Info Tinc automatically sets up a mesh VPN between multiple nodes in a network. Each daemon will communicate directly to every other daemon if possible. I find it very easy to setup, even if you only want to connect only two Nodes. http://www.tinc-vpn.org/ Firmware sample http://files.lancethepants.com/Firmware/ MIPSR2 routers with 8MB+ flash. MIPSR1 routers with 4MB flash. Now available in Shibby firmware starting with release v122. Code https://github.com/lancethepants/Toastman-Tinc https://github.com/lancethepants/Toastman-Tinc-MIPSR1 I've used Tinc for years on my routers (in /jffs) and have finally gotten around to doing an integration with gui. I'm sure there's a few bugs around, so let me know what you find. I've integrated tinc 1.1preX. Version 1.1 fixes some security vulnerabilities in the tinc 1.0 branch. Currently 1.1 is still in pre-releases. Each pre-release is incompatible with other pre-releases, so you must make sure to use the same version everywhere, at least until 1.1 final is released. The gui will display the current version you are running. Tinc can also run on Windows. Tutorial I recommend running Tinc in 'tun' mode. For tun, each node must use a different subnet. These subnets must fit with the 'VPN Netmask' found in the config tab. Say for example the entire VPN will fall in the address range 192.168.0.0/16. (192.168.0.0/255.255.0.0) Tomato by default uses a /24 netmask. You can then add subnets starting from 192.168.0.0/24 - 192.168.255.0/24 and everything in between. To begin we need to generate certificates for every node. In the 'Generate Keys' tab Generate a new set of keys. (Keys shown are only for demonstration.) Starting with tinc1.1pre11, only Ed25519 keys are required. RSA keys are only needed for backwards comparability in order to connect to tinc1.0 nodes Copy Code: Ed25519 Private Key to its location in the 'Config' tab. Also in the 'Config' tab pick a 'Host Name' that will identify this Node. We must create an entry for this node in the Hosts section. This information will be shared with other nodes to create connections. Copy the following Code: Ed25519 Public Key generated earlier to its locations in the 'Hosts' tab. Enter the this node's Host name, and the subnet that this router is using. If this node has a publicly available static IP or hostname (ddns) enter that. For other nodes that you check ConnectTo, this will tell tinc to make a connection to that node. For this node ConnectTo has no influence (you're already connected to yourself). Do the same for other routers, and then you can share the hosts' information to help them connect to each other. It isn't necessary to define every node in every router. If Node A and Node B are connected, and Node A and Node C are connected, then Node B and Node C will learn about each other through Node A. Node B and Node C should then be able to communicate directly to each other. Previously nvram space may have been a large issue when connecting many nodes in a mesh network. Now in newer version of tinc, only Ed25519 keys are required. They are very small, and will allow you to add many nodes since they don't use much nvram space. RSA keys are only needed for backwards compatibility with tinc1.0 nodes. The Status area is active when Tinc is running, and will give you some information about the mesh. 'Edges' and 'Connections' show nodes for which ConnectTo was defined in one or both Nodes. If you don't see a connection between two particular nodes, this doesn't mean they aren't communicating directly to each other. It means that neither had ConnectTo defined for the other, which is fine. The 'info' button will give you more detailed information about a particular node. Sometime it says "Reachability: unknown" if neither of those nodes have attempted communicating to eachother yet. There must be some path of ConnectTo's among the network so all nodes can learn of each other. The 'Scripts' tab allow you to define scripts to run whenever a subnet or host becomes available or unavailable. Refer to the tinc documentation for more information.