[File:Tinc_VPN_WebUI_Cert_2.png|none|border|left|class=tlt-border|700x700px]]

====Exporting Certificates From The Router====
----

Certificates should be displayed in the root directory; you can export them by using '''[https://wiki.teltonika-networks.com/view/Upload_%26_Download_Files_from_RutOS WinSCP]'''
 
[[File:Tinc_VPN_WebUI_Cert_3_1.png|none|border|left|class=tlt-border|800x800px]]

==Router Configuration==
===Tinc VPN Server configuration=== 
Open '''WebUI -> Services -> VPN -> Tinc''', enter configuration name and create new instance.
[[File:Tinc_VPN_WebUI_2.png.png|border|class=tlt-border|center| 1000x1000px]]
 

====General Setup configuration====
----
After creating a new Tinc VPN tunnel instance in the new window under General Setup, configure the following:
 
[[File:Tinc_VPN_WebUI_3.png|border|class=tlt-border|center| 1000x1000px]]

#Enable: on
#Enter local tunnel endpoint IP: '''10.0.0.1/24'''
#Enter subnet (Local LAN): '''192.168.1.0/24'''
#Select private key: '''Server.pem'''
#Select public key: '''pubServer.pem'''

====Hosts Configuration====
----
Under the same tab after applying General Setup changes add new Hosts configuration instance
[[File:Tinc_VPN_WebUI_4.png|border|class=tlt-border|center| 1000x1000px]]
 

After creating new Tinc VPN Host instance in the new window under Tinc host net2 configure the following:
 
[[File:Tinc_VPN_WebUI_5.png|border|class=tlt-border|center| 1000x1000px]]
#Enable: '''on'''
#Enter subnet (Remote LAN): '''192.168.10.0/24'''
#Select Public Key: '''pubClient.pem'''

====Session Selection====
----
In the General Setup Tinc VPN configuration window select the host that the server will establish a session with:
 
[[File:Tinc_VPN_WebUI_6.png|border|class=tlt-border|center| 1000x1000px]]
1.	Select Host to Connect to: net1

===Tinc VPN Client configuration===
----
Open '''WebUI -> Services -> VPN -> Tinc''', enter configuration name and create new instance.
 
[[File:Tinc_VPN_WebUI_7.png|border|class=tlt-border|center| 1000x1000px]]
====General Setup configuration====
After creating new Tinc VPN tunnel instance in the new window under General Setup configure the following:
 
[[File:Tinc_VPN_WebUI_8.png|border|class=tlt-border|center| 1000x1000px]]
#Enable: '''on'''
#Enter local tunnel endpoint IP: '''10.0.0.2/24'''
#Enter subnet (Local LAN): '''192.168.10.0/24'''
#Select private key: '''Client.pem'''
#Select public key: '''pubClient.pem'''

====Hosts Configuration====
----
Under the same tab after applying General Setup changes add new Hosts configuration instance
 
[[File:Tinc_VPN_WebUI_9.png|border|class=tlt-border|center| 1000x1000px]]
After creating new Tinc VPN Host instance in the new window under Tinc host net1 configure the following:
 
[[File:Tinc_VPN_WebUI_10.png|border|class=tlt-border|center| 1000x1000px]]
#Enable: '''on'''
#Enter Address (Server address): '''84.xx.xx.xx'''
#Enter subnet (Remote LAN): '''192.168.1.0/24'''
#Select Public Key: '''pubServer.pem'''

====Session Selection====
----
In the General Setup Tinc VPN configuration window select the host that client will establish session with:
 
[[File:Tinc_VPN_WebUI_11.png|border|class=tlt-border|center| 1000x1000px]]
1.	Select Host to Connect to: net1

===Testing if VPN session is established successfully===
----
If all the steps previously mentioned were followed accordingly, you should have established a VPN session between the two network devices.


Open '''WebUI -> System -> Maintenance -> CLI'''


Execute the following command in CLI: '''logread | grep tinc'''


This command should display if VPN session is established with the client and the server

====Server Session Testing====
----
[[File:Tinc_VPN_WebUI_12.png|border|class=tlt-border|center| 1000x1000px]]

====Client Session Testing====
----
[[File:Tinc_VPN_WebUI_13.png|border|class=tlt-border|center| 1000x1000px]]

Additionally, you can test VPN connectivity by using the PING command if tunnel addresses and remote network devices are accessible via VPN from the end device.

====End Device 1 Testing====
----

[[File:Tinc_VPN_WebUI_14.png|none|border|left|class=tlt-border|500x500px]]

====End Device 2 Testing====
----

[[File:Tinc_VPN_WebUI_15.png|none|border|left|class=tlt-border| 450x450px]]