0x8
0x8

Tinc异地组网使用实例

tinc是一个组建虚拟专用网络（VPN）的工具，通过隧道及加密技术在互联网上点与点之间创建专有网络。tinc 在网络层工作，因此无需对现有软件进行修改和配置。其数据通讯经过加密和压缩，能避免敏感数据和隐私的泄露。

vps主机安装设置tinc

  • debian系统
  • 公网ip 12.23.34.45
  • vpn名称 bbq
  • vpn主机名 tcb
  • vpn ip 10.0.0.11

安装tinc

使用apt install tinc -y安装tinc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

➜  ~ apt install tinc -y
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
  liblzo2-2
The following NEW packages will be installed:
  liblzo2-2 tinc
0 upgraded, 2 newly installed, 0 to remove and 6 not upgraded.
Need to get 261 kB of archives.
After this operation, 831 kB of additional disk space will be used.
Get:1 http://deb.debian.org/debian bookworm/main amd64 liblzo2-2 amd64 2.10-2 [56.9 kB]
Get:2 http://deb.debian.org/debian bookworm/main amd64 tinc amd64 1.0.36-2+b2 [204 kB]
Fetched 261 kB in 0s (2,189 kB/s)
Selecting previously unselected package liblzo2-2:amd64.
(Reading database ... 56790 files and directories currently installed.)
Preparing to unpack .../liblzo2-2_2.10-2_amd64.deb ...
Unpacking liblzo2-2:amd64 (2.10-2) ...
Selecting previously unselected package tinc.
Preparing to unpack .../tinc_1.0.36-2+b2_amd64.deb ...
Unpacking tinc (1.0.36-2+b2) ...
Setting up liblzo2-2:amd64 (2.10-2) ...
Setting up tinc (1.0.36-2+b2) ...
Created symlink /etc/systemd/system/multi-user.target.wants/tinc.service → /lib/systemd/system/tinc.service.
Processing triggers for man-db (2.11.2-2) ...
Processing triggers for libc-bin (2.36-9+deb12u9) ...

新建vpn配置目录

以vpn名称新建配置目录

1
2

mkdir -p /etc/tinc/bbq/
mkdir -p /etc/tinc/bbq/hosts

tinc vpn配置文件

新建配置文件

1

vi /etc/tinc/bbq/tinc.conf

内容如下：

1
2
3
4

# vpn主机名
Name = tcb
# 网卡接口名
Interface = tinc

tinc启动脚本

创建启动脚本vi /etc/tinc/bbq/tinc-up，内容如下：

1
2

#!/bin/sh
ifconfig $INTERFACE 10.0.0.11 netmask 255.255.255.0

创建关闭脚本vi /etc/tinc/bbq/tinc-down，内容如下：

1
2

#!/bin/sh
ifconfig $INTERFACE down

修改脚本权限

1
2

chmod +x /etc/tinc/bbq/tinc-up
chmod +x /etc/tinc/bbq/tinc-down

tinc主机配置文件

创建主机配置文件 vi /etc/tinc/bbq/hosts/tcb，内容如下：

1
2
3
4

## 公网ip
Address = 12.23.34.45
## vpn subnet
Subnet = 10.0.0.11/32

tinc密钥管理

使用tincd生成密钥tincd -n bbq -K 4096

1
2
3
4
5
6

➜tincd -n bbq -K 4096
Generating 4096 bits keys:
.+....+..+....+............+..+..................+...+....+......+..+....+.....+....+.....+..........+..+...+......+.+..+...+..........+.....+........................+..........+.....+.......+...+............+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ p
Done.
Please enter a file to save private RSA key to [/etc/tinc/bbq/rsa_key.priv]:
Please enter a file to save public RSA key to [/etc/tinc/bbq/hosts/tcb]:

tinc服务管理

使用systemd服务区系统

systemd配置启动tinc服务

1
2

systemctl enable tinc@bbq
systemctl start tinc@bbq

检查虚拟网卡和服务状态

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

➜  systemctl status [email protected]
● [email protected] - Tinc net bbq
     Loaded: loaded (/lib/systemd/system/[email protected]; enabled; preset: enabled)
     Active: active (running) since Wed 2025-02-12 22:35:16 PST; 10s ago
       Docs: info:tinc
             man:tinc(8)
             man:tinc.conf(5)
             http://tinc-vpn.org/docs/
   Main PID: 1452 (tincd)
      Tasks: 1 (limit: 815)
     Memory: 860.0K
        CPU: 15ms
     CGroup: /system.slice/system-tinc.slice/[email protected]
             └─1452 /usr/sbin/tincd -n bbq -D

Feb 12 22:35:16 bwg systemd[1]: Started [email protected] - Tinc net bbq.
Feb 12 22:35:16 bwg tincd[1452]: tincd 1.0.36 starting, debug level 0
Feb 12 22:35:16 bwg tincd[1452]: /dev/net/tun is a Linux tun/tap device (tun mode)
Feb 12 22:35:16 bwg tincd[1452]: Ready
➜  ip a
9: tinc: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq state UNKNOWN group default qlen 500
    link/none
    inet 10.0.0.11/24 scope global tinc
       valid_lft forever preferred_lft forever
    inet6 fe80::cf33:a7c9:2d4e:e5b3/64 scope link stable-privacy
       valid_lft forever preferred_lft forever

使用sysvinit服务管理系统

如果你使用的是sysvinit管理服务，那么就需要将bbq添加进/etc/tinc/nets.boot文件

Linux客户端安装设置tinc

  • vpn名称 bbq
  • 系统 Debian
  • vpn主机名 tcd
  • vpn ip 10.0.0.22

安装tinc apt install tinc -y

以vpn名称新建配置目录 mkdir -p /etc/tinc/bbq/hosts

新建vpn配置文件 vi /etc/tinc/bbq/tinc.conf内容如下：

1
2
3
4
5
6

# vpn主机名
Name = tcd
# vpn服务主机名
ConnectTo = tcb
# 网卡接口名
Interface = tinc

创建启动脚本vi /etc/tinc/bbq/tinc-up，内容如下：

1
2

#!/bin/sh
ifconfig $INTERFACE 10.0.0.22 netmask 255.255.255.0

创建关闭脚本vi /etc/tinc/bbq/tinc-down，内容如下：

1
2

#!/bin/sh
ifconfig $INTERFACE down

修改脚本权限

1
2

chmod +x /etc/tinc/bbq/tinc-up
chmod +x /etc/tinc/bbq/tinc-down

创建主机配置文件 vi /etc/tinc/bbq/hosts/tcd，内容如下：

1
2

# vpn subnet
Subnet = 10.0.0.22/32

使用tincd生成密钥tincd -n bbq -K 4096

1
2
3
4
5
6

➜  ~ tincd -n bbq -K 4096
Generating 4096 bits keys:
...+.....+............+.........+.+........+......+....+..+.........+......+....+...........+....+...+......+.....+..............+.....+.........+.............+...........+....+...+..+......+.+...............+...+..+......+...+..........+..+...+.......+............+..+.............+...+...+.....+......+..........+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ p
Done.
Please enter a file to save private RSA key to [/etc/tinc/bbq/rsa_key.priv]:
Please enter a file to save public RSA key to [/etc/tinc/bbq/hosts/tcd]:

将pc配置上传至vps主机同目录

1
2

scp /etc/tinc/bbq/hosts/tcd root@vpsip:/etc/tinc/bbq/hosts/tcd
tcdp                                                        100%  799     3.6KB/s   00:00

将vps配置下载至pc同目录

1
2

➜  ~ scp root@vpsip:/etc/tinc/bbq/hosts/tcb /etc/tinc/bbq/hosts/tcb
tcbwg                                                       100%   59     0.1KB/s   00:00

systemd配置启动tinc服务

1
2
3

systemctl enable tinc@bbq
systemctl start tinc@bbq
systemctl status tinc@bbq

检查虚拟网卡和服务状态

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

➜  hosts systemctl status [email protected]
● [email protected] - Tinc net bbq
     Loaded: loaded (/lib/systemd/system/[email protected]; enabled; preset: enabled)
     Active: active (running) since Thu 2025-02-13 14:54:48 CST; 42s ago
       Docs: info:tinc
             man:tinc(8)
             man:tinc.conf(5)
             http://tinc-vpn.org/docs/
   Main PID: 1651 (tincd)
      Tasks: 1 (limit: 1020)
     Memory: 1.0M
        CPU: 59ms
     CGroup: /system.slice/system-tinc.slice/[email protected]
             └─1651 /usr/sbin/tincd -n bbq -D

2月 13 14:54:48 dietpi systemd[1]: Started [email protected] - Tinc net bbq.
2月 13 14:54:48 dietpi tincd[1651]: tincd 1.0.36 starting, debug level 0
2月 13 14:54:48 dietpi tincd[1651]: /dev/net/tun is a Linux tun/tap device (tun mode)
2月 13 14:54:48 dietpi tincd[1651]: Ready
➜  hosts ip a
5: tinc: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
    link/none
    inet 10.0.0.22/24 scope global tinc
       valid_lft forever preferred_lft forever
    inet6 fe80::37e5:c3f2:d09:131d/64 scope link stable-privacy
       valid_lft forever preferred_lft forever

测试互通效果

ping测试 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

# 本地pc ping服务器
➜  ~ ping -c 5 10.0.0.11
PING 10.0.0.11 (10.0.0.11) 56(84) bytes of data.
64 bytes from 10.0.0.11: icmp_seq=1 ttl=64 time=202 ms
64 bytes from 10.0.0.11: icmp_seq=2 ttl=64 time=212 ms
64 bytes from 10.0.0.11: icmp_seq=3 ttl=64 time=198 ms
64 bytes from 10.0.0.11: icmp_seq=4 ttl=64 time=201 ms
64 bytes from 10.0.0.11: icmp_seq=5 ttl=64 time=203 ms

--- 10.0.0.11 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4009ms
rtt min/avg/max/mdev = 197.765/203.114/211.705/4.642 ms
# 服务器ping本地pc
➜  ~ ping -c 5 10.0.0.22
PING 10.0.0.22 (10.0.0.22) 56(84) bytes of data.
64 bytes from 10.0.0.22: icmp_seq=1 ttl=64 time=200 ms
64 bytes from 10.0.0.22: icmp_seq=2 ttl=64 time=198 ms
64 bytes from 10.0.0.22: icmp_seq=3 ttl=64 time=203 ms
64 bytes from 10.0.0.22: icmp_seq=4 ttl=64 time=217 ms
64 bytes from 10.0.0.22: icmp_seq=5 ttl=64 time=208 ms

--- 10.0.0.22 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4006ms
rtt min/avg/max/mdev = 198.229/205.123/216.801/6.694 ms

iperf3测试 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

➜  ~ iperf3 -s
-----------------------------------------------------------
Server listening on 5201 (test #1)
-----------------------------------------------------------
Accepted connection from 10.0.0.22, port 56980
[  5] local 10.0.0.11 port 5201 connected to 10.0.0.22 port 56986
[ ID] Interval           Transfer     Bitrate
[  5]   0.00-1.00   sec   203 KBytes  1.66 Mbits/sec
[  5]   1.00-2.00   sec   881 KBytes  7.21 Mbits/sec
[  5]   2.00-3.00   sec  1.06 MBytes  8.90 Mbits/sec
[  5]   3.00-4.00   sec  1.35 MBytes  11.3 Mbits/sec
[  5]   4.00-5.00   sec  1.53 MBytes  12.8 Mbits/sec
[  5]   5.00-6.00   sec  1.48 MBytes  12.5 Mbits/sec
[  5]   6.00-7.00   sec  1.73 MBytes  14.5 Mbits/sec
[  5]   7.00-8.00   sec  1.79 MBytes  15.0 Mbits/sec
[  5]   8.00-9.00   sec  1.61 MBytes  13.5 Mbits/sec
[  5]   9.00-10.00  sec   925 KBytes  7.58 Mbits/sec
[  5]  10.00-10.36  sec  1.27 MBytes  29.3 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate
[  5]   0.00-10.36  sec  13.8 MBytes  11.2 Mbits/sec                  receiver
-----------------------------------------------------------
Server listening on 5201 (test #2)
-----------------------------------------------------------
^Ciperf3: interrupt - the server has terminated

➜  ~ iperf3 -c 10.0.0.11
Connecting to host 10.0.0.11, port 5201
[  5] local 10.0.0.22 port 56986 connected to 10.0.0.11 port 5201
[ ID] Interval           Transfer     Bitrate         Retr  Cwnd
[  5]   0.00-1.00   sec   755 KBytes  6.18 Mbits/sec    0    185 KBytes
[  5]   1.00-2.00   sec   763 KBytes  6.25 Mbits/sec    0    229 KBytes
[  5]   2.00-3.00   sec  1.18 MBytes  9.90 Mbits/sec    0    283 KBytes
[  5]   3.00-4.00   sec  1.43 MBytes  12.0 Mbits/sec    0    352 KBytes
[  5]   4.00-5.00   sec  1.80 MBytes  15.1 Mbits/sec    0    427 KBytes
[  5]   5.00-6.00   sec  1.55 MBytes  13.0 Mbits/sec    0    504 KBytes
[  5]   6.00-7.00   sec  1.80 MBytes  15.1 Mbits/sec    0    594 KBytes
[  5]   7.00-8.00   sec  2.11 MBytes  17.7 Mbits/sec    0    683 KBytes
[  5]   8.00-9.00   sec  1.55 MBytes  13.0 Mbits/sec    0    761 KBytes
[  5]   9.00-10.00  sec  1.74 MBytes  14.6 Mbits/sec   23    571 KBytes
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.00  sec  14.6 MBytes  12.3 Mbits/sec   23             sender
[  5]   0.00-10.36  sec  13.8 MBytes  11.2 Mbits/sec                  receiver

