| 1 |
=head1 NAME |
| 2 |
|
| 3 |
gvpe.conf - configuration file for the GNU VPE daemon |
| 4 |
|
| 5 |
=head1 SYNOPSIS |
| 6 |
|
| 7 |
udp-port = 407 |
| 8 |
mtu = 1492 |
| 9 |
ifname = vpn0 |
| 10 |
|
| 11 |
node = branch1 |
| 12 |
hostname = 1.2.3.4 |
| 13 |
|
| 14 |
node = branch2 |
| 15 |
hostname = www.example.net |
| 16 |
udp-port = 500 # this host uses a different udp-port |
| 17 |
|
| 18 |
node = branch3 |
| 19 |
connect = ondemand |
| 20 |
|
| 21 |
=head1 DESCRIPTION |
| 22 |
|
| 23 |
The gvpe config file consists of a series of lines that contain C<variable |
| 24 |
= value> pairs. Empty lines are ignored. Comments start with a C<#> and |
| 25 |
extend to the end of the line. They can be used on their own lines, or |
| 26 |
after any directives. Spaces are allowed before or after the C<=> sign or |
| 27 |
after values, but not within the variable names or values themselves. |
| 28 |
|
| 29 |
The only exception to the above is the "on" directive that can prefix any |
| 30 |
C<name = value> setting and will only "execute" it on the named node, or |
| 31 |
(if the nodename starts with "!") on all nodes except the named one. |
| 32 |
|
| 33 |
name = value |
| 34 |
on branch1 loglevel = noise |
| 35 |
on !branch2 connect = ondemand |
| 36 |
|
| 37 |
All settings are executed "in order", that is, later settings of the same |
| 38 |
variable overwrite earlier ones. |
| 39 |
|
| 40 |
=head1 ANATOMY OF A CONFIG FILE |
| 41 |
|
| 42 |
Usually, a config file starts with global settings (like the udp port to |
| 43 |
listen on), followed by node-specific sections that begin with a C<node = |
| 44 |
nickname> line. |
| 45 |
|
| 46 |
Every node that is part of the network must have a section that starts |
| 47 |
with C<node = nickname>. The number and order of the nodes is important |
| 48 |
and must be the same on all hosts. It is not uncommon for node sections to |
| 49 |
be completely empty - if the default values are right. |
| 50 |
|
| 51 |
Node-specific settings can be used at any time. If used before the first |
| 52 |
node section they will set the default values for all following nodes. |
| 53 |
|
| 54 |
=head1 CONFIG VARIABLES |
| 55 |
|
| 56 |
=head2 GLOBAL SETTINGS |
| 57 |
|
| 58 |
Global settings will affect the behaviour of the running gvpe daemon, that |
| 59 |
is, they are in some sense node-specific (config files can set different |
| 60 |
values on different nodes using C<on>), but will affect the behaviour of |
| 61 |
the gvpe daemon and all connections it creates. |
| 62 |
|
| 63 |
=over 4 |
| 64 |
|
| 65 |
=item dns-forw-host = hostname/ip |
| 66 |
|
| 67 |
The dns server to forward dns requests to for the DNS tunnel protocol |
| 68 |
(default: C<127.0.0.1>, changing it is highly recommended). |
| 69 |
|
| 70 |
=item dns-forw-port = port-number |
| 71 |
|
| 72 |
The port where the C<dns-forw-host> is to be contacted (default: C<53>, |
| 73 |
which is fine in most cases). |
| 74 |
|
| 75 |
=item if-up = relative-or-absolute-path |
| 76 |
|
| 77 |
Sets the path of a script that should be called immediately after the |
| 78 |
network interface is initialized (but not neccessarily up). The following |
| 79 |
environment variables are passed to it (the values are just examples): |
| 80 |
|
| 81 |
=over 4 |
| 82 |
|
| 83 |
=item CONFBASE=/etc/gvpe |
| 84 |
|
| 85 |
The configuration base directory. |
| 86 |
|
| 87 |
=item IFNAME=vpn0 |
| 88 |
|
| 89 |
The interface to initialize. |
| 90 |
|
| 91 |
=item MTU=1436 |
| 92 |
|
| 93 |
The MTU to set the interface to. You can use lower values (if done |
| 94 |
consistently on all hosts), but this is usually ineffective. |
| 95 |
|
| 96 |
=item MAC=fe:fd:80:00:00:01 |
| 97 |
|
| 98 |
The MAC address to set the interface to. The script *must* set the |
| 99 |
interface MAC to this value. You will most likely use one of these: |
| 100 |
|
| 101 |
ip link set $IFNAME address $MAC mtu $MTU up # GNU/Linux |
| 102 |
ifconfig $IFNAME ether $MAC mtu $MTU up # FreeBSD |
| 103 |
|
| 104 |
Please see the C<gvpe.osdep(5)> manpage for platform-specific information. |
| 105 |
|
| 106 |
=item IFTYPE=native # or tincd |
| 107 |
|
| 108 |
=item IFSUBTYPE=linux # or freebsd, darwin etc.. |
| 109 |
|
| 110 |
The interface type (C<native> or C<tincd>) and the subtype (usually the os |
| 111 |
name in lowercase) that this gvpe was configured for. Can be used to select |
| 112 |
the correct syntax to use for network-related commands. |
| 113 |
|
| 114 |
=item NODENAME=branch1 |
| 115 |
|
| 116 |
The nickname of the current node, as passed to the gvpe daemon. |
| 117 |
|
| 118 |
=item NODEID=1 |
| 119 |
|
| 120 |
The numerical node id of the current node. The first node mentioned in the |
| 121 |
config file gets ID 1, the second ID 2 and so on. |
| 122 |
|
| 123 |
=back |
| 124 |
|
| 125 |
Here is a simple if-up script: |
| 126 |
|
| 127 |
#!/bin/sh |
| 128 |
ip link set $IFNAME address $MAC mtu $MTU up |
| 129 |
[ $NODENAME = branch1 ] && ip addr add 10.0.0.1 dev $IFNAME |
| 130 |
[ $NODENAME = branch2 ] && ip addr add 10.1.0.1 dev $IFNAME |
| 131 |
ip route add 10.0.0.0/8 dev $IFNAME |
| 132 |
|
| 133 |
More complicated examples (using routing to reduce arp traffic) can be |
| 134 |
found in the etc/ subdirectory of the distribution. |
| 135 |
|
| 136 |
=item ifname = devname |
| 137 |
|
| 138 |
Sets the tun interface name to the given name. The default is OS-specific |
| 139 |
and most probably something like C<tun0>. |
| 140 |
|
| 141 |
=item ifpersist = yes|true|on | no|false|off |
| 142 |
|
| 143 |
Should the tun/tap device be made persistent, that is, should the device |
| 144 |
stay up even when gvpe exits? Some versions of the tunnel device have |
| 145 |
problems sending packets when gvpe is restarted in persistent mode, so |
| 146 |
if the connections can be established but you cannot send packets from |
| 147 |
the local node, try to set this to C<off> and do an ifconfig down on the |
| 148 |
device. |
| 149 |
|
| 150 |
=item ip-proto = numerical-ip-protocol |
| 151 |
|
| 152 |
Sets the protocol number to be used for the rawip protocol. This is a |
| 153 |
global option because all hosts must use the same protocol, and since |
| 154 |
there are no port numbers, you cannot easily run more than one gvpe |
| 155 |
instance using the same protocol, nor can you share the protocol with |
| 156 |
other programs. |
| 157 |
|
| 158 |
The default is 47 (GRE), which has a good chance of tunneling through |
| 159 |
firewalls (but note that the rawip protocol is not GRE compatible). Other |
| 160 |
common choices are 50 (IPSEC, ESP), 51 (IPSEC, AH), 4 (IPIP tunnels) or 98 |
| 161 |
(ENCAP, rfc1241) |
| 162 |
|
| 163 |
=item http-proxy-host = hostname/ip |
| 164 |
|
