welterde/l2tpns
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add DHCPv6 functionality.

Browse source
This commit is contained in:
fendo 2014-09-11 16:19:57 +02:00
parent 786a8c4546
commit b3f40f41f7
36 changed files with 2430 additions and 546 deletions
Download patch file Download diff file Expand all files Collapse all files

304
Docs/l2tpns.8
View file

@ -1,70 +1,248 @@
.\" -*- nroff -*-
.de Id
.ds Dt \\$4 \\$5
.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.16)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.Id $Id: l2tpns.8,v 1.4 2005-06-12 06:09:35 bodea Exp $
.TH L2TPNS 8 "\*(Dt" L2TPNS "System Management Commands"
.SH NAME
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" Set up some character translations and predefined strings. \*(-- will
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
.\" double quote, and \*(R" will give a right double quote. \*(C+ will
.\" give a nicer C++. Capital omega is used to do unbreakable dashes and
.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
.\" nothing in troff, for use with C<>.
.tr \(*W-
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.ie n \{\
. ds -- \(*W-
. ds PI pi
. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
. ds L" ""
. ds R" ""
. ds C` ""
. ds C' ""
'br\}
.el\{\
. ds -- \|\(em\|
. ds PI \(*p
. ds L" ``
. ds R" ''
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el .ds Aq '
.\"
.\" If the F register is turned on, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD. Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.ie \nF \{\
. de IX
. tm Index:\\$1\t\\n%\t"\\$2"
..
. nr % 0
. rr F
.\}
.el \{\
. de IX
..
.\}
.\"
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
.\" Fear. Run. Save yourself. No user-serviceable parts.
. \" fudge factors for nroff and troff
.if n \{\
. ds #H 0
. ds #V .8m
. ds #F .3m
. ds #[ \f1
. ds #] \fP
.\}
.if t \{\
. ds #H ((1u-(\\\\n(.fu%2u))*.13m)
. ds #V .6m
. ds #F 0
. ds #[ \&
. ds #] \&
.\}
. \" simple accents for nroff and troff
.if n \{\
. ds ' \&
. ds ` \&
. ds ^ \&
. ds , \&
. ds ~ ~
. ds /
.\}
.if t \{\
. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
.\}
. \" troff and (daisy-wheel) nroff accents
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
.ds ae a\h'-(\w'a'u*4/10)'e
.ds Ae A\h'-(\w'A'u*4/10)'E
. \" corrections for vroff
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
. \" for low resolution devices (crt and lpr)
.if \n(.H>23 .if \n(.V>19 \
\{\
. ds : e
. ds 8 ss
. ds o a
. ds d- d\h'-1'\(ga
. ds D- D\h'-1'\(hy
. ds th \o'bp'
. ds Th \o'LP'
. ds ae ae
. ds Ae AE
.\}
.rm #[ #] #H #V #F C
.\" ========================================================================
.\"
.IX Title "L2TPNS.8 1"
.TH L2TPNS.8 1 "2014-09-11" "perl v5.14.2" "User Contributed Perl Documentation"
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH "NAME"
l2tpns \- Layer 2 tunneling protocol network server (LNS)
.SH SYNOPSIS
.B l2tpns
.RB [ \-d ]
.RB [ \-v ]
.RB [ \-c
.IR file ]
.RB [ \-h
.IR hostname ]
.SH DESCRIPTION
.B l2tpns
is a daemon for terminating layer 2 tunneling protocol (L2TP: RFC
2661) sessions.
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
\&\fBl2tpns\fR [\-\fBd\fR] [\-\fBv\fR] [\-\fBc\fR \fIfile\fR] [\-\fBh\fR \fIhostname\fR]
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
\&\fBl2tpns\fR is a daemon for terminating layer 2 tunneling protocol (L2TP: \s-1RFC2661\s0) sessions.
.PP
Once running,
.B l2tpns
may be controlled by telnetting to port 23 on the machine running the
daemon and with the
.B nsctl
utility.
.SH OPTIONS
.TP
.B \-d
Detach from terminal and fork into the background. By default l2tpns
will stay in the foreground.
.TP
.B \-v
Increase verbosity for debugging. Can be used multiple times.
.TP
.BI "\-c " file
\&\fBl2tpns\fR is a complete L2TP implementation. It supports the \s-1LAC\s0, \s-1LNS\s0, \s-1PPPOE\s0 and DHCPv6 server.
.PP
Once running, \fBl2tpns\fR may be controlled by telnetting to port 23 on the machine running the daemon and with the \fBnsctl\fR utility.
.SH "OPTIONS"
.IX Header "OPTIONS"
.IP "\fB\-d\fR Detach from terminal and fork into the background. By default l2tpns will stay in the foreground." 4
.IX Item "-d Detach from terminal and fork into the background. By default l2tpns will stay in the foreground."
\&.
.IP "\fB\-v\fR Increase verbosity for debugging. Can be used multiple times." 4
.IX Item "-v Increase verbosity for debugging. Can be used multiple times."
\&.
.IP "\fB\-c\fR \fIfile\fR" 4
.IX Item "-c file"
Specify configuration file.
.TP
.BI "\-h " hostname
Force hostname to
.IR hostname .
.SH FILES
.TP
.I /etc/l2tpns/startup-config
.IP "\fB\-h\fR \fIhostname\fR" 4
.IX Item "-h hostname"
Force hostname to \fIhostname\fR.
.SH "FILES"
.IX Header "FILES"
.IP "\fI/etc/l2tpns/startup\-config\fR" 4
.IX Item "/etc/l2tpns/startup-config"
The default configuration file.
.TP
.I /etc/l2tpns/ip_pool
IP address pool configuration.
.TP
.I /etc/l2tpns/users
.IP "\fI/etc/l2tpns/ip_pool\fR" 4
.IX Item "/etc/l2tpns/ip_pool"
\&\s-1IP\s0 address pool configuration.
.IP "\fI/etc/l2tpns/users\fR" 4
.IX Item "/etc/l2tpns/users"
Username/password configuration for access to admin interface.
.SH SIGNALS
.TP
.B SIGHUP
Reload the config from disk and re-open log file.
.TP
.BR SIGTERM ", " SIGINT
Stop process. Tunnels and sessions are not terminated. This signal
should be used to stop l2tpns on a cluster node where there are other
machines to continue handling traffic.
.TP
.B SIGQUIT
.SH "SIGNALS"
.IX Header "SIGNALS"
.IP "\fB\s-1SIGHUP\s0\fR Reload the config from disk and re-open log file." 4
.IX Item "SIGHUP Reload the config from disk and re-open log file."
\&.
.IP "\fB\s-1SIGTERM\s0\fR, \fB\s-1SIGINT\s0\fR" 4
.IX Item "SIGTERM, SIGINT"
Stop process. Tunnels and sessions are not terminated. This signal should be used to stop l2tpns on a cluster node where there are other machines to continue handling traffic.
.IP "\fB\s-1SIGQUIT\s0\fR" 4
.IX Item "SIGQUIT"
Shut down tunnels and sessions, exit process when complete.
.SH SEE ALSO
.BR startup-config (5),
.BR nsctl (8)
.SH AUTHOR
This manual page was written by Jonathan McDowell <noodles@earth.li>,
for the Debian GNU/Linux system (but may be used by others).
.SH "MANAGED RADIUS ATTRIBUTE"
.IX Header "MANAGED RADIUS ATTRIBUTE"
.IP "\fBAscend-Client-Primary-DNS\fR, \fBAscend-Client-Secondary-DNS\fR" 4
.IX Item "Ascend-Client-Primary-DNS, Ascend-Client-Secondary-DNS"
Specifies a primary and secondary \s-1DNS\s0 server address to send to user.
.IP "\fBDelegated\-IPv6\-Prefix\fR" 4
.IX Item "Delegated-IPv6-Prefix"
Assign a network address IPv6 prefix to a user by DHCPv6.
.IP "\fBFramed-IP-Address\fR" 4
.IX Item "Framed-IP-Address"
The address to be configured for the user (IPv4 address of the interface ppp).
.IP "\fBFramed-Route\fR" 4
.IX Item "Framed-Route"
provides routing information to be configured for the user.
.IP "\fBFramed\-IPv6\-Route\fR" 4
.IX Item "Framed-IPv6-Route"
Has the same action as \fBDelegated\-IPv6\-Prefix\fR. \fBDelegated\-IPv6\-Prefix\fR is the correct one to use.
.IP "\fBFramed\-IPv6\-Address\fR" 4
.IX Item "Framed-IPv6-Address"
IPv6 address to be assigned to the user by DHCPv6 (IPv6 address of the interface ppp).
.IP "\fBIdle-Timeout\fR" 4
.IX Item "Idle-Timeout"
disconnects the session if no data for more than \fBIdle-Timeout\fR (in seconds).
.IP "\fBSession-Timeout\fR" 4
.IX Item "Session-Timeout"
disconnects the user session when the time \fBSession-Timeout\fR is reached (in seconds).
.IP "\fBTunnel-Type\fR, \fBTunnel-Medium-Type\fR, \fBTunnel-Server-Endpoint\fR, \fBTunnel-Password\fR, \fBTunnel-Assignment-Id\fR" 4
.IX Item "Tunnel-Type, Tunnel-Medium-Type, Tunnel-Server-Endpoint, Tunnel-Password, Tunnel-Assignment-Id"
attributes returned by the Radius of the remote \s-1LNS\s0 server (\s-1LAC\s0 functionality).
.Sp
example, Radius that return the information of 2 remote \s-1LNS\s0 server with which must be open a L2TP \s-1TUNNEL:\s0
.RS 4
.IP "\fBTunnel-Type\fR: 1 = L2TP" 4
.IX Item "Tunnel-Type: 1 = L2TP"
.PD 0
.IP "\fBTunnel-Medium-Type\fR: 1 = IPv4" 4
.IX Item "Tunnel-Medium-Type: 1 = IPv4"
.ie n .IP "\fBTunnel-Password\fR: 1 = ""TheSecretL2TP""" 4
.el .IP "\fBTunnel-Password\fR: 1 = ``TheSecretL2TP''" 4
.IX Item "Tunnel-Password: 1 = TheSecretL2TP"
.ie n .IP "\fBTunnel-Server-Endpoint\fR: 1 = ""88.xx.xx.x1""" 4
.el .IP "\fBTunnel-Server-Endpoint\fR: 1 = ``88.xx.xx.x1''" 4
.IX Item "Tunnel-Server-Endpoint: 1 = 88.xx.xx.x1"
.ie n .IP "\fBTunnel-Assignment-Id\fR: 1 = ""friendisp_lns1""" 4
.el .IP "\fBTunnel-Assignment-Id\fR: 1 = ``friendisp_lns1''" 4
.IX Item "Tunnel-Assignment-Id: 1 = friendisp_lns1"
.IP "\fBTunnel-Type\fR: 2 = L2TP" 4
.IX Item "Tunnel-Type: 2 = L2TP"
.IP "\fBTunnel-Medium-Type\fR: 2 = IPv4" 4
.IX Item "Tunnel-Medium-Type: 2 = IPv4"
.ie n .IP "\fBTunnel-Password\fR: 2 = ""TheSecretL2TP""" 4
.el .IP "\fBTunnel-Password\fR: 2 = ``TheSecretL2TP''" 4
.IX Item "Tunnel-Password: 2 = TheSecretL2TP"
.ie n .IP "\fBTunnel-Server-Endpoint\fR: 2 = ""88.xx.xx.x2""" 4
.el .IP "\fBTunnel-Server-Endpoint\fR: 2 = ``88.xx.xx.x2''" 4
.IX Item "Tunnel-Server-Endpoint: 2 = 88.xx.xx.x2"
.ie n .IP "\fBTunnel-Assignment-Id\fR: 2 = ""friendisp_lns2""" 4
.el .IP "\fBTunnel-Assignment-Id\fR: 2 = ``friendisp_lns2''" 4
.IX Item "Tunnel-Assignment-Id: 2 = friendisp_lns2"
.RE
.RS 4
.RE
.PD
.SH "SEE ALSO"
.IX Header "SEE ALSO"
\&\fBstartup-config\fR(5), \fBnsctl\fR(8)
.SH "AUTHOR"
.IX Header "AUTHOR"
This manual page was written by Jonathan McDowell <noodles@earth.li> and Fernando Alves (fendo@sameswifi.fr), for the Debian GNU/Linux system (but may be used by others).

151
Docs/l2tpns.8.pod Normal file
View file

@ -0,0 +1,151 @@
=pod
=head1 NAME
l2tpns - Layer 2 tunneling protocol network server (LNS)
=head1 SYNOPSIS
B<l2tpns> [-B<d>] [-B<v>] [-B<c> I<file>] [-B<h> I<hostname>]
=head1 DESCRIPTION
B<l2tpns> is a daemon for terminating layer 2 tunneling protocol (L2TP: RFC2661) sessions.
B<l2tpns> is a complete L2TP implementation. It supports the LAC, LNS, PPPOE and DHCPv6 server.
Once running, B<l2tpns> may be controlled by telnetting to port 23 on the machine running the daemon and with the B<nsctl> utility.
=head1 OPTIONS
=over
=item B<-d> Detach from terminal and fork into the background. By default l2tpns will stay in the foreground.
.
=item B<-v> Increase verbosity for debugging. Can be used multiple times.
.
=item B<-c> I<file>
Specify configuration file.
=item B<-h> I<hostname>
Force hostname to I<hostname>.
=back
=head1 FILES
=over
=item I</etc/l2tpns/startup-config>
The default configuration file.
=item I</etc/l2tpns/ip_pool>
IP address pool configuration.
=item I</etc/l2tpns/users>
Username/password configuration for access to admin interface.
=back
=head1 SIGNALS
=over
=item B<SIGHUP> Reload the config from disk and re-open log file.
.
=item B<SIGTERM>, B<SIGINT>
Stop process. Tunnels and sessions are not terminated. This signal should be used to stop l2tpns on a cluster node where there are other machines to continue handling traffic.
=item B<SIGQUIT>
Shut down tunnels and sessions, exit process when complete.
=back
=head1 MANAGED RADIUS ATTRIBUTE
=over
=item B<Ascend-Client-Primary-DNS>, B<Ascend-Client-Secondary-DNS>
Specifies a primary and secondary DNS server address to send to user.
=item B<Delegated-IPv6-Prefix>
Assign a network address IPv6 prefix to a user by DHCPv6.
=item B<Framed-IP-Address>
The address to be configured for the user (IPv4 address of the interface ppp).
=item B<Framed-Route>
provides routing information to be configured for the user.
=item B<Framed-IPv6-Route>
Has the same action as B<Delegated-IPv6-Prefix>. B<Delegated-IPv6-Prefix> is the correct one to use.
=item B<Framed-IPv6-Address>
IPv6 address to be assigned to the user by DHCPv6 (IPv6 address of the interface ppp).
=item B<Idle-Timeout>
disconnects the session if no data for more than B<Idle-Timeout> (in seconds).
=item B<Session-Timeout>
disconnects the user session when the time B<Session-Timeout> is reached (in seconds).
=item B<Tunnel-Type>, B<Tunnel-Medium-Type>, B<Tunnel-Server-Endpoint>, B<Tunnel-Password>, B<Tunnel-Assignment-Id>
attributes returned by the Radius of the remote LNS server (LAC functionality).
example, Radius that return the information of 2 remote LNS server with which must be open a L2TP TUNNEL:
=over
=item B<Tunnel-Type>: 1 = L2TP
=item B<Tunnel-Medium-Type>: 1 = IPv4
=item B<Tunnel-Password>: 1 = "TheSecretL2TP"
=item B<Tunnel-Server-Endpoint>: 1 = "88.xx.xx.x1"
=item B<Tunnel-Assignment-Id>: 1 = "friendisp_lns1"
=item B<Tunnel-Type>: 2 = L2TP
=item B<Tunnel-Medium-Type>: 2 = IPv4
=item B<Tunnel-Password>: 2 = "TheSecretL2TP"
=item B<Tunnel-Server-Endpoint>: 2 = "88.xx.xx.x2"
=item B<Tunnel-Assignment-Id>: 2 = "friendisp_lns2"
=back
=back
=head1 SEE ALSO
B<startup-config>(5), B<nsctl>(8)
=head1 AUTHOR
This manual page was written by Jonathan McDowell <noodles@earth.li> and Fernando Alves (fendo@sameswifi.fr), for the Debian GNU/Linux system (but may be used by others).

54
Docs/manual.html
View file

@ -60,29 +60,17 @@ H3 {
</OL>
<H2 ID="Overview">Overview</H2>
l2tpns a complete L2TP implementation. It supports the LAC, LNS and
PPPOE server.<P>
l2tpns a complete L2TP implementation. It supports the LAC, LNS, PPPOE and DHCPv6 server.<P>
L2TP (Layer 2 Tunneling Protocol) is designed to allow any layer 2
protocol (e.g. Ethernet, PPP) to be tunneled over an IP connection. l2tpns
implements PPP over L2TP only.<P>
L2TP (Layer 2 Tunneling Protocol) is designed to allow any layer 2 protocol (e.g. Ethernet, PPP) to be tunneled over an IP connection. l2tpns implements PPP over L2TP only.<P>
There are a couple of other L2TP implementations, of which <A
HREF="http://sourceforge.net/projects/l2tpd">l2tpd</A> is probably the
most popular. l2tpd also will handle being either end of a tunnel, and
is a lot more configurable than l2tpns. However, due to the way it works,
it is nowhere near as scalable.<P>
There are a couple of other L2TP implementations, of which <A HREF="http://sourceforge.net/projects/l2tpd">l2tpd</A> is probably the most popular. l2tpd also will handle being either end of a tunnel, and is a lot more configurable than l2tpns. However, due to the way it works, it is nowhere near as scalable.<P>
l2tpns uses the TUN/TAP interface provided by the Linux kernel to receive
and send packets. Using some packet manipulation it doesn't require a
single interface per connection, as l2tpd does.<P>
l2tpns uses the TUN/TAP interface provided by the Linux kernel to receive and send packets. Using some packet manipulation it doesn't require a single interface per connection, as l2tpd does.<P>
This allows it to scale extremely well to very high loads and very high
numbers of connections.<P>
This allows it to scale extremely well to very high loads and very high numbers of connections.<P>
It also has a plugin architecture which allows custom code to be run
during processing. An example of this is in the walled garden module
included.<P>
It also has a plugin architecture which allows custom code to be run during processing. An example of this is in the walled garden module included.<P>
<BR>
<EM>Documentation is not my best skill. If you find any problems
@ -167,15 +155,15 @@ only ever be used for working out why it doesn't work at all.
</LI>
<LI><B>log_file</B> (string)<BR>
This will be where all logging and debugging information is written
to. This may be either a filename, such as <EM>/var/log/l2tpns</EM>, or
the special magic string <EM>syslog:facility</EM>, where <EM>facility</EM>
is any one of the syslog logging facilities, such as local5.
This will be where all logging and debugging information is written to. This may be either a filename, such as <EM>/var/log/l2tpns</EM>, or the special magic string <EM>syslog:facility</EM>, where <EM>facility</EM> is any one of the syslog logging facilities, such as local5.
</LI>
<LI><B>pid_file</B> (string)<BR>
If set, the process id will be written to the specified file. The
value must be an absolute path.
If set, the process id will be written to the specified file. The value must be an absolute path.
</LI>
<LI><B>random_device</B>B> (string)<BR>
Path to random data source (default /dev/urandom). Use "" to use the rand() library function.
</LI>
<LI><B>l2tp_secret</B> (string)<BR>
@ -185,8 +173,7 @@ used if the LAC requests authentication.
</LI>
<LI><B>l2tp_mtu</B> (int)<BR>
MTU of interface for L2TP traffic (default: 1500). Used to set link
MRU and adjust TCP MSS.
MTU of interface for L2TP traffic (default: 1500). Used to set link MRU and adjust TCP MSS.
</LI>
<LI><B>ppp_restart_time</B> (int)<BR>
@ -231,8 +218,7 @@ session is closed.
</LI>
<LI><B>radius_secret</B> (string)<BR>
This secret will be used in all RADIUS queries. If this is not set then
RADIUS queries will fail.
This secret will be used in all RADIUS queries. If this is not set then RADIUS queries will fail.
</LI>
<LI><B>radius_authtypes</B> (string)</BR>
@ -252,11 +238,7 @@ session is established.
</LI>
<LI><B>bind_address</B> (ip address)<BR>
It's the listen address of the l2tp udp protocol sent and received
to LAC. This address is also assigned to the tun interface if no
iftun_address is specified. Packets containing user traffic should be
routed via this address if given, otherwise the primary address of the
machine.
It's the listen address of the l2tp udp protocol sent and received to LAC. This address is also assigned to the tun interface if no iftun_address is specified. Packets containing user traffic should be routed via this address if given, otherwise the primary address of the machine.
</LI>
<LI><B>iftun_address</B> (ip address)<BR>
@ -280,7 +262,6 @@ for Address1 on LNS1 and a bgp.prepend(MY_AS) for Address2 on LNS2
example of use with 2 address:
<BR>
set bind_multi_address "64.14.13.41, 64.14.13.42"
</LI>
<LI><B>tundevicename</B> (string)<BR>
@ -325,11 +306,6 @@ uptxoctets, downrxoctets, origin (optional). The qos field is 1 if a standard us
If set to true, all origin of the usage is dumped to the accounting file (LAC+Remote LNS+PPPOE)(default false).
</LI>
<LI><B>setuid</B> (int)<BR>
After starting up and binding the interface, change UID to this. This
doesn't work properly.
</LI>
<LI><B>dump_speed</B> (boolean)<BR>
If set to true, then the current bandwidth utilization will be logged every
second. Even if this is disabled, you can see this information by running

815
Docs/startup-config.5
View file

@ -1,367 +1,496 @@
.\" -*- nroff -*-
.de Id
.ds Dt \\$4 \\$5
.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.16)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.Id $Id: startup-config.5,v 1.18 2006-07-01 12:40:17 bodea Exp $
.TH STARTUP-CONFIG 5 "\*(Dt" L2TPNS "File Formats and Conventions"
.SH NAME
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" Set up some character translations and predefined strings. \*(-- will
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
.\" double quote, and \*(R" will give a right double quote. \*(C+ will
.\" give a nicer C++. Capital omega is used to do unbreakable dashes and
.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
.\" nothing in troff, for use with C<>.
.tr \(*W-
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.ie n \{\
. ds -- \(*W-
. ds PI pi
. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
. ds L" ""
. ds R" ""
. ds C` ""
. ds C' ""
'br\}
.el\{\
. ds -- \|\(em\|
. ds PI \(*p
. ds L" ``
. ds R" ''
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el .ds Aq '
.\"
.\" If the F register is turned on, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD. Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.ie \nF \{\
. de IX
. tm Index:\\$1\t\\n%\t"\\$2"
..
. nr % 0
. rr F
.\}
.el \{\
. de IX
..
.\}
.\"
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
.\" Fear. Run. Save yourself. No user-serviceable parts.
. \" fudge factors for nroff and troff
.if n \{\
. ds #H 0
. ds #V .8m
. ds #F .3m
. ds #[ \f1
. ds #] \fP
.\}
.if t \{\
. ds #H ((1u-(\\\\n(.fu%2u))*.13m)
. ds #V .6m
. ds #F 0
. ds #[ \&
. ds #] \&
.\}
. \" simple accents for nroff and troff
.if n \{\
. ds ' \&
. ds ` \&
. ds ^ \&
. ds , \&
. ds ~ ~
. ds /
.\}
.if t \{\
. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
.\}
. \" troff and (daisy-wheel) nroff accents
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
.ds ae a\h'-(\w'a'u*4/10)'e
.ds Ae A\h'-(\w'A'u*4/10)'E
. \" corrections for vroff
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
. \" for low resolution devices (crt and lpr)
.if \n(.H>23 .if \n(.V>19 \
\{\
. ds : e
. ds 8 ss
. ds o a
. ds d- d\h'-1'\(ga
. ds D- D\h'-1'\(hy
. ds th \o'bp'
. ds Th \o'LP'
. ds ae ae
. ds Ae AE
.\}
.rm #[ #] #H #V #F C
.\" ========================================================================
.\"
.IX Title "STARTUP-CONFIG.5 1"
.TH STARTUP-CONFIG.5 1 "2014-09-11" "perl v5.14.2" "User Contributed Perl Documentation"
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH "NAME"
startup\-config \- configuration file for l2tpns
.SH SYNOPSIS
/etc/l2tpns/startup-config
.SH DESCRIPTION
.B startup-config
is the configuration file for
.BR l2tpns .
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
/etc/l2tpns/startup\-config
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
\&\fBstartup-config\fR is the configuration file for \fBl2tpns\fR
.PP
The format is plain text, in the same format as accepted by the
configuration mode of
.BR l2tpns 's
telnet administrative interface. Comments are indicated by either the
character
.B #
or
.BR ! .
.SS SETTINGS
The format is plain text, in the same format as accepted by
the configuration mode of l2tpns's telnet administrative
interface. Comments are indicated by either the character # or !.
.SS "\s-1SETTINGS\s0"
.IX Subsection "SETTINGS"
Settings are specified with
.IP
.BI "set " "variable value"
.IP "\fBset\fR \fIvariable\fR \fIvalue\fR" 4
.IX Item "set variable value"
.PP
The following
.IR variable s
may be set:
.RS
.TP
.B debug
Set the level of debugging messages written to the log file. The
value should be between 0 and 5, with 0 being no debugging, and 5
being the highest.
.TP
.B log_file
This will be where all logging and debugging information is written
to. This may be either a filename, such as
.BR /var/log/l2tpns ,
or the string
.BR syslog : \fIfacility\fR ,
where
.I facility
is any one of the syslog logging facilities, such as
.BR local5 .
.TP
.B pid_file
If set, the process id will be written to the specified file. The
value must be an absolute path.
.TP
.B random_device
Path to random data source (default
.BR /dev/urandom ).
Use "" to use the rand() library function.
.TP
.B l2tp_secret
The secret used by
.B l2tpns
for authenticating tunnel request. Must be the same as the LAC, or
authentication will fail. Only actually be used if the LAC requests
authentication.
.TP
.B l2tp_mtu
MTU of interface for L2TP traffic (default: 1500). Used to set link
MRU and adjust TCP MSS.
.TP
.B ppp_restart_time
Restart timer for PPP protocol negotiation in seconds (default: 3).
.TP
.B ppp_max_configure
Number of configure requests to send before giving up (default: 10).
.TP
.B ppp_max_failure
Number of Configure-Nak requests to send before sending a
Configure-Reject (default: 5).
.TP
.BR primary_dns ", " secondary_dns
Whenever a PPP connection is established, DNS servers will be sent to the
user, both a primary and a secondary. If either is set to 0.0.0.0, then that
one will not be sent.
.TP
.BR primary_radius ", " secondary_radius
Sets the RADIUS servers used for both authentication and accounting.
If the primary server does not respond, then the secondary RADIUS
server will be tried.
.TP
.BR primary_radius_port ", " secondary_radius_port
Sets the authentication ports for the primary and secondary RADIUS
servers. The accounting port is one more than the authentication
port. If no ports are given, authentication defaults to 1645, and
accounting to 1646.
.TP
.B radius_accounting
If set to true, then RADIUS accounting packets will be sent. A
.B Start
record will be sent when the session is successfully authenticated,
and a
.B Stop
record when the session is closed.
.TP
.B radius_interim
If
.B radius_accounting
is on, defines the interval between sending of RADIUS interim
accounting records (in seconds).
.TP
.B radius_secret
Secret to be used in RADIUS packets.
.TP
.B radius_authtypes
A comma separated list of supported RADIUS authentication methods
("pap" or "chap"), in order of preference (default "pap").
.TP
.B radius_dae_port
Port for DAE RADIUS (Packet of Death/Disconnect, Change of Authorization)
requests (default: 3799).
.TP
.BR radius_bind_min ", " radius_bind_max
Define a port range in which to bind sockets used to send and receive
RADIUS packets. Must be at least RADIUS_FDS (64) wide. Simplifies
firewalling of RADIUS ports (default: dynamically assigned).
.TP
.B allow_duplicate_users
Allow multiple logins with the same username. If false (the default),
any prior session with the same username will be dropped when a new
session is established.
.TP
.B guest_account
Allow multiple logins matching this specific username.
.TP
.B bind_address
When the tun interface is created, it is assigned the address
specified here. If no address is given, 1.1.1.1 is used. Packets
containing user traffic should be routed via this address if given,
otherwise the primary address of the machine.
.TP
.B peer_address
Address to send to clients as the default gateway.
.TP
.B send_garp
Determines whether or not to send a gratuitous ARP for the
.B bind_address
when the server is ready to handle traffic (default: true). This
setting is ignored if BGP is configured.
.TP
.B throttle_speed
Sets the default speed (in kbits/s) which sessions will be limited to.
.TP
.B throttle_buckets
Number of token buckets to allocate for throttling. Each throttled
session requires two buckets (in and out).
.TP
.B accounting_dir
If set to a directory, then every 5 minutes the current usage for
every connected use will be dumped to a file in this directory.
.TP
.B dump_speed
If set to true, then the current bandwidth utilization will be logged
every second. Even if this is disabled, you can see this information
by running the
.B uptime
command on the CLI.
.TP
.B multi_read_count
Number of packets to read off each of the UDP and TUN fds when
returned as readable by select (default: 10). Avoids incurring the
unnecessary system call overhead of select on busy servers.
.TP
.B scheduler_fifo
Sets the scheduling policy for the
.B l2tpns
process to
.BR SCHED_FIFO .
This causes the kernel to immediately preempt any currently running
.B SCHED_OTHER
(normal) process in favour of
.B l2tpns
when it becomes runnable.
.br
Ignored on uniprocessor systems.
.TP
.B lock_pages
Keep all pages mapped by the
.B l2tpns
process in memory.
.TP
.B icmp_rate
Maximum number of host unreachable ICMP packets to send per second.
.TP
.B packet_limit
Maximum number of packets of downstream traffic to be handled each
tenth of a second per session. If zero, no limit is applied (default:
0). Intended as a DoS prevention mechanism and not a general
throttling control (packets are dropped, not queued).
.TP
.B cluster_address
Multicast cluster address (default: 239.192.13.13).
.TP
.B cluster_interface
A list of the possible configuration directives follows. Each of these should be set by a line like:
.ie n .IP "\fBset\fR \fIconfigstring\fR \fI""value""\fR" 4
.el .IP "\fBset\fR \fIconfigstring\fR \fI``value''\fR" 4
.IX Item "set configstring value"
.PD 0
.IP "\fBset\fR \fIipaddress\fR \fI192.168.1.1\fR" 4
.IX Item "set ipaddress 192.168.1.1"
.IP "\fBset\fR \fIboolean\fR \fItrue\fR" 4
.IX Item "set boolean true"
.PD
.PP
The following \fIvariables\fR may be set:
.IP "\fBaccounting_dir\fR (string)" 4
.IX Item "accounting_dir (string)"
If set to a directory, then every 5 minutes the current usage for every connected use will be dumped to a file in this directory. Each file dumped begins with a header, where each line is prefixed by #. Following the header is a single line for every connected user, fields separated by a space.
.Sp
The fields are username, ip, qos, uptxoctets, downrxoctets, origin (optional). The qos field is 1 if a standard user, and 2 if the user is throttled. The origin field is dump if \fBaccount_all_origin\fR is set to true (origin value: L=LAC data, R=Remote \s-1LNS\s0 data, P=PPPOE data).
.IP "\fBaccount_all_origin\fR (boolean)" 4
.IX Item "account_all_origin (boolean)"
If set to true, all origin of the usage is dumped to the accounting file (LAC+Remote \s-1LNS+PPPOE\s0)(default false).
.IP "\fBallow_duplicate_users\fR (boolean)" 4
.IX Item "allow_duplicate_users (boolean)"
Allow multiple logins with the same username. If false (the default), any prior session with the same username will be dropped when a new session is established.
.IP "\fBauth_tunnel_change_addr_src\fR (boolean)" 4
.IX Item "auth_tunnel_change_addr_src (boolean)"
This parameter authorize to change the source \s-1IP\s0 of the tunnels l2tp. This parameter can be used when the remotes \s-1BAS/LAC\s0 are l2tpns server configured in cluster mode, but that the interface to remote \s-1LNS\s0 are not clustered (the tunnel can be coming from different source \s-1IP\s0) (default: no).
.IP "\fBbind_address\fR (ip address)" 4
.IX Item "bind_address (ip address)"
It's the listen address of the l2tp udp protocol sent and received to \s-1LAC\s0. This address is also assigned to the tun interface if no iftun_address is specified. Packets containing user traffic should be routed via this address if given, otherwise the primary address of the machine.
.IP "\fBbind_multi_address\fR (ip address)" 4
.IX Item "bind_multi_address (ip address)"
This parameter permit to listen several addresss of the l2tp udp protocol (and set several address to the tun interface).
.Sp
\&\s-1WHEN\s0 this parameter is set, It \s-1OVERWRITE\s0 the parameters \*(L"bind_address\*(R" and \*(L"iftun_address\*(R".
.Sp
these can be interesting when you want do load-balancing in cluster mode of the uploaded from the \s-1LAC\s0. For example you can set a bgp.prepend(\s-1MY_AS\s0) for Address1 on \s-1LNS1\s0 and a bgp.prepend(\s-1MY_AS\s0) for Address2 on \s-1LNS2\s0 (see \s-1BGP\s0 AS-path prepending).
.Sp
example of use with 2 address:
.Sp
\&\fBset\fR \fIbind_multi_address\fR \*(L"64.14.13.41, 64.14.13.42\*(R"
.IP "\fBcluster_address\fR (ip address)" 4
.IX Item "cluster_address (ip address)"
Multicast cluster address (default: 239.192.13.13). See the section on Clustering for more information.
.IP "\fBcluster_interface\fR (string)" 4
.IX Item "cluster_interface (string)"
Interface for cluster packets (default: eth0).
.TP
.B cluster_mcast_ttl
TTL for multicast packets (default: 1).
.TP
.B cluster_hb_interval
.IP "\fBcluster_mcast_ttl\fR (int)" 4
.IX Item "cluster_mcast_ttl (int)"
\&\s-1TTL\s0 for multicast packets (default: 1).
.IP "\fBcluster_hb_interval\fR (int)" 4
.IX Item "cluster_hb_interval (int)"
Interval in tenths of a second between cluster heartbeat/pings.
.TP
.B cluster_hb_timeout
Cluster heartbeat timeout in tenths of a second. A new master will be
elected when this interval has been passed without seeing a heartbeat
from the master.
.TP
.B cluster_master_min_adv
Determines the minumum number of up to date slaves required before the
master will drop routes (default: 1).
.TP
.B ipv6_prefix
Enable negotiation of IPv6. This forms the the first 64 bits of the
client allocated address. The remaining 64 come from the allocated
IPv4 address and 4 bytes of 0s.
.IP "\fBcluster_hb_timeout\fR (int)" 4
.IX Item "cluster_hb_timeout (int)"
Cluster heartbeat timeout in tenths of a second. A new master will be elected when this interval has been passed without seeing a heartbeat from the master.
.IP "\fBcluster_master_min_adv\fR (int)" 4
.IX Item "cluster_master_min_adv (int)"
Determines the minumum number of up to date slaves required before the master will drop routes (default: 1).
.IP "\fBdebug\fR (int)" 4
.IX Item "debug (int)"
Set the level of debugging messages written to the log file. The value should
be between 0 and 5, with 0 being no debugging, and 5 being the highest.
A rough description of the levels is:
.RS 4
.IP "0. Critical Errors \- Things are probably broken" 4
.IX Item "0. Critical Errors - Things are probably broken"
.PD 0
.IP "1. Errors \- Things might have gone wrong, but probably will recover" 4
.IX Item "1. Errors - Things might have gone wrong, but probably will recover"
.IP "2. Warnings \- Just in case you care what is not quite perfect" 4
.IX Item "2. Warnings - Just in case you care what is not quite perfect"
.IP "3. Information \- Parameters of control