Another interesting alternative to tinc is ZeroTier ( https://www.zerotier.com/ ). I am using it to remotely play Steam games over the Internet and it is surprisingly easy to set up. Probably due to existence of centralized hub.
Also softether is extremely underrated for what it can do.
Usually most VPN tunnels use 1 connection, softether can use 16... So for overseas where you tend to see slow single connection throughout, this can be a game changer. Also its backed by a great University.
Just putting these two out there.
Meshbird project (golang) is also very interesting but not production ready.
SoftEther is an impressive product, but I can't tell if it's ever received a security audit.
Also, I'm a weirdo and run a fair number of services at home with AD authentication. SoftEther has AD support native in the Windows server, which is great, but as far as I can tell there's no way to add two-factor auth.
Like other people answered I am connecting from my Macbook to my Windows gaming PC at home and play games on it. This feature is called 'Steam In-Home Streaming' and it works only over local network (or VPN in my case). 30Mbit is sufficient to remotely play at full HD.
It doesn't seem like exactly what OP is describing, but people buy cheap region-locked licenses to arbitrage different geographic pricing (i.e., it may be cheaper to buy a steam key in eastern Europe than in the US), and then activate the games over a VPN in the original region.
Most big companies will check the PayPal recipient address for country match (yes even for virtual), or an CC avs address match for country, or card BIN lookup. Spotify, Netflix, etc. This is often for compliance, for example VAT collection in EU, or license rights affected by geography. IP Geo is meh, I'd even prioritize your Accept header locale over that.
It is used in the VoIP market. Always behind NAT, yes. We found zerotier much easier to manage, for example it's so quick for support to join/leave networks.
Another use case is our Docker Swarm which runs completely on zerotier, most nodes are on premise but some are in the cloud to make the system publicly accessible.
Every other VPN is different from ZeroTier. I would say a large additional job of ZeroTier is direct connection facilitation between two endpoints rather than route all traffic through a server.
If you have two computers behind NAT, the ZeroTier will help you punch through your NAT and let the computers talk to each other directly. It does it extremely well, and I haven't seen anything like it.
Cool thing is, it can do everything that a normal VPN can. When the other commenters talk about them hosting the 'server'. They're talking about configs, etc. Traffic doesn't usually go through their servers. Just in rare cases where your ISP is really hell bent of preventing you from UDP hole punching.
People always forget about ZeroTier's network flow rules. In a little text file/field, you have a full-on software-defined networking appliance, with filters on any kind of Layer 3-4 information, and a capability model. You could regulate a medium corporate network in about 50 lines, giving people capabilities as required or segmenting areas with tags. And it would work exactly the same whether laptops were inside the building or not. And you can do mad stuff like 'copy all TCP traffic with dport X to some machine running tcpdump'. The whole thing is a dream. I love it.
I personally use it as a replacement for AWS VPN Gateway using a ZT managed route and a couple of VPC route table entries. I detail that setup in my ZeroTier Terraform plugin: https://github.com/cormacrelf/terraform-provider-zerotier
AFAIK you can run your own ZeroTier controller for free. It's just not documented too well and also it's missing the web UI for managing your networks.
I ended up writing a CLI to do it that's relatively full-featured. At some point, I intend to move functionality to a shared library between a CLI and a Web frontend, but for now, the CLI works tremendously well for my use cases:
It's $100/month for licensing our web interface for controller management. You're free to set up your own network controller and write your interface for managing it :)
I know this is old, but there's one thing that is a big advantage for tinc, and it's that it supports TCP P2P
If you're behind a restrictive firewall ZeroTier won't be able to punch through it, and will fall back to forwarding packets (encrypted) through ZeroTier servers, Even if a connection could've been made over TCP to the other client (because his firewall supports UPnP or is port forwarded) which creates a tunnel directly between them.
Note that UDP connections are always better for encapsulating TCP, but P2P TCP is better then TCP through an external server with limited bandwidth.
I'm a ZeroTier user though, and i've only encountered this to be a problem once. It's nice to know it'll always work well though.