iperf Done.

Windows客户端安装设置tinc

  • vpn名称 bbq
  • 系统 Windows10
  • vpn主机名 zb14
  • vpn ip 10.0.0.33

下载安装tinc Windows客户端 https://www.tinc-vpn.org/download/ 国内下载地址 访问密码: 3705

以管理员权限运行PowerShell，运行以下命令添加虚拟网卡

1

PS C:\Program Files (x86)\tinc\tap-win64\addtap.bat

tinc添加虚拟网卡
tinc添加虚拟网卡

创建vpn配置目录

1

PS C:\Program Files (x86)\tinc> mkdir -p bbq\hosts

创建vpn配置文件

1

PS C:\Program Files (x86)\tinc\bbq\touch tinc.conf

tinc.conf内容如下:

1
2
3
4
5
6

#本地命名
Name = zb14
#链接服务器
ConnectTo tcb
#本地网卡名
Interface = 以太网 2

创建启动/关闭脚本文件

1
2
3
4

#创建启动脚本文件
PS C:\Program Files (x86)\tinc\bbq\touch tinc-up.bat
#创建关闭脚本文件
PS C:\Program Files (x86)\tinc\bbq\touch tinc-down.bat

启动脚本tinc-up.bat内容如下

1

netsh interface ip set address "以太网 2" static 10.0.0.33 255.255.255.0

关闭脚本tinc-down.bat内容如下

1

netsh interface ip set address "以太网 2" source=dhcp

创建本地主机文件

1

PS C:\Program Files (x86)\tinc\bbq\hosts\touch zb14

内容如下：

1

Subnet = 10.0.0.33/32

生成密钥

1
2
3
4
5
6
7

PS C:\Program Files (x86)\tinc> .\tincd.exe -n bbq -K 4096
Generating 4096 bits keys:
...................................................................................................................................................................................................................................................................................................................................................++++ p
...........................................++++ q
Done.
Please enter a file to save private RSA key to [C:\Program Files (x86)\tinc/bbq/rsa_key.priv]:
Please enter a file to save public RSA key to [C:\Program Files (x86)\tinc/bbq/hosts/zb14]:

交换密钥

1
2
3

PS C:\Program Files (x86)\tinc\bbq\hosts> scp root@hostip:/etc/tinc/bbq/hosts/tcb .
[email protected]'s password:
tcb                                                                                   100%  849    10.5KB/s   00:00
1
2
3

PS C:\Program Files (x86)\tinc\bbq\hosts> scp zb14 root@hostip:/etc/tinc/bbq/hosts/zb14
[email protected]'s password:
zb14                                         100%  797    19.3KB/s   00:00

安装启动服务

1
2
3

PS C:\Program Files (x86)\tinc> .\tincd.exe -n bbq
tinc.bbq service installed
tinc.bbq service started

互通测试

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

PS C:\Program Files (x86)\tinc> ping 10.0.0.11

正在 Ping 10.0.0.11 具有 32 字节的数据:
来自 10.0.0.11 的回复: 字节=32 时间=36ms TTL=64
来自 10.0.0.11 的回复: 字节=32 时间=32ms TTL=64
来自 10.0.0.11 的回复: 字节=32 时间=52ms TTL=64
来自 10.0.0.11 的回复: 字节=32 时间=34ms TTL=64

10.0.0.11 的 Ping 统计信息:
    数据包: 已发送 = 4，已接收 = 4，丢失 = 0 (0% 丢失)，
往返行程的估计时间(以毫秒为单位):
    最短 = 32ms，最长 = 52ms，平均 = 38ms
PS C:\Program Files (x86)\tinc>

https://tinc-vpn.org/

0%