| 165 |
The C<http-proxy-*> family of options are only available if gvpe was |
| 166 |
compiled with the C<--enable-http-proxy> option and enable tunneling of |
| 167 |
tcp connections through a http proxy server. |
| 168 |
|
| 169 |
C<http-proxy-host> and C<http-proxy-port> should specify the hostname and |
| 170 |
port number of the proxy server. See C<http-proxy-loginpw> if your proxy |
| 171 |
requires authentication. |
| 172 |
|
| 173 |
Please note that gvpe will still try to resolve all hostnames in the |
| 174 |
configuration file, so if you are behind a proxy without access to a dns |
| 175 |
server better use numerical IP addresses. |
| 176 |
|
| 177 |
To make best use of this option disable all protocols except tcp in your |
| 178 |
config file and make sure your routers (or all other hosts) are listening |
| 179 |
on a port that the proxy allows (443, https, is a common choice). |
| 180 |
|
| 181 |
If you have a router, connecting to it will suffice. Otherwise tcp must be |
| 182 |
enabled on all hosts. |
| 183 |
|
| 184 |
Example: |
| 185 |
|
| 186 |
http-proxy-host = proxy.example.com |
| 187 |
http-proxy-port = 3128 # 8080 is another common choice |
| 188 |
http-proxy-auth = schmorp:grumbeere |
| 189 |
|
| 190 |
=item http-proxy-port = proxy-tcp-port |
| 191 |
|
| 192 |
The port where your proxy server listens. |
| 193 |
|
| 194 |
=item http-proxy-auth = login:password |
| 195 |
|
| 196 |
The optional login and password used to authenticate to the proxy server, |
| 197 |
seperated by a literal colon (C<:>). Only basic authentication is |
| 198 |
currently supported. |
| 199 |
|
| 200 |
=item keepalive = seconds |
| 201 |
|
| 202 |
Sets the keepalive probe interval in seconds (default: C<60>). After this |
| 203 |
many seconds of inactivity the daemon will start to send keepalive probe |
| 204 |
every 5 seconds until it receives a reply from the other end. If no reply |
| 205 |
is received within 30 seconds, the peer is considered unreachable and the |
| 206 |
connection is closed. |
| 207 |
|
| 208 |
=item loglevel = noise|trace|debug|info|notice|warn|error|critical |
| 209 |
|
| 210 |
Set the logging level. Connection established messages are logged at level |
| 211 |
C<info>, notable errors are logged with C<error>. Default is C<info>. |
| 212 |
|
| 213 |
=item mtu = bytes |
| 214 |
|
| 215 |
Sets the maximum MTU that should be used on outgoing packets (basically |
| 216 |
the MTU of the outgoing interface) The daemon will automatically calculate |
| 217 |
maximum overhead (e.g. udp header size, encryption blocksize...) and pass |
| 218 |
this information to the C<if-up> script. |
| 219 |
|
| 220 |
Recommended values are 1500 (ethernet), 1492 (pppoe), 1472 (pptp). |
| 221 |
|
| 222 |
This value must be the minimum of the mtu values of all hosts. |
| 223 |
|
| 224 |
=item node = nickname |
| 225 |
|
| 226 |
Not really a config setting but introduces a node section. The nickname is |
| 227 |
used to select the right configuration section and must be passed as an |
| 228 |
argument to the gvpe daemon. |
| 229 |
|
| 230 |
=item node-up = relative-or-absolute-path |
| 231 |
|
| 232 |
Sets a command (default: no script) that should be called whenever a |
| 233 |
connection is established (even on rekeying operations). In addition |
| 234 |
to the variables passed to C<if-up> scripts, the following environment |
