ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/doc/gvpe.conf.5.pod
(Generate patch)

Comparing gvpe/doc/gvpe.conf.5.pod (file contents):
Revision 1.1 by pcg, Fri Jun 11 15:56:13 2004 UTC vs.
Revision 1.16 by pcg, Wed Aug 2 16:58:49 2006 UTC

2 2
3gvpe.conf - configuration file for the GNU VPE daemon 3gvpe.conf - configuration file for the GNU VPE daemon
4 4
5=head1 SYNOPSIS 5=head1 SYNOPSIS
6 6
7 enable-udp = yes
8 udp-port = 407 7 udp-port = 407
9 mtu = 1492 8 mtu = 1492
10 ifname = vpn0 9 ifname = vpn0
11 10
12 node = branch1 11 node = branch1
22=head1 DESCRIPTION 21=head1 DESCRIPTION
23 22
24The gvpe config file consists of a series of lines that contain C<variable 23The gvpe config file consists of a series of lines that contain C<variable
25= value> pairs. Empty lines are ignored. Comments start with a C<#> and 24= value> pairs. Empty lines are ignored. Comments start with a C<#> and
26extend to the end of the line. They can be used on their own lines, or 25extend to the end of the line. They can be used on their own lines, or
27after any directives. Spaces are allowed before or after the C<=> sign or 26after any directives. Whitespace is allowed around the C<=> sign or after
28after values, but not within the variable names or values themselves. 27values, but not within the variable names or values themselves.
29 28
30The only exception to the above is the "on" directive that can prefix any 29The only exception to the above is the "on" directive that can prefix any
31C<name = value> setting and will only "execute" it on the named node, or 30C<name = value> setting and will only "execute" it on the named node, or
32(if the nodename starts with "!") on all nodes except the named one. 31(if the nodename starts with "!") on all nodes except the named one.
33 32
61values on different nodes using C<on>), but will affect the behaviour of 60values on different nodes using C<on>), but will affect the behaviour of
62the gvpe daemon and all connections it creates. 61the gvpe daemon and all connections it creates.
63 62
64=over 4 63=over 4
65 64
66=item loglevel = noise|trace|debug|info|notice|warn|error|critical 65=item dns-forw-host = hostname/ip
67 66
68Set the logging level. Connection established messages are logged at level 67The dns server to forward dns requests to for the DNS tunnel protocol
69C<info>, notable errors are logged with C<error>. Default is C<info>. 68(default: C<127.0.0.1>, changing it is highly recommended).
70 69
71=item node = nickname 70=item dns-forw-port = port-number
72 71
73Not really a config setting but introduces a node section. The nickname is 72The port where the C<dns-forw-host> is to be contacted (default: C<53>,
74used to select the right configuration section and must be passed as an 73which is fine in most cases).
75argument to the gvpe daemon.
76 74
77=item private-key = relative-path-to-key 75=item dns-max-outstanding = integer-number-of-requests
78 76
79Sets the path (relative to the config directory) to the private key 77The maximum number of outstanding DNS transport requests
80(default: C<hostkey>). This is a printf format string so every C<%> must 78(default: C<100>). GVPE will never issue more requests then the given
81be doubled. A single C<%s> is replaced by the hostname, so you could 79limit without receiving replies. In heavily overloaded situations it might
82use paths like C<hostkeys/%s> to fetch the files at the location where 80help to set this to a low number (e.g. C<3> or even C<1>) to limit the
83C<gvpectrl> puts them. 81number of parallel requests.
84 82
85Since only the private key file of the current node is used and the 83The default should be working ok for most links.
86private key file should be kept secret per-host to avoid spoofings, it is 84
87not recommended to use this feature. 85=item dns-overlap-factor = float
86
87The DNS transport uses the minimum request latency (B<min_latency>) seen
88during a connection as it's timing base. This factor (default: C<0.5>,
89must be > 0) is multiplied by B<min_latency> to get the maximum sending
90rate (= minimum send interval), i.e. a factor of C<1> means that a new
91request might be generated every B<min_latency> seconds, which means on
92average there should only ever be one outstanding request. A factor of
93C<0.5> means that GVPE will send requests twice as often as the minimum
94latency measured.
95
96For congested or picky dns forwarders you could use a value nearer to or
97exceeding C<1>.
98
99The default should be working ok for most links.
100
101=item dns-send-interval = send-interval-in-seconds
102
103The minimum send interval (= maximum rate) that the DNS transport will
104use to send new DNS requests. GVPE will not exceed this rate even when
105the latency is very low. The default is C<0.01>, which means GVPE will
106not send more than 100 DNS requests per connection per second. For
107high-bandwidth links you could go lower, e.g. to C<0.001> or so. For
108congested or rate-limited links, you might want to go higher, say C<0.1>,
109C<0.2> or even higher.
110
111The default should be working ok for most links.
112
113=item dns-timeout-factor = float
114
115Factor to multiply the C<min_latency> (see C<dns-overlap-factor>) by to
116get request timeouts. The default of C<8> means that the DNS transport
117will resend the request when no reply has been received for longer than
118eight times the minimum (= expected) latency, assuming the request or
119reply has been lost.
120
121For congested links a higher value might be necessary (e.g. C<30>). If the
122link is very stable lower values (e.g. C<2>) might work nicely. Values
123near or below C<1> makes no sense whatsoever.
124
125The default should be working ok for most links.
126
127=item if-up = relative-or-absolute-path
128
129Sets the path of a script that should be called immediately after the
130network interface is initialized (but not neccessarily up). The following
131environment variables are passed to it (the values are just examples).
132
133Variables that have the same value on all nodes:
134
135=over 4
136
137=item CONFBASE=/etc/gvpe
138
139The configuration base directory.
140
141=item IFNAME=vpn0
142
143The network interface to initialize.
144
145=item IFTYPE=native # or tincd
146
147=item IFSUBTYPE=linux # or freebsd, darwin etc..
148
149The interface type (C<native> or C<tincd>) and the subtype (usually the
150OS name in lowercase) that this GVPE was configured for. Can be used to
151select the correct syntax to use for network-related commands.
152
153=item MTU=1436
154
155The MTU to set the interface to. You can use lower values (if done
156consistently on all hosts), but this is usually ineffective.
157
158=item NODES=5
159
160The number of nodes in this GVPE network.
161
162=back
163
164Variables that are node-specific and with values pertaining to the node
165running this GVPE:
166
167=over 4
168
169=item IFUPDATA=string
170
171The value of the configuration directive C<if-up-data>.
172
173=item MAC=fe:fd:80:00:00:01
174
175The MAC address the network interface has to use.
176
177Might be used to initialize interfaces on platforms where GVPE does not
178do this automatically. Please see the C<gvpe.osdep(5)> manpage for
179platform-specific information.
180
181=item NODENAME=branch1
182
183The nickname of the node.
184
185=item NODEID=1
186
187The numerical node ID of the node running this instance of GVPE. The first
188node mentioned in the config file gets ID 1, the second ID 2 and so on.
189
190=back
191
192In addition, all node-specific variables (except C<NODEID>) will be
193available with a postfix of C<_nodeid>, which contains the value for that
194node, e.g. the C<MAC_1> variable contains the MAC address of node #1, while
195the C<NODENAME_22> variable contains the name of node #22.
196
197Here is a simple if-up script:
198
199 #!/bin/sh
200 ip link set $IFNAME up
201 [ $NODENAME = branch1 ] && ip addr add 10.0.0.1 dev $IFNAME
202 [ $NODENAME = branch2 ] && ip addr add 10.1.0.1 dev $IFNAME
203 ip route add 10.0.0.0/8 dev $IFNAME
204
205More complicated examples (using routing to reduce arp traffic) can be
206found in the etc/ subdirectory of the distribution.
207
208=item ifname = devname
209
210Sets the tun interface name to the given name. The default is OS-specific
211and most probably something like C<tun0>.
88 212
89=item ifpersist = yes|true|on | no|false|off 213=item ifpersist = yes|true|on | no|false|off
90 214
91Should the tun/tap device be made persistent, that is, should the device 215Should the tun/tap device be made persistent, that is, should the device
92stay up even when gvpe exits? Some versions of the tunnel device have 216stay up even when gvpe exits? Some versions of the tunnel device have
93problems sending packets when gvpe is restarted in persistent mode, so 217problems sending packets when gvpe is restarted in persistent mode, so
94if the connections can be established but you cannot send packets from 218if the connections can be established but you cannot send packets from
95the local node, try to set this to C<off> and do an ifconfig down on the 219the local node, try to set this to C<off> and do an ifconfig down on the
96device. 220device.
