ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/doc/gvpe.conf.5.pod
(Generate patch)

Comparing gvpe/doc/gvpe.conf.5.pod (file contents):
Revision 1.30 by root, Tue Dec 4 13:23:17 2012 UTC vs.
Revision 1.32 by root, Tue Jul 16 16:44:36 2013 UTC

… …
370 370
371Recommended values are 1500 (ethernet), 1492 (pppoe), 1472 (pptp). 371Recommended values are 1500 (ethernet), 1492 (pppoe), 1472 (pptp).
372 372
373This value must be the minimum of the MTU values of all nodes. 373This value must be the minimum of the MTU values of all nodes.
374 374
375=item nfmark = integer
376
377This advanced option, when set to a nonzero value (default: C<0>), tries
378to set the netfilter mark (or fwmark) value on all sockets gvpe uses to
379send packets.
380
381This can be used to make gvpe use a different set of routing rules. For
382example, on GNU/Linux, the C<if-up> could set C<nfmark> to 1000 and then
383put all routing rules into table C<99> and then use an ip rule to make
384gvpe traffic avoid that routing table, in effect routing normal traffic
385via gvpe and gvpe traffic via the normal system routing tables:
386
387 ip rule add not fwmark 1000 lookup 99
388
375=item node = nickname 389=item node = nickname
376 390
377Not really a config setting but introduces a node section. The nickname is 391Not really a config setting but introduces a node section. The nickname is
378used to select the right configuration section and must be passed as an 392used to select the right configuration section and must be passed as an
379argument to the gvpe daemon. 393argument to the gvpe daemon.
… …
439Same as C<node-up>, but gets called whenever a connection is lost. 453Same as C<node-up>, but gets called whenever a connection is lost.
440 454
441=item pid-file = path 455=item pid-file = path
442 456
443The path to the pid file to check and create 457The path to the pid file to check and create
444(default: C<LOCALSTATEDIR/run/gvpe.pid>). 458(default: C<LOCALSTATEDIR/run/gvpe.pid>). The first C<%s> is replaced by
459the nodename - any other use of C<%> must be written as C<%%>.
445 460
446=item private-key = relative-path-to-key 461=item private-key = relative-path-to-key
447 462
448Sets the path (relative to the config directory) to the private key 463Sets the path (relative to the config directory) to the private key
449(default: C<hostkey>). This is a printf format string so every C<%> must 464(default: C<hostkey>). This is a printf format string so every C<%> must
… …
455private key file should be kept secret per-node to avoid spoofing, it is 470private key file should be kept secret per-node to avoid spoofing, it is
456not recommended to use this feature. 471not recommended to use this feature.
457 472
458=item rekey = seconds 473=item rekey = seconds
459 474
460Sets the rekeying interval in seconds (default: C<3600>). Connections are 475Sets the rekeying interval in seconds (default: C<3607>). Connections are
461reestablished every C<rekey> seconds, making them use a new encryption 476reestablished every C<rekey> seconds, making them use a new encryption
462key. 477key.
463 478
464=item nfmark = integer 479=item seed-device = path
465 480
466This advanced option, when set to a nonzero value (default: C<0>), tries 481The random device used to initially and regularly seed the random
467to set the netfilter mark (or fwmark) value on all sockets gvpe uses to 482number generator (default: F</dev/urandom>). Randomness is of paramount
468send packets. 483importance to the security of the algorithms used in gvpe.
469 484
470This can be used to make gvpe use a different set of routing rules. For 485On program start and every seed-interval, gvpe will read 64 octets.
471example, on GNU/Linux, the C<if-up> could set C<nfmark> to 1000 and then
472put all routing rules into table C<99> and then use an ip rule to make
473gvpe traffic avoid that routing table, in effect routing normal traffic
474via gvpe and gvpe traffic via the normal system routing tables:
475 486
476 ip rule add not fwmark 1000 lookup 99 487Setting this path to the empty string will disable this functionality
488completely (the underlying crypto library will likely look for entropy
489sources on it's own though, so not all is lost).
490
491=item seed-interval = seconds
492
493The number of seconds between reseeds of the random number generator
494(default: C<3613>). A value of C<0> disables this regular reseeding.
477 495
478=back 496=back
479 497
480=head2 NODE SPECIFIC SETTINGS 498=head2 NODE SPECIFIC SETTINGS
481 499
… …
712 730
713If used the node up or node-down scripts. 731If used the node up or node-down scripts.
714 732
715=item hostkey 733=item hostkey
716 734
717The private key (taken from C<hostkeys/nodename>) of the current host. 735The (default path of the) private key of the current host.
718 736
719=item pubkey/nodename 737=item pubkey/nodename
720 738
721The public keys of the other nodes, one file per node. 739The public keys of the other nodes, one file per node.
722 740

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines