What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A basic Tinc VPN on an Ubuntu or Debian VPS consists of a named network, one uniquely named node per device, a host file containing each node’s public identity and reachable address, and a private key that never leaves its node. This guide builds a routed VPN between a VPS and a second device, using the private range 10.50.0.0/24, node addresses 10.50.0.1 and 10.50.0.2, and the default Tinc port 655.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
You will install Tinc from your distribution, initialize the network, create interface scripts, exchange only public host files, open the firewall, start the per-network systemd unit, and verify the connection. The same layout can later advertise a deliberate LAN subnet behind a node, but overlapping subnets and accidentally exposed private keys are the two mistakes to avoid first.
As an Amazon Associate I earn from qualifying purchases.
What Tinc does and how its configuration is organized
Tinc is a mesh-oriented VPN daemon. Every participating device is a named node inside a named network. A node has four practical pieces: daemon settings, a host file, private identity keys, and interface-up/interface-down scripts. Nodes can initiate connections to peers listed with ConnectTo; once connected, Tinc uses the subnet declarations in host files to build routes for the VPN.
For routed IP traffic, router mode is the normal default. You assign an address to the virtual interface on each node and advertise the address or network that node serves. Tinc then carries layer-3 traffic between those advertised destinations rather than making the VPN behave like one shared Ethernet segment.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
The Debian-style directory layout
On Debian-family systems, a network named vpn normally lives at /etc/tinc/vpn/:
| Path | Purpose |
|---|---|
/etc/tinc/vpn/tinc.conf |
Network-level daemon settings, including this node’s name and peers it should contact. |
/etc/tinc/vpn/hosts/ |
One host file for each node whose public identity, reachable address, and advertised subnets are known. |
/etc/tinc/vpn/rsa_key.priv |
Private RSA identity key generated for the node. |
/etc/tinc/vpn/ed25519_key.priv |
Private Ed25519 identity key generated for the node. |
/etc/tinc/vpn/tinc-up |
Executable hook that brings up the virtual interface and assigns its VPN address and routes. |
/etc/tinc/vpn/tinc-down |
Optional executable hook for removing the interface address and routes when the daemon stops. |
The private key files stay on the node that generated them. You exchange host files, not private keys.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Plan the VPN before changing files
Write down the topology, names, addresses, forwarding requirements, and firewall policy first. The example below uses a two-node routed network:
| Item | Example |
|---|---|
| Network name | vpn |
| VPS node name | vps |
| Peer node name | laptop |
| VPN range | 10.50.0.0/24 |
| VPS interface address | 10.50.0.1/24 |
| Peer interface address | 10.50.0.2/24 |
| VPS advertised subnet | 10.50.0.1/32 |
| Peer advertised subnet | 10.50.0.2/32 |
| Transport port | 655 unless you deliberately configure another port |
The interface mask and the advertised subnets serve different purposes. The interface addresses put both nodes on the private VPN network. The Subnet lines tell Tinc which address space is local to a particular node. Use network addresses with CIDR prefixes, and ensure that two nodes do not advertise overlapping ranges.
Requirements
- A Linux VPS running a Debian-family distribution, with root access or an account that can use
sudo. - Permission to install packages and run systemd services.
- TUN/TAP support enabled by the VPS environment.
- A configurable VPS firewall and, where applicable, a cloud security-group rule.
- A second Linux host or other supported Tinc node that can reach the VPS’s public address.
Use a DNS name in the examples only if it resolves to the VPS’s actual public address. The Address value in a host file is the real network address peers use to reach the daemon; it is not the private VPN address.
Install Tinc on the VPS
Install the package supplied by the VPS distribution. On Debian-style systems, package names and service behavior can vary by release, so confirm the command and package documentation for the exact release you run. A typical installation is:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo apt update
sudo apt install tincThe package provides the Tinc daemon and systemd units. You will use the per-network template later rather than starting an unnamed, global configuration by accident.
Initialize the network and the VPS node
Run the initialization command as root or through sudo:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo tinc -n vpn init vpsOn Tinc 1.1, this creates /etc/tinc/vpn/, an initial tinc.conf, hosts/vps, RSA and Ed25519 private keys, corresponding public-key material, and an initial tinc-up script. The node name vps must be unique in this VPN. If your distribution still supplies an older Tinc 1.0 release, the documented equivalent key-generation workflow uses:
sudo tincd -n vpn -KDo not run both workflows unnecessarily. Use the initialization and key-generation method provided by the version installed on the VPS.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Configure the VPS daemon
Edit tinc.conf
Open /etc/tinc/vpn/tinc.conf and set the VPS node name plus at least one peer to which it should initiate a connection:
Name = vps
ConnectTo = laptopName identifies this node and must match the host-file name hosts/vps. A ConnectTo entry names another node; it does not replace that node’s host file. The VPS must have the peer’s public host file locally before it can authenticate and connect.