97 221
98=item ifname = devname 222=item ip-proto = numerical-ip-protocol
99 223
100Sets the tun interface name to the given name. The default is OS-specific 224Sets the protocol number to be used for the rawip protocol. This is a
101and most probably something like C<tun0>. 225global option because all hosts must use the same protocol, and since
226there are no port numbers, you cannot easily run more than one gvpe
227instance using the same protocol, nor can you share the protocol with
228other programs.
102 229
103=item rekey = seconds 230The default is 47 (GRE), which has a good chance of tunneling through
231firewalls (but note that the rawip protocol is not GRE compatible). Other
232common choices are 50 (IPSEC, ESP), 51 (IPSEC, AH), 4 (IPIP tunnels) or 98
233(ENCAP, rfc1241)
104 234
105Sets the rekeying interval in seconds (default: C<3600>). Connections are 235=item http-proxy-host = hostname/ip
106reestablished every C<rekey> seconds. 236
237The C<http-proxy-*> family of options are only available if gvpe was
238compiled with the C<--enable-http-proxy> option and enable tunneling of
239tcp connections through a http proxy server.
240
241C<http-proxy-host> and C<http-proxy-port> should specify the hostname and
242port number of the proxy server. See C<http-proxy-loginpw> if your proxy
243requires authentication.
244
245Please note that gvpe will still try to resolve all hostnames in the
246configuration file, so if you are behind a proxy without access to a dns
247server better use numerical IP addresses.
248
249To make best use of this option disable all protocols except tcp in your
250config file and make sure your routers (or all other hosts) are listening
251on a port that the proxy allows (443, https, is a common choice).
252
253If you have a router, connecting to it will suffice. Otherwise tcp must be
254enabled on all hosts.
255
256Example:
257
258 http-proxy-host = proxy.example.com
259 http-proxy-port = 3128 # 8080 is another common choice
260 http-proxy-auth = schmorp:grumbeere
261
262=item http-proxy-port = proxy-tcp-port
263
264The port where your proxy server listens.
265
266=item http-proxy-auth = login:password
267
268The optional login and password used to authenticate to the proxy server,
269seperated by a literal colon (C<:>). Only basic authentication is
270currently supported.
107 271
108=item keepalive = seconds 272=item keepalive = seconds
109 273
110Sets the keepalive probe interval in seconds (default: C<60>). After this 274Sets the keepalive probe interval in seconds (default: C<60>). After this
111many seconds of inactivity the daemon will start to send keepalive probe 275many seconds of inactivity the daemon will start to send keepalive probe
112every 5 seconds until it receives a reply from the other end. If no reply 276every 5 seconds until it receives a reply from the other end. If no reply
113is received within 30 seconds, the peer is considered unreachable and the 277is received within 30 seconds, the peer is considered unreachable and the
114connection is closed. 278connection is closed.
115 279
280=item loglevel = noise|trace|debug|info|notice|warn|error|critical
281
282Set the logging level. Connection established messages are logged at level
283C<info>, notable errors are logged with C<error>. Default is C<info>.
284
116=item mtu = bytes 285=item mtu = bytes
117 286
118Sets the maximum MTU that should be used on outgoing packets (basically 287Sets the maximum MTU that should be used on outgoing packets (basically
119the MTU of the outgoing interface) The daemon will automatically calculate 288the MTU of the outgoing interface) The daemon will automatically calculate
120maximum overhead (e.g. udp header size, encryption blocksize...) and pass 289maximum overhead (e.g. udp header size, encryption blocksize...) and pass
122 291
123Recommended values are 1500 (ethernet), 1492 (pppoe), 1472 (pptp). 292Recommended values are 1500 (ethernet), 1492 (pppoe), 1472 (pptp).
124 293
125This value must be the minimum of the mtu values of all hosts. 294This value must be the minimum of the mtu values of all hosts.
126 295
127=item ip-proto = numerical-ip-protocol 296=item node = nickname
128 297
129Sets the protocol number to be used for the rawip protocol. This is a 298Not really a config setting but introduces a node section. The nickname is
130global option because all hosts must use the same protocol, and since 299used to select the right configuration section and must be passed as an
131there are no port numbers, you cannot easily run more than one gvpe 300argument to the gvpe daemon.
