External VPN access to LE box behind FW...

    awiouy I begging you now for help! ;) I know you mastered all those things as I've seen your posts from years back about tinc...

    After couple days ofr esting from it I'm back with new ideas :)

    Managed to get my own config like you said using "$DIR_LEGACY" in your tinc.start

    So far so good. I'm connected and vpn ip works (can browse 10.0.0.1

    Need to add my home subnet and if possible have my home ip address as main mobile ip.

    Here is my tinc.conf

    tinc-up

    Bash
    #!/bin/sh
ifconfig $INTERFACE 10.0.0.1 netmask 255.255.255.0

    tinc-down

    Bash
    #!/bin/sh
ip addr del 10.0.0.1 dev $INTERFACE
ip link set $INTERFACE down

    hosts/server

    hosts/mobile

    Code
    Subnet = 10.0.0.2/32
Subnet = 192.168.1.0/24
Ed25519PublicKey = =================================
Port = 11443
    Code
    HTPC:~ # ip route
default via 192.168.1.254 dev eth0 
10.0.0.0/24 dev tun0 scope link  src 10.0.0.1 
172.17.0.0/16 dev docker0 scope link  src 172.17.0.1 
172.18.0.0/16 dev br-cb2fc26669fb scope link  src 172.18.0.1 
192.168.1.0/24 dev eth0 scope link  src 192.168.1.111 
192.168.1.254 dev eth0 scope link

    Edited once, last by Borygo77 (September 22, 2020 at 3:29 AM).

    • Official Post

    I do not understand your configuration. Why do you use two subnets?

    It has been a long time that I have not played with tinc, but I remember that it was complicated.

    Some advice:

    - on LibreELEC, use an interface name that is blacklisted by connman, eg vmnet_foo, to prevent connman from messing with its configuration,

    - by default interfaces on LibreELEC will not forward traffic, so you have to enable ip forwarding (for tinc in router mode) or promiscuitous mode (for tinc in switch mode),

    - use two addresses of your home network for the tinc interfaces (home ip 192.168.1.200 with a route to remote 192.168.0.201, remote ip 192.168.1.201 with a route to 192.168.1.0/24 via 192.168.0.200)

    - I vaguely remember static routes on the router and/or brutils.

    It will therefore probably be easier to configure a device more suitable to your purpose than a LibreELEC mediacenter

    Everything I was reading always said to not make vpn subnets same as host subnet is or you will get in troubles? ;)

    And it actually doesn't work when I change setup to 192.168.1.200 and 192.168.1.0/24 subnet

    Got also tp-link 1043v1 but it'll be too weak to serve any files for me I'm afraid :(

    My htpc old machine with x86 arch is working for me as emby server and is quite doing nothing so why not to give it another life ? ;)

    It was quite loud in living room so I switched to amlogic as my players connected to htpc....


    Think all I miss id some route from network 10.0.0.0/24 to 192.168.1.0/24 but I'm so lost with linux that I got no idea how to add it :(


    This is friend of mine OpenVPN server on strong machine

    Code
    Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         _gateway        0.0.0.0         UG    0      0        0 enp1s0
10.8.0.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 enp1s0

    And this is how mine looks like

    Code
    Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         fritz.box       0.0.0.0         UG    0      0        0 eth0
10.0.0.0        *               255.255.255.0   U     0      0        0 tun0
192.168.1.0     *               255.255.255.0   U     0      0        0 eth0
192.168.1.254   *               255.255.255.255 UH    0      0        0 eth0


    And my proper iptables

    Edited 3 times, last by Borygo77 (September 22, 2020 at 3:31 AM).

    So what would be best? I might try do same Subnet as my home Subnet is for vpn and try bridge eth0 with tun0.

    I don't think I can add static routes in Fritzbox which I got from my network provider. Again. Would like to have my openwrt as main router but this won't serve 1gbps connection ;)

    I'm really thankful that you answering all my question but I'm feeling really dumb speaking about networks, bridges and forwardings.. 😳


    edit; I do actually found this just now 😁

    Configuring a static IP route in the FRITZ!Box | FRITZ!Box 4040 | AVM International

    Might try this first....