| 235 |
variables will be set: |
| 236 |
|
| 237 |
=over 4 |
| 238 |
|
| 239 |
=item DESTNODE=branch2 |
| 240 |
|
| 241 |
The name of the remote node. |
| 242 |
|
| 243 |
=item DESTID=2 |
| 244 |
|
| 245 |
The node id of the remote node. |
| 246 |
|
| 247 |
=item DESTIP=188.13.66.8 |
| 248 |
|
| 249 |
The numerical IP address of the remote host (gvpe accepts connections from |
| 250 |
everywhere, as long as the other host can authenticate itself). |
| 251 |
|
| 252 |
=item DESTPORT=655 # deprecated |
| 253 |
|
| 254 |
The UDP port used by the other side. |
| 255 |
|
| 256 |
=item STATE=UP |
| 257 |
|
| 258 |
Node-up scripts get called with STATE=UP, node-down scripts get called |
| 259 |
with STATE=DOWN. |
| 260 |
|
| 261 |
=back |
| 262 |
|
| 263 |
Here is a nontrivial example that uses nsupdate to update the name => ip |
| 264 |
mapping in some dns zone: |
| 265 |
|
| 266 |
#!/bin/sh |
| 267 |
{ |
| 268 |
echo update delete $DESTNODE.lowttl.example.net. a |
| 269 |
echo update add $DESTNODE.lowttl.example.net. 1 in a $DESTIP |
| 270 |
echo |
| 271 |
} | nsupdate -d -k $CONFBASE:key.example.net. |
| 272 |
|
| 273 |
=item node-down = relative-or-absolute-path |
| 274 |
|
| 275 |
Same as C<node-up>, but gets called whenever a connection is lost. |
| 276 |
|
| 277 |
=item pid-file = path |
| 278 |
|
| 279 |
The path to the pid file to check and create |
| 280 |
(default: C<LOCALSTATEDIR/run/gvpe.pid>). |
| 281 |
|
| 282 |
=item private-key = relative-path-to-key |
| 283 |
|
| 284 |
Sets the path (relative to the config directory) to the private key |
| 285 |
(default: C<hostkey>). This is a printf format string so every C<%> must |
| 286 |
be doubled. A single C<%s> is replaced by the hostname, so you could |
| 287 |
use paths like C<hostkeys/%s> to fetch the files at the location where |
| 288 |
C<gvpectrl> puts them. |
| 289 |
|
| 290 |
Since only the private key file of the current node is used and the |
| 291 |
private key file should be kept secret per-host to avoid spoofings, it is |
| 292 |
not recommended to use this feature. |
| 293 |
|
| 294 |
=item rekey = seconds |
| 295 |
|
| 296 |
Sets the rekeying interval in seconds (default: C<3600>). Connections are |
| 297 |
reestablished every C<rekey> seconds. |
| 298 |
|
| 299 |
=back |
| 300 |
|
| 301 |
=head2 NODE SPECIFIC SETTINGS |
| 302 |
|
| 303 |
The following settings are node-specific, that is, every node can have |
| 304 |
different settings, even within the same gvpe instance. Settings that are |
| 305 |
executed before the first node section set the defaults, settings that are |
| 306 |
executed within a node section only apply to the given node. |
| 307 |
|
| 308 |
=over 4 |
| 309 |
|
| 310 |
=item compress = yes|true|on | no|false|off |
| 311 |
|
| 312 |
Wether to compress data packets sent to this host (default: C<yes>). |
| 313 |
Compression is really cheap even on slow computers and has no size |
| 314 |
overhead at all, so enabling this is a good idea. |
| 315 |
|
| 316 |
=item connect = ondemand | never | always | disabled |
| 317 |
|
| 318 |
Sets the connect mode (default: C<always>). It can be C<always> (always |
| 319 |
try to establish and keep a connection to the given host), C<never> |
| 320 |
(never initiate a connection to the given host, but accept connections), |
| 321 |
C<ondemand> (try to establish a connection on the first packet sent, and |
| 322 |
take it down after the keepalive interval) or C<disabled> (node is bad, |
| 323 |
don't talk to it). |
| 324 |
|
| 325 |
=item dns-domain = domain-suffix |
| 326 |
|
| 327 |
The DNS domain suffix that points to the DNS tunnel server for this node. |
| 328 |
|
| 329 |
The domain must point to a NS record that points to the I<dns-hostname>, |
| 330 |
i.e. |
| 331 |
|
| 332 |
dns-domainname = tunnel.example.net |
| 333 |
dns-hostname = tunnel-server.example.net |
| 334 |
|
| 335 |
Corresponds to the following DNS entries in the C<example.net> domain: |
| 336 |
|
| 337 |
tunnel.example.net. NS tunnel-server.example.net. |
| 338 |
tunnel-server.example.net. A 13.13.13.13 |
| 339 |
|
| 340 |
=item dns-hostname = hostname/ip |
| 341 |
|
| 342 |
The address to bind the DNS tunnel socket to, similar to the C<hostname>, |
| 343 |
but for the DNS tunnel protocol only. Default: C<0.0.0.0>, but that might |
| 344 |
change. |
| 345 |
|
| 346 |
=item dns-port = port-number |
| 347 |
|
| 348 |
The port to bind the DNS tunnel socket to. Must be C<53> on DNS tunnel servers. |
| 349 |
|
| 350 |
=item enable-dns = yes|true|on | no|false|off |
| 351 |
|
| 352 |
See gvpe.protocol(7) for a description of the DNS transport |
| 353 |
protocol. Avoid this protocol if you can. |
| 354 |
|
| 355 |
Enable the DNS tunneling protocol on this node, either as server or as |
| 356 |
client. Support for this transport protocol is only available when gvpe |
| 357 |
was compiled using the C<--enable-dns> option. |
| 358 |
|
| 359 |
=item enable-icmp = yes|true|on | no|false|off |
| 360 |
|
| 361 |
See gvpe.protocol(7) for a description of the ICMP transport protocol. |
| 362 |
|
| 363 |
Enable the ICMP transport using icmp packets of type C<icmp-type> on this |
| 364 |
node. |
| 365 |
|
| 366 |
=item enable-rawip = yes|true|on | no|false|off |
| 367 |
|
| 368 |
See gvpe.protocol(7) for a description of the RAW IP transport protocol. |
| 369 |
|
| 370 |
Enable the RAW IPv4 transport using the C<ip-proto> protocol |
| 371 |
(default: C<no>). |
| 372 |
|
| 373 |
=item enable-tcp = yes|true|on | no|false|off |
| 374 |
|
| 375 |
See gvpe.protocol(7) for a description of the TCP transport protocol. |
| 376 |
|
| 377 |
Enable the TCPv4 transport using the C<tcp-port> port |
| 378 |
(default: C<no>). Support for this transport protocol is only available |
| 379 |
when gvpe was compiled using the C<--enable-tcp> option. |
| 380 |
|
| 381 |
=item enable-udp = yes|true|on | no|false|off |
| 382 |
|
| 383 |
See gvpe.protocol(7) for a description of the UDP transport protocol. |
| 384 |
|
| 385 |
Enable the UDPv4 transport using the C<udp-port> port (default: C<no>, |
| 386 |
unless no other protocol is enabled for a node, in which case this |
| 387 |
protocol is enabled automatically). |
| 388 |
|
| 389 |
NOTE: Please specify C<enable-udp = yes> if you want t use it even though |
| 390 |
it might get switched on automatically, as some future version might |
| 391 |
default to another default protocol. |
| 392 |
|
| 393 |
=item icmp-type = integer |
| 394 |
|
| 395 |
Sets the type value to be used for outgoing (and incoming) packets sent |
| 396 |
via the ICMP transport. |
| 397 |
|
| 398 |
The default is C<0> (which is C<echo-reply>, also known as |
| 399 |
"ping-replies"). Other useful values include C<8> (C<echo-request>, a.k.a. |
| 400 |
"ping") and C<11> (C<time-exceeded>), but any 8-bit value can be used. |
| 401 |
|
| 402 |
=item inherit-tos = yes|true|on | no|false|off |
| 403 |
|
| 404 |
Wether to inherit the TOS settings of packets sent to the tunnel when |
| 405 |
sending packets to this node (default: C<yes>). If set to C<yes> then |
| 406 |
outgoing tunnel packets will have the same TOS setting as the packets sent |
| 407 |
to the tunnel device, which is usually what you want. |
| 408 |
|
| 409 |
=item max-retry = positive-number |
| 410 |
|
| 411 |
The maximum interval in seconds (default: C<3600>, one hour) between |
| 412 |
retries to establish a connection to this node. When a connection cannot |
| 413 |
be established, gvpe uses exponential backoff capped at this value. It's |
| 414 |
sometimes useful to set this to a much lower value (e.g. C<120>) on |
| 415 |
connections to routers that usually are stable but sometimes are down, to |
| 416 |
assure quick reconnections even after longer downtimes. |
| 417 |
|
| 418 |
=item router-priority = 0 | 1 | positive-number>=2 |
| 419 |
|
| 420 |
Sets the router priority of the given host (default: C<0>, disabled). If |
| 421 |
some host tries to connect to another host without a hostname, it asks |
| 422 |
the router host for it's IP address. The router host is the one with the |
| 423 |
highest priority larger than C<1> that is currently reachable. |
| 424 |
|
| 425 |
Make sure all hosts always connect (C<connect = always>) to the router |
| 426 |
hosts, otherwise connecting to them might be impossible. |
| 427 |
|
| 428 |
The special value C<1> allows other hosts to route through the router |
| 429 |
host, but they will never route through it by default. The value C<0> |
| 430 |
disables routing. The idea behind this is that some hosts can, if |
| 431 |
required, bump the C<router-priority> setting to higher than C<1> in their |
| 432 |
local config to route through specific hosts. If C<router-priority> is |
| 433 |
C<0>, then routing will be refused, so C<1> serves as a "enable, but do |
| 434 |
not use by default" switch. |
| 435 |
|
| 436 |
=item tcp-port = port-number |
| 437 |
|
| 438 |
Similar to C<udp-port> (default: C<655>), but sets the TCP port number. |
| 439 |
|
| 440 |
=item udp-port = port-number |
| 441 |
|
| 442 |
Sets the port number used by the UDP protocol (default: C<655>, not |
| 443 |
officially assigned by IANA!). |
| 444 |
|
| 445 |
=back |
| 446 |
|
| 447 |
=head1 CONFIG DIRECTORY LAYOUT |
| 448 |
|
| 449 |
The default (or recommended) directory layout for the config directory is: |
| 450 |
|
| 451 |
=over 4 |
| 452 |
|
| 453 |
=item X<gvpe.conf> |
| 454 |
|
| 455 |
The config file. |
| 456 |
|
| 457 |
=item X<if-up> |
| 458 |
|
| 459 |
The if-up script |
| 460 |
|
| 461 |
=item X<node-up>, X<node-down> |
| 462 |
|
| 463 |
If used the node up or node-down scripts. |
| 464 |
|
| 465 |
=item X<hostkey> |
| 466 |
|
| 467 |
The private key (taken from C<hostkeys/nodename>) of the current host. |
| 468 |
|
| 469 |
=item X<pubkey/nodename> |
| 470 |
|
| 471 |
The public keys of the other nodes, one file per node. |
| 472 |
|
| 473 |
=back |
| 474 |
|
| 475 |
=head1 SEE ALSO |
| 476 |
|
| 477 |
gvpe(5), gvpe(8), gvpectrl(8). |
| 478 |
|
| 479 |
=head1 AUTHOR |
| 480 |
|
| 481 |
Marc Lehmann <gvpe@plan9.de> |
| 482 |
|
