tinc setup for remote support

[Pablo Piaggio]

Hint: if you don't feel familiar enough with the concepts and config file names, start here: tinc basic setup (https://groups.google.com/forum/#!topic/homefrontrouter/ayeyqauN1ao)


Network layout before tinc

Client (my house):
Banana PI R1 set up as a home router. Serving 10.20.30.0/24
Software:

• Bananian 15.08
• DNSmasq as DHCP server, and DNS
• tinc VPN

Target machine: Laptop connected over wired to the BPI-R1.
Software:

• Ubuntu Trusty 14.04
• ssh server (for the purpose of using a service to receive connections from tech support)

Server (in the 'cloud'):

• VPS running Debian jessie 8.2
• tinc VPN. Public IP: 1.2.3.4 (not really).

Support technician (my brother's house):

• Ubuntu Precise 12.04
• tinc VPN.
• ssh client (for the purpose of using a client that initiates a remote connection)

VPN Design

VPN name: supvpn

Server:

• VPN name: hfserver
• VPN address: 10.0.0.1
• Server will initiate VPN and wait for connections.

Client:

• VPN name: hfrouter
• VPN address: 10.0.0.100
• Client will connect to the server.

Support technician:

• VPN name: hftechsup
• VPN address: 10.0.0.5
• In order to gain access to the client, it will join the VPN by connecting to the server.

Client setup

Create VPN directories:

$ sudo mkdir -p /etc/tinc/supvpn/hosts

Create the main configuration file as follows:

$ sudo vi /etc/tinc/supvpn/tinc.conf

tinc.conf:

Name = hfrouter
AddressFamily = ipv4
Interface = tun0
ConnectTo = hfserver

Create the host config file:

$ sudo vi /etc/tinc/supvpn/hosts/hfrouter

hfrouter:

Subnet = 10.0.0.100/32
Subnet = 10.20.30.0/24

The first subnet (10.0.0.100/32) defines the internal VPN address. The second (10.20.30.0/24) is exposing the LAN to the VPN. This declaration will allow tinc to route traffic to the LAN trough this node (hfrouter).

Create the keys:

$ sudo tincd -n supvpn -K4096

Create the up and down scripts:

$ sudo touch /etc/tinc/supvpn/tinc-up
$ sudo touch /etc/tinc/supvpn/tinc-down
$ sudo chmod a+x /etc/tinc/supvpn/tinc-*
$ sudo vi /etc/tinc/supvpn/tinc-up

tinc-up:

#!/bin/sh
/sbin/ip link set $INTERFACE up
/sbin/ip addr add 10.0.0.100/24 dev $INTERFACE

Then:

$ sudo vi /etc/tinc/supvpn/tinc-down

tinc-down:

#!/bin/sh

/sbin/ip addr delete 10.0.0.3/24 dev $INTERFACE
/sbin/ip link set $INTERFACE down

(note the use of the command "ip" instead of the good ol' "ifconfig" and "route". How modern, isn't it?)



Server setup

Create VPN directories:

$ sudo mkdir -p /etc/tinc/supvpn/hosts

Create the main configuration file as follows:

$ sudo vi /etc/tinc/supvpn/tinc.conf

tinc.conf:

Name = hfserver
AddressFamily = ipv4
Interface = tun0

Create the host config file:

$ sudo vi /etc/tinc/supvpn/hosts/hfserver

hfserver:

Address = 1.2.3.4
Subnet = 10.0.0.1/32

Create the keys:

$ sudo tincd -n supvpn -K4096

Create the up and down scripts:

$ sudo touch /etc/tinc/supvpn/tinc-up
$ sudo touch /etc/tinc/supvpn/tinc-down
$ sudo chmod a+x /etc/tinc/supvpn/tinc-*
$ sudo vi /etc/tinc/supvpn/tinc-up

tinc-up:

#!/bin/sh

/sbin/ip link set $INTERFACE up
/sbin/ip addr add 10.0.0.1/24 dev $INTERFACE

/sbin/ip route add 10.20.30.0/24 dev $INTERFACE    # client LAN

Then:

$ sudo vi /etc/tinc/supvpn/tinc-down

tinc-down:

#!/bin/sh
/sbin/ip route delete 10.20.30.0/24 dev $INTERFACE    # client LAN

/sbin/ip addr delete 10.0.0.1/24 dev $INTERFACE
/sbin/ip link set $INTERFACE down

Technician machine setup

Create VPN directories:

$ sudo mkdir -p /etc/tinc/supvpn/hosts

Create the main configuration file as follows:

$ sudo vi /etc/tinc/supvpn/tinc.conf

tinc.conf:

Name = hftechsup
AddressFamily = ipv4
Interface = tun0
ConnectTo = hfserver

Create the host config file:

$ sudo vi /etc/tinc/supvpn/hosts/hftechsup

hftechsup:

Subnet = 10.0.0.5/32

Create the keys:

$ sudo tincd -n supvpn -K4096

Create the up and down scripts:

$ sudo touch /etc/tinc/supvpn/tinc-up
$ sudo touch /etc/tinc/supvpn/tinc-down
$ sudo chmod a+x /etc/tinc/supvpn/tinc-*
$ sudo vi /etc/tinc/supvpn/tinc-up

tinc-up:

#!/bin/sh

/sbin/ip link set $INTERFACE up
/sbin/ip addr add 10.0.0.5/24 dev $INTERFACE

/sbin/ip route add 10.20.30.0/24 dev $INTERFACE    # client LAN

Then:

$ sudo vi /etc/tinc/supvpn/tinc-down

tinc-down:

#!/bin/sh
/sbin/ip route delete 10.20.30.0/24 dev $INTERFACE    # client LAN

/sbin/ip addr delete 10.0.0.5/24 dev $INTERFACE
/sbin/ip link set $INTERFACE down

Final step: exchange host files so that all nodes have all hosts files. See 'tinc basic setup'



How it works

After restarting the tinc service on each machine (server first), the technician is able to:

• ping and ssh to the router (BPR1).
• ping the laptop (target machine), and more importantly
  
• ssh directly to the laptop without island hopping into the router first *.

* right now to obtain the Laptop's IP the technician would have to either run arp, or check the DNSmasq leases on the router. In the future, I imagine s/he can get a list of all LAN machines from the HomeFrontRouter service (web GUI?)