tinc

Tinc sounds pretty awesome, but based on the repo activity and a post from the author[1], it looks to be unmaintained. [1]: https://github.com/gsliepen/tinc/issues/443#issuecomment-184...

Tinc[1] [1]: https://github.com/gsliepen/tinc

Tinc[1]? [1]: https://github.com/gsliepen/tinc

> It's rock-solid. Unfortunately, I cannot confirm. Sharing my experience: I used tinc over multiple years on production servers and it would sometimes create netsplits that did not recover. I also suspect that there's a race or bug in re-keying, which also causes disconnects. On the netsplit issue, it was me posting alone on the relevant issue [1] over multiple years without response. (I don't expect to get any from free-time maintainers, especially on hard-to-reproduce issues, but it's still important to know that such unsolvable hurdles exist.) When I switched to Nebula, it improved this situation. But both Nebula and tinc max out at around 1 Gbit/s on my Hetzner servers, thus not using most of my 10 Gbit/s connectivity. This is because they cap out at 100% of 1 CPU. The Nebula issue about that was closed due to "inactivity" [2]. I als

From a purely networking perspective, there are far better solutions than tailscale. Have a look at full mesh VPNs like: https://github.com/cjdelisle/cjdns https://github.com/yggdrasil-network/yggdrasil-go https://github.com/gsliepen/tinc https://github.com/costela/wesher These build actual mesh networks where every node is equal and can serve as a router for other nodes to resolve difficult network topologies (where some nodes might not be connected to the internet, but do have connections to other nodes with an internet connection — I work with networks like that every day). Sending data through multiple routers is also possible. They also deal with nodes disappearing and change routes accordingly. tailscale (and similar solutions like netbird) still use a bunch of "proxy servers" for that. You can set them up on intermediate nodes, but

I use tinc myself and like it. I like that I only have to update a single node and all the other nodes will accept those peers from that node. I've been playing with wireguard, and having the other nodes discover and communicate with each other directly doesn't happen without you adding the other's public key to both peers. I remember there was talk about switching the backend for Wireguard for security and speed, but it seems to be on the backburner: https://github.com/gsliepen/tinc/issues/179

Don't forget tinc: https://github.com/gsliepen/tinc/tree/1.1 It isn't based on WireGuard, but is a true mesh network, unlike everything you've listed. No central coordination point, every node is equal. Think of it as BitTorrent with a few initial peers you set up through a config file, and it learns of every other peer at runtime (like BitTorrent does through Peer Exchange). It can forward traffic through other nodes (like Tailscale and unlike Nebula) and recomputes the most efficient route as peers become (un)available.

I see some people experimenting and achieving more Mbit/s with their separate async thread host https://github.com/gsliepen/tinc/issues/110

I hope https://github.com/gsliepen/tinc/issues/179 becomes a reality: tinc ui and features on top of wireguard!