Edit the VPS host file
Create or edit /etc/tinc/vpn/hosts/vps:
Address = vpn.example.com
Subnet = 10.50.0.1/32Replace vpn.example.com with the VPS’s actual public DNS name or address. The Subnet declaration says that the VPS serves the single VPN address 10.50.0.1. A host file may contain public identity data generated during initialization in addition to these lines; preserve that generated key material. Do not replace it with the private key.
Bring up the virtual interface
Edit /etc/tinc/vpn/tinc-up so Linux creates an active interface with the planned address:
#!/bin/sh
ip link set "$INTERFACE" up
ip addr add 10.50.0.1/24 dev "$INTERFACE"$INTERFACE is supplied by Tinc when the hook runs. Make the hook executable:
sudo chmod a+x /etc/tinc/vpn/tinc-upThe interface needs an address and a route covering the VPN network. For the simple two-node example, the /24 address assignment supplies that connected route. If the VPS will route a separate LAN or another private network, add the appropriate route in the interface script and enable Linux IP forwarding for that topology. Do not advertise a LAN merely because it exists; advertise only a subnet that this node actually serves and that does not overlap another node’s declaration.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Initialize and configure the peer
Perform the same initialization on the second device, using a unique node name. If the peer is also Debian-family Linux and the network is named vpn, run:
sudo tinc -n vpn init laptopSet its /etc/tinc/vpn/tinc.conf to identify the node and point it at the VPS:
Name = laptop
ConnectTo = vpsConfigure /etc/tinc/vpn/hosts/laptop with the peer’s reachable address and its local VPN address:
Address = laptop.example.net
Subnet = 10.50.0.2/32If the laptop is behind changing residential NAT, its public address may not be stable or directly reachable. In that case, the VPS can still be the node that accepts an inbound connection, but the peer’s reachability and firewall behavior must match your network. Tinc’s configuration still requires the host file and keys to be distributed correctly.
Set the peer’s executable tinc-up to use the other address in the same VPN range:
#!/bin/sh
ip link set "$INTERFACE" up
ip addr add 10.50.0.2/24 dev "$INTERFACE"sudo chmod a+x /etc/tinc/vpn/tinc-upExchange host files safely
Copy the public host configuration for each node into the other node’s hosts/ directory:
- Copy the VPS’s
hosts/vpsfile to the peer’s/etc/tinc/vpn/hosts/. - Copy the peer’s
hosts/laptopfile to the VPS’s/etc/tinc/vpn/hosts/.
The resulting filenames must match the node names referenced by Name and ConnectTo. Keep the generated public identity material in those files. Never copy rsa_key.priv or ed25519_key.priv to the other device, into a shared repository, or into a support ticket. A private key belongs only in the network directory of its originating node.
Protect the configuration directory and key files with the ownership and permissions installed by the package. If you copied files as another user, correct ownership before starting the daemon; unsafe permissions can prevent startup or expose credentials.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Choose and open the transport port
Tinc listens on port 655 by default when no different port is configured. Permit the selected transport in both layers that can filter traffic:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- The VPS operating-system firewall must allow the Tinc transport to the daemon.
- The VPS provider’s cloud firewall or security group must allow the same port and protocol selection.
Open only the port and protocols required by your configured policy. If you need a different port, set an explicit Port value in the relevant Tinc configuration and make the firewall rules match it exactly. A mismatch produces the same visible symptom as a missing peer file: the daemon starts, but no usable connection forms.
Do not confuse the transport port with the VPN addresses. Port 655 is where peers reach the daemon over the public network; 10.50.0.1 and 10.50.0.2 are addresses carried inside the VPN.
Start Tinc automatically with systemd
Debian packages provide a global tinc.service and a per-network template unit named [email protected]. For the network named vpn, enable and start the named instance:
sudo systemctl enable --now tinc@vpnenable registers the instance for automatic startup, while --now starts it immediately. Inspect the instance after starting:
sudo systemctl status tinc@vpnOlder distributions can differ in unit behavior. If the template is unavailable or reports an error, list the installed Tinc units and follow the package’s service naming for that release rather than creating a second, conflicting daemon process.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify the VPN in a safe order
Verification is easiest when you separate service startup, interface configuration, peer authentication, and traffic routing.
- Check the unit: run
sudo systemctl status tinc@vpnand confirm that the named instance remains active rather than exiting immediately. - Check the interface: confirm that the Tinc interface exists, is up, and has
10.50.0.1/24on the VPS or10.50.0.2/24on the peer. - Check the route: inspect the node’s routing table and verify that the VPN range is associated with the Tinc interface.