132instance using the same protocol, nor can you share the protocol with
133other programs.
134
135The default is 47 (GRE), which has a good chance of tunneling through
136firewalls (but note that the rawip protocol is not GRE compatible). Other
137common choices are 50 (IPSEC, ESP), 51 (IPSEC, AH), 4 (IPIP tunnels) or 98
138(ENCAP, rfc1241)
139
140=item if-up = relative-or-absolute-path
141
142Sets the path of a script that should be called immediately after the
143network interface is initialized (but not neccessarily up). The following
144environment variables are passed to it (the values are just examples):
145
146=over 4
147
148=item CONFBASE=/etc/gvpe
149
150The configuration base directory.
151
152=item IFNAME=vpn0
153
154The interface to initialize.
155
156=item MTU=1436
157
158The MTU to set the interface to. You can use lower values (if done
159consistently on all hosts), but this is usually ineffective.
160
161=item MAC=fe:fd:80:00:00:01
162
163The MAC address to set the interface to. The script *must* set the
164interface MAC to this value. You will most likely use one of these:
165
166 ip link set $IFNAME address $MAC mtu $MTU up # GNU/Linux
167 ifconfig $IFNAME ether $MAC mtu $MTU up # FreeBSD
168
169Please see the C<gvpe.osdep(5)> manpage for platform-specific information.
170
171=item IFTYPE=native # or tincd
172
173=item IFSUBTYPE=linux # or freebsd, darwin etc..
174
175The interface type (C<native> or C<tincd>) and the subtype (usually the os
176name in lowercase) that this gvpe was configured for. Can be used to select
177the correct syntax to use for network-related commands.
178
179=item NODENAME=branch1
180
181The nickname of the current node, as passed to the gvpe daemon.
182
183=item NODEID=1
184
185The numerical node id of the current node. The first node mentioned in the
186config file gets ID 1, the second ID 2 and so on.
187
188=back
189
190Here is a simple if-up script:
191
192 #!/bin/sh
193 ip link set $IFNAME address $MAC mtu $MTU up
194 [ $NODENAME = branch1 ] && ip addr add 10.0.0.1 dev $IFNAME
195 [ $NODENAME = branch2 ] && ip addr add 10.1.0.1 dev $IFNAME
196 ip route add 10.0.0.0/8 dev $IFNAME
197
198More complicated examples (using routing to reduce arp traffic) can be
199found in the etc/ subdirectory of the distribution.
200 301
201=item node-up = relative-or-absolute-path 302=item node-up = relative-or-absolute-path
202 303
203Sets a command (default: no script) that should be called whenever a 304Sets a command (default: no script) that should be called whenever a
204connection is established (even on rekeying operations). In addition 305connection is established (even on rekeying operations). In addition to
205to the variables passed to C<if-up> scripts, the following environment 306all the variables passed to C<if-up> scripts, the following environment
206variables will be set: 307variables will be set:
207 308
208=over 4 309=over 4
209 310
210=item DESTNODE=branch2 311=item DESTNODE=branch2
243 344
244=item node-down = relative-or-absolute-path 345=item node-down = relative-or-absolute-path
245 346
246Same as C<node-up>, but gets called whenever a connection is lost. 347Same as C<node-up>, but gets called whenever a connection is lost.
247 348
248=item http-proxy-host = hostname/ip
249
250The C<http-proxy-*> family of options are only available if gvpe was
251compiled with the C<--enable-http-proxy> option and enable tunneling of
252tcp connections through a http proxy server.
253
254C<http-proxy-host> and C<http-proxy-port> should specify the hostname and
255port number of the proxy server. See C<http-proxy-loginpw> if your proxy
256requires authentication.
257
258Please note that gvpe will still try to resolve all hostnames in the
259configuration file, so if you are behind a proxy without access to a dns
260server better use numerical IP addresses.
261
262To make best use of this option disable all protocols except tcp in your
263config file and make sure your routers (or all other hosts) are listening
264on a port that the proxy allows (443, https, is a common choice).
265
266If you have a router, connecting to it will suffice. Otherwise tcp must be
267enabled on all hosts.
268
269Example:
270
271 http-proxy-host = proxy.example.com
272 http-proxy-port = 3128 # 8080 is another common choice
273 http-proxy-auth = schmorp:grumbeere
274
275=item http-proxy-port = proxy-tcp-port
276
277The port where your proxy server listens.
