Have you considered moving from tinc to Wireguard?

mavidser · on Oct 13, 2019

Yes, I've been meaning to give it a go for a while now. Couldn't use it initially because of (then) lack of availability on BSD.

masterfooo · on Oct 13, 2019

I use both, and one thing I found that is sucky about WG is that it does not work well with the Windows firewall. I need to give full permission to an app to be able to access ip addresses routed by WG. Tinc does not have this problem.

LinuxBender · on Oct 15, 2019

WG also doesn't do dynamic mesh routing. With tinc, I can have a network path down, and my mesh will find it's way around it. Tinc is slower than WG, but I will take that hit for the benefit of availability. (my preference anyway)

One thing I noticed with tinc is that it does not take advantage of sysctl network tuning. I had to increase the network buffers for that dynamic routing to not make as much of a noticeable slowdown.

    Cipher = aes-128-cbc
    ClampMSS = yes
    UDPRcvBuf = 81920000
    UDPSndBuf = 81920000
    Compression = 0