ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/doc/gvpe.conf.5.pod
(Generate patch)

Comparing gvpe/doc/gvpe.conf.5.pod (file contents):
Revision 1.30 by root, Tue Dec 4 13:23:17 2012 UTC vs.
Revision 1.31 by root, Sat Jul 13 04:10:29 2013 UTC

… …
370 370
371Recommended values are 1500 (ethernet), 1492 (pppoe), 1472 (pptp). 371Recommended values are 1500 (ethernet), 1492 (pppoe), 1472 (pptp).
372 372
373This value must be the minimum of the MTU values of all nodes. 373This value must be the minimum of the MTU values of all nodes.
374 374
375=item nfmark = integer
376
377This advanced option, when set to a nonzero value (default: C<0>), tries
378to set the netfilter mark (or fwmark) value on all sockets gvpe uses to
379send packets.
380
381This can be used to make gvpe use a different set of routing rules. For
382example, on GNU/Linux, the C<if-up> could set C<nfmark> to 1000 and then
383put all routing rules into table C<99> and then use an ip rule to make
384gvpe traffic avoid that routing table, in effect routing normal traffic
385via gvpe and gvpe traffic via the normal system routing tables:
386
387 ip rule add not fwmark 1000 lookup 99
388
375=item node = nickname 389=item node = nickname
376 390
377Not really a config setting but introduces a node section. The nickname is 391Not really a config setting but introduces a node section. The nickname is
378used to select the right configuration section and must be passed as an 392used to select the right configuration section and must be passed as an
379argument to the gvpe daemon. 393argument to the gvpe daemon.
… …
455private key file should be kept secret per-node to avoid spoofing, it is 469private key file should be kept secret per-node to avoid spoofing, it is
456not recommended to use this feature. 470not recommended to use this feature.
457 471
458=item rekey = seconds 472=item rekey = seconds
459 473
460Sets the rekeying interval in seconds (default: C<3600>). Connections are 474Sets the rekeying interval in seconds (default: C<3607>). Connections are
461reestablished every C<rekey> seconds, making them use a new encryption 475reestablished every C<rekey> seconds, making them use a new encryption
462key. 476key.
463 477
464=item nfmark = integer 478=item seed-device = path
465 479
466This advanced option, when set to a nonzero value (default: C<0>), tries 480The random device used to initially and regularly seed the random
467to set the netfilter mark (or fwmark) value on all sockets gvpe uses to 481number generator (default: F</dev/urandom>). Randomness is of paramount
468send packets. 482importance to the security of the algorithms used in gvpe.
469 483
470This can be used to make gvpe use a different set of routing rules. For 484On program start and every seed-interval, gvpe will read 64 octets.
471example, on GNU/Linux, the C<if-up> could set C<nfmark> to 1000 and then
472put all routing rules into table C<99> and then use an ip rule to make
473gvpe traffic avoid that routing table, in effect routing normal traffic
474via gvpe and gvpe traffic via the normal system routing tables:
475 485
476 ip rule add not fwmark 1000 lookup 99 486Setting this path to the empty string will disable this functionality
487completely (the underlying crypto library will likely look for entropy
488sources on it's own though, so not all is lost).
489
490=item seed-interval = seconds
491
492The number of seconds between reseeds of the random number generator
493(default: C<3613>). A value of C<0> disables this regular reseeding.
477 494
478=back 495=back
479 496
480=head2 NODE SPECIFIC SETTINGS 497=head2 NODE SPECIFIC SETTINGS
481 498

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines