Unique session keys between each node or shared across entire mesh? about tinc HOT 6 CLOSED

Session keys are always unique between nodes. However: with tinc 1.0.*, data is encrypted in a hop-by-hop fashion. That means that if tinc cannot route packets between two nodes directly, it will route it via one or more intermediate nodes, each of which will decrypt and re-encrypt the traffic. This allows the intermediate nodes to read the data. It might also possible for a malicious node to send false information to other nodes and possibly get traffic rerouted via it. In tinc 1.1, data is encrypted end-to-end. That means that even if data is routed via an intermediate node, those intermediate nodes cannot read the data. But, there are still ways for malicious nodes to interfere. By default, tinc is trusting all peers, and so a peer can announce it has any Subnet it wants, and can thus cause traffic to be redirected to it. The StrictSubnets option can be used to prevent this from happening. However, it is only useful in router mode. In short, if you want to separate nodes so they cannot read each other's traffic, don't put them in the same VPN.

Well, it already works for switch and hub modes. And you can have MAC address Subnets, so if you know which nodes use which MAC addresses, you can indeed use it!

Yes, since 1.0.11 (maybe even earlier). Indeed, you just write Subnet = 01:23:45:67:89:ab.