- Check the peer: read the daemon output or logs for a connection to the expected node name.
- Test the VPN address: from the VPS, ping
10.50.0.2; from the peer, ping10.50.0.1. Test an allowed service only after the address-level test succeeds. - Validate the configuration: use the
tinccommand’s configuration checks to find unsafe permissions, missing executable bits, unknown variables, or key problems.
Test over the VPN address, not the VPS’s public address. A successful public-IP ping does not prove that the Tinc interface, host files, or VPN routes are correct.
Troubleshoot the failures that matter most
The service starts, but no peer appears
- Confirm that the peer’s host file is present under the exact network directory and filename expected by
ConnectTo. - Check that the peer’s
Namematches the host-file name and theConnectTovalue on the other node. - Verify the
Addresspoints to a public address or DNS name reachable from the initiating node. - Confirm that the chosen port is allowed by both the VPS firewall and the cloud security group.
- Check that each node retained its own private keys and that the exchanged files contain the corresponding public identity material.
The daemon runs, but the interface has no address
Check that tinc-up begins with a valid interpreter line, uses $INTERFACE, and is executable. Run chmod a+x again if a file transfer removed its execute bit. Confirm that the interface script assigns the address intended for that node rather than reusing the peer’s address.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteThe interface exists, but pings fail
- Inspect both routing tables and verify that each node has a route through the Tinc interface.
- Check the two
Subnetdeclarations. They must use network addresses and prefixes, and they must not overlap accidentally. - Ensure that the test uses the VPN addresses and that host firewalls permit the traffic you are testing.
- Review the daemon logs for an authentication or key error even if systemd reports the service as running.
A routed LAN behind the VPS does not respond
A node-to-node VPN address test does not automatically make a LAN reachable. The node serving that LAN must advertise the correct LAN network in its host file, the interface script must install the corresponding route, and Linux IP forwarding must be enabled where the topology requires it. Return to the planned topology and ensure that no other node advertises an overlapping range.
Subnet and address decisions that prevent later outages
Use a private range that does not overlap with networks your users commonly access. Assign one stable VPN address per node. A /32 host route in the host file is appropriate when a node serves only its own VPN address; a larger CIDR should represent an actual network behind that node.
The official Tinc terminology is deliberately local: a Subnet specifies the address range local to that node’s part of the VPN. Advertising 10.50.0.0/24 from every node would claim the entire VPN range from every location and create ambiguous routing. Advertise the smallest accurate range instead.
| Use case | Interface address example | Host-file subnet example |
|---|---|---|
| VPS serving only itself | 10.50.0.1/24 |
10.50.0.1/32 |
| Peer serving only itself | 10.50.0.2/24 |
10.50.0.2/32 |
| Node serving a deliberate private LAN | One address from the VPN range | The LAN’s network address and prefix, with a matching route and forwarding policy |
Operational and security checklist
- Give every node a unique name within the named network.
- Keep
rsa_key.privanded25519_key.privon their originating node only. - Exchange host files through a controlled channel and verify the destination path and ownership.
- Use executable, minimal interface scripts and make their addresses match the topology plan.
- Open the selected Tinc port in every firewall layer that protects the VPS.
- Use explicit
Portconfiguration when the default 655 does not fit your policy, and update firewall rules at the same time. - Advertise only real local networks with non-overlapping CIDR prefixes.
- Enable forwarding only when the node is intentionally routing traffic for another network.
- Check systemd status and daemon logs after every configuration change.
- Test node-to-node VPN addresses before testing services or routed LANs.
Extending the two-node setup
To add another node, initialize it with a new name in the same network, generate its own keys, create its host file, assign an unused VPN address, and exchange its public host file with the nodes that must reach it. Add a suitable ConnectTo relationship so at least one reachable peer can initiate contact. Every node that needs to authenticate the newcomer must have the newcomer’s host file.
Recommended Free Tools
A larger deployment can use several peer connections rather than forcing every node through one central VPS. The practical trade-off is operational: every additional node creates more host-file distribution, address planning, firewall decisions, and troubleshooting paths. Keep the advertised subnets precise so routing remains deterministic.
What a successful basic deployment looks like
At the end of this procedure, the VPS and peer each have a running tinc@vpn instance, an active Tinc interface, one address from 10.50.0.0/24, and a host file advertising only the address or network that node serves. Each side has the other side’s public host file, neither side has the other’s private keys, and the selected transport port is allowed through the VPS firewall and cloud security group. A ping between 10.50.0.1 and 10.50.0.2 then verifies the core routed VPN before you add services or LAN forwarding.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