278
279=item http-proxy-auth = login:password
280
281The optional login and password used to authenticate to the proxy server,
282seperated by a literal colon (C<:>). Only basic authentication is
283currently supported.
284
285=item pid-file = path 349=item pid-file = path
286 350
287The path to the pid file to check and create (Default: 351The path to the pid file to check and create
352(default: C<LOCALSTATEDIR/run/gvpe.pid>).
353
354=item private-key = relative-path-to-key
355
356Sets the path (relative to the config directory) to the private key
357(default: C<hostkey>). This is a printf format string so every C<%> must
358be doubled. A single C<%s> is replaced by the hostname, so you could
359use paths like C<hostkeys/%s> to fetch the files at the location where
360C<gvpectrl> puts them.
361
362Since only the private key file of the current node is used and the
363private key file should be kept secret per-host to avoid spoofings, it is
364not recommended to use this feature.
365
366=item rekey = seconds
367
368Sets the rekeying interval in seconds (default: C<3600>). Connections are
369reestablished every C<rekey> seconds.
288 370
289=back 371=back
290 372
291=head2 NODE SPECIFIC SETTINGS 373=head2 NODE SPECIFIC SETTINGS
292 374
293The following settings are node-specific, that is, every node can have 375The following settings are node-specific, that is, every node can have
294different settings, even within the same gvpe instance. Settings that are 376different settings, even within the same gvpe instance. Settings that are
295executed before the first node section set the defaults, settings that are 377set before the first node section set the defaults, settings that are
296executed within a node section only apply to the given node. 378set within a node section only apply to the given node.
297 379
298=over 4 380=over 4
299 381
300=item udp-port = port-number 382=item allow-direct = nodename
301 383
302Sets the port number used by the UDP protocol (default: C<655>, not 384Allow direct connections to this node. See C<deny-direct> for more info.
303officially assigned by IANA!).
304 385
305=item tcp-port = port-number
306
307Similar to C<udp-port> (default: C<655>), but sets the TCP port number.
308
309=item enable-rawip = yes|true|on | no|false|off
310
311Enable the RAW IPv4 transport using the C<ip-proto> protocol
312(default: C<no>). This is the best choice, since the overhead per packet
313is only 38 bytes, as opposed to UDP's 58 (or TCP's 60+).
314
315=item enable-udp = yes|true|on | no|false|off 386=item compress = yes|true|on | no|false|off
316 387
317Enable the UDPv4 transport using the C<udp-port> port (default: C<yes>, 388Wether to compress data packets sent to this host (default: C<yes>).
318but this will change!). This is a good general choice since UDP tunnels 389Compression is really cheap even on slow computers and has no size
319well through many firewalls. 390overhead at all, so enabling this is a good idea.
320 391
321NOTE: Please specify C<enable-udp = yes> even though it is the default, as
322some future version will have all protocols disabled by default.
323
324=item enable-tcp = yes|true|on | no|false|off
325
326Enable the TCPv4 transport using the C<tcp-port> port
327(default: C<no>). Support for this horribly unsuitable protocol is only
328available when gvpe was compiled using the C<--enable-tcp> option. Never
329use this transport unless you really must, it is horribly ineffiecent and
330resource-intensive compared to the other transports.
331
332=item router-priority = positive-number
333
334Sets the router priority of the given host (default: C<0>, disabled). If
335some host tries to connect to another host without a hostname, it asks
336the router host for it's IP address. The router host is the one with the
337highest priority that is currently reachable. Make sure all clients always
338connect to the router hosts, otherwise conencting to them is impossible.
339
340=item connect = ondemand|never|always|disabled 392=item connect = ondemand | never | always | disabled
341 393
342Sets the connect mode (default: C<always>). It can be C<always> (always 394Sets the connect mode (default: C<always>). It can be C<always> (always
343try to establish and keep a conenction to the given host), C<never> 395try to establish and keep a connection to the given host), C<never>
344(nevr initiate a connection to the given host, but accept connections), 396(never initiate a connection to the given host, but accept connections),
345C<ondemand> (try to establish a connection on the first packet sent, and 397C<ondemand> (try to establish a connection on the first packet sent, and
346take it down after the keepalive interval) or C<disabled> (node is bad, 398take it down after the keepalive interval) or C<disabled> (node is bad,
347don't talk to it). 399don't talk to it).
400
401=item deny-direct = nodename | *
402
403Deny direct connections to the specified node (or all nodes when C<*>
404is given). Only one node can be specified, but you can use multiple
405C<allow-direct> and C<deny-direct> statements. This only makes sense in
406networks with routers, as routers are required for indirect connections.
407
408Sometimes, a node cannot reach some other nodes for reasons of network
409connectivity. For example, a node behind a firewall that only allows
410conenctions to/from a single other node in the network. In this case one
411should specify C<deny-direct = *> and C<allow-direct = othernodename> (the other
412node I<must> be a router for this to work).
413
414The algorithm to check wether a connection may be direct is as follows:
415
4161. Other node mentioned in a C<allow-direct>? If yes, allow the connection.
417
4182. Other node mentioned in a C<deny-direct>? If yes, deny direct connections.
419
4203. Allow the connection.
421
422That is, C<allow-direct> takes precedence over C<deny-direct>.
423
424The check is done in both directions, i.e. both nodes must allow a direct
425connection before one is attempted, so you only need to specify connect
426limitations on one node.
427
428=item dns-domain = domain-suffix
429
430The DNS domain suffix that points to the DNS tunnel server for this node.
431
432The domain must point to a NS record that points to the I<dns-hostname>,
433i.e.
434
435 dns-domainname = tunnel.example.net
436 dns-hostname = tunnel-server.example.net
437
438Corresponds to the following DNS entries in the C<example.net> domain:
439
440 tunnel.example.net. NS tunnel-server.example.net.
441 tunnel-server.example.net. A 13.13.13.13
442
443=item dns-hostname = hostname/ip
444
445The address to bind the DNS tunnel socket to, similar to the C<hostname>,
446but for the DNS tunnel protocol only. Default: C<0.0.0.0>, but that might
447change.
448
449=item dns-port = port-number
450
451The port to bind the DNS tunnel socket to. Must be C<53> on DNS tunnel servers.
452
453=item enable-dns = yes|true|on | no|false|off
454
455See gvpe.protocol(7) for a description of the DNS transport
456protocol. Avoid this protocol if you can.
457
458Enable the DNS tunneling protocol on this node, either as server or as
459client. Support for this transport protocol is only available when gvpe
460was compiled using the C<--enable-dns> option.
461
462=item enable-icmp = yes|true|on | no|false|off
463
464See gvpe.protocol(7) for a description of the ICMP transport protocol.
465
466Enable the ICMP transport using icmp packets of type C<icmp-type> on this
467node.
468
469=item enable-rawip = yes|true|on | no|false|off
470
471See gvpe.protocol(7) for a description of the RAW IP transport protocol.
472
473Enable the RAW IPv4 transport using the C<ip-proto> protocol
474(default: C<no>).
475
476=item enable-tcp = yes|true|on | no|false|off
477
478See gvpe.protocol(7) for a description of the TCP transport protocol.
479
480Enable the TCPv4 transport using the C<tcp-port> port
481(default: C<no>). Support for this transport protocol is only available
482when gvpe was compiled using the C<--enable-tcp> option.
483
484=item enable-udp = yes|true|on | no|false|off
485
486See gvpe.protocol(7) for a description of the UDP transport protocol.
487
488Enable the UDPv4 transport using the C<udp-port> port (default: C<no>,
489unless no other protocol is enabled for a node, in which case this
490protocol is enabled automatically).
491
492NOTE: Please specify C<enable-udp = yes> if you want t use it even though
493it might get switched on automatically, as some future version might
494default to another default protocol.
495
496=item hostname = hostname | ip [can not be defaulted]
497
498Forces the address of this node to be set to the given dns hostname or ip
499address. It will be resolved before each connect request, so dyndns should
500work fine. If this setting is not specified and a router is available,
501then the router will be queried for the address of this node. Otherwise,
502the connection attempt will fail.
503
504=item icmp-type = integer
505
506Sets the type value to be used for outgoing (and incoming) packets sent
507via the ICMP transport.
508
509The default is C<0> (which is C<echo-reply>, also known as
510"ping-replies"). Other useful values include C<8> (C<echo-request>, a.k.a.
511"ping") and C<11> (C<time-exceeded>), but any 8-bit value can be used.
512
513=item if-up-data = value
514
515The value specified using this directive will be passed to the C<if-up>
516script in the environment variable C<IFUPDATA>.
348 517
349=item inherit-tos = yes|true|on | no|false|off 518=item inherit-tos = yes|true|on | no|false|off
350 519
351Wether to inherit the TOS settings of packets sent to the tunnel when 520Wether to inherit the TOS settings of packets sent to the tunnel when
352sending packets to this node (default: C<yes>). If set to C<yes> then 521sending packets to this node (default: C<yes>). If set to C<yes> then
353outgoing tunnel packets will have the same TOS setting as the packets sent 522outgoing tunnel packets will have the same TOS setting as the packets sent
354to the tunnel device, which is usually what you want. 523to the tunnel device, which is usually what you want.
355 524
356=item compress = yes|true|on | no|false|off
357
358Wether to compress data packets sent to this host (default: C<yes>).
359Compression is really cheap even on slow computers and has no size
360overhead at all, so enabling this is a good idea.
361
362=item max-retry = positive-number 525=item max-retry = positive-number
363 526
364The maximum interval in seconds (default: C<28800>, 8 hours) between 527The maximum interval in seconds (default: C<3600>, one hour) between
365retries to establish a connection to this node. When a connection cannot 528retries to establish a connection to this node. When a connection cannot
366be established, gvpe uses exponential backoff capped at this value. It's 529be established, gvpe uses exponential backoff capped at this value. It's
367sometimes useful to set this to a much lower value (e.g. C<120>) on 530sometimes useful to set this to a much lower value (e.g. C<120>) on
368connections to routers that usually are stable but sometimes are down, to 531connections to routers that usually are stable but sometimes are down, to
369assure quick reconnections. 532assure quick reconnections even after longer downtimes.
533
534=item router-priority = 0 | 1 | positive-number>=2
535
536Sets the router priority of the given host (default: C<0>, disabled). If
537some host tries to connect to another host without a hostname, it asks
538the router host for it's IP address. The router host is the one with the
539highest priority larger than C<1> that is currently reachable.
540
541Make sure all hosts always connect (C<connect = always>) to the router
542hosts, otherwise connecting to them might be impossible.
543
544The special value C<1> allows other hosts to route through the router
545host, but they will never route through it by default. The value C<0>
546disables routing. The idea behind this is that some hosts can, if
547required, bump the C<router-priority> setting to higher than C<1> in their
548local config to route through specific hosts. If C<router-priority> is
549C<0>, then routing will be refused, so C<1> serves as a "enable, but do
550not use by default" switch.
551
552=item tcp-port = port-number
553
554Similar to C<udp-port> (default: C<655>), but sets the TCP port number.
555
556=item udp-port = port-number
557
558Sets the port number used by the UDP protocol (default: C<655>, not
559officially assigned by IANA!).
370 560
371=back 561=back
372 562
373=head1 CONFIG DIRECTORY LAYOUT 563=head1 CONFIG DIRECTORY LAYOUT
374 564
375The default (or recommended) directory layout for the config directory is: 565The default (or recommended) directory layout for the config directory is:
376 566
377=over 4 567=over 4
378 568
379=item gvpe.conf 569=item X<gvpe.conf>
380 570
381The config file. 571The config file.
382 572
383=item if-up 573=item X<if-up>
384 574
385The if-up script 575The if-up script
386 576
387=item node-up, node-down 577=item X<node-up>, X<node-down>
388 578
389If used the node up or node-down scripts. 579If used the node up or node-down scripts.
390 580
391=item hostkey 581=item X<hostkey>
392 582
393The private key (taken from C<hostkeys/nodename>) of the current host. 583The private key (taken from C<hostkeys/nodename>) of the current host.
394 584
395=item pubkey/nodename 585=item X<pubkey/nodename>
396 586
397The public keys of the other nodes, one file per node. 587The public keys of the other nodes, one file per node.
398 588
399=back 589=back
400 590
402 592
403gvpe(5), gvpe(8), gvpectrl(8). 593gvpe(5), gvpe(8), gvpectrl(8).
404 594
405=head1 AUTHOR 595=head1 AUTHOR
406 596
407Marc Lehmann <gvpe@plan9.de> 597Marc Lehmann <gvpe@schmorp.de>
408 598

Diff Legend

Removed lines
+ Added lines
< Changed lines
> Changed lines