ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/doc/gvpe.conf.5.pod
(Generate patch)

Comparing gvpe/doc/gvpe.conf.5.pod (file contents):
Revision 1.30 by root, Tue Dec 4 13:23:17 2012 UTC vs.
Revision 1.33 by root, Thu Jul 18 13:35:19 2013 UTC

… …
31values, but not within the variable names or values themselves. 31values, but not within the variable names or values themselves.
32 32
33All settings are applied "in order", that is, later settings of the same 33All settings are applied "in order", that is, later settings of the same
34variable overwrite earlier ones. 34variable overwrite earlier ones.
35 35
36The only exceptions to the above are the "on" and "include" directives: 36The only exceptions to the above are the following directives:
37 37
38=over 4 38=over 4
39
40=item node nodename
41
42Introduces a node section. The nodename is used to select the right
43configuration section and is the same string as is passed as an argument
44to the gvpe daemon.
45
46Multiple C<node> statements with the same node name are supported and will
47be merged together.
48
49=item global
50
51This statement switches back to the global section, which is mainly
52useful if you want to include a second config file, e..g for local
53customisations. To do that, simply include this at the very end of your
54config file:
55
56 global
57 include local.conf
39 58
40=item on nodename ... 59=item on nodename ...
41 60
42=item on !nodename ... 61=item on !nodename ...
43 62
… …
370 389
371Recommended values are 1500 (ethernet), 1492 (pppoe), 1472 (pptp). 390Recommended values are 1500 (ethernet), 1492 (pppoe), 1472 (pptp).
372 391
373This value must be the minimum of the MTU values of all nodes. 392This value must be the minimum of the MTU values of all nodes.
374 393
375=item node = nickname 394=item nfmark = integer
376 395
377Not really a config setting but introduces a node section. The nickname is 396This advanced option, when set to a nonzero value (default: C<0>), tries
378used to select the right configuration section and must be passed as an 397to set the netfilter mark (or fwmark) value on all sockets gvpe uses to
379argument to the gvpe daemon. 398send packets.
399
400This can be used to make gvpe use a different set of routing rules. For
401example, on GNU/Linux, the C<if-up> could set C<nfmark> to 1000 and then
402put all routing rules into table C<99> and then use an ip rule to make
403gvpe traffic avoid that routing table, in effect routing normal traffic
404via gvpe and gvpe traffic via the normal system routing tables:
405
406 ip rule add not fwmark 1000 lookup 99
380 407
381=item node-up = relative-or-absolute-path 408=item node-up = relative-or-absolute-path
382 409
383Sets a command (default: none) that should be called whenever a connection 410Sets a command (default: none) that should be called whenever a connection
384is established (even on rekeying operations). Note that node-up/down 411is established (even on rekeying operations). Note that node-up/down
… …
439Same as C<node-up>, but gets called whenever a connection is lost. 466Same as C<node-up>, but gets called whenever a connection is lost.
440 467
441=item pid-file = path 468=item pid-file = path
442 469
443The path to the pid file to check and create 470The path to the pid file to check and create
444(default: C<LOCALSTATEDIR/run/gvpe.pid>). 471(default: C<LOCALSTATEDIR/run/gvpe.pid>). The first C<%s> is replaced by
472the nodename - any other use of C<%> must be written as C<%%>.
445 473
446=item private-key = relative-path-to-key 474=item private-key = relative-path-to-key
447 475
448Sets the path (relative to the config directory) to the private key 476Sets the path (relative to the config directory) to the private key
449(default: C<hostkey>). This is a printf format string so every C<%> must 477(default: C<hostkey>). This is a printf format string so every C<%> must
… …
455private key file should be kept secret per-node to avoid spoofing, it is 483private key file should be kept secret per-node to avoid spoofing, it is
456not recommended to use this feature. 484not recommended to use this feature.
457 485
458=item rekey = seconds 486=item rekey = seconds
459 487
460Sets the rekeying interval in seconds (default: C<3600>). Connections are 488Sets the rekeying interval in seconds (default: C<3607>). Connections are
461reestablished every C<rekey> seconds, making them use a new encryption 489reestablished every C<rekey> seconds, making them use a new encryption
462key. 490key.
463 491
464=item nfmark = integer 492=item seed-device = path
465 493
466This advanced option, when set to a nonzero value (default: C<0>), tries 494The random device used to initially and regularly seed the random
467to set the netfilter mark (or fwmark) value on all sockets gvpe uses to 495number generator (default: F</dev/urandom>). Randomness is of paramount
468send packets. 496importance to the security of the algorithms used in gvpe.
469 497
470This can be used to make gvpe use a different set of routing rules. For 498On program start and every seed-interval, gvpe will read 64 octets.
471example, on GNU/Linux, the C<if-up> could set C<nfmark> to 1000 and then
472put all routing rules into table C<99> and then use an ip rule to make
473gvpe traffic avoid that routing table, in effect routing normal traffic
474via gvpe and gvpe traffic via the normal system routing tables:
475 499
476 ip rule add not fwmark 1000 lookup 99 500Setting this path to the empty string will disable this functionality
501completely (the underlying crypto library will likely look for entropy
502sources on it's own though, so not all is lost).
503
504=item seed-interval = seconds
505
506The number of seconds between reseeds of the random number generator
507(default: C<3613>). A value of C<0> disables this regular reseeding.
477 508
478=back 509=back
479 510
480=head2 NODE SPECIFIC SETTINGS 511=head2 NODE SPECIFIC SETTINGS
481 512
… …
712 743
713If used the node up or node-down scripts. 744If used the node up or node-down scripts.
714 745
715=item hostkey 746=item hostkey
716 747
717The private key (taken from C<hostkeys/nodename>) of the current host. 748The (default path of the) private key of the current host.
718 749
719=item pubkey/nodename 750=item pubkey/nodename
720 751
721The public keys of the other nodes, one file per node. 752The public keys of the other nodes, one file per node.
722 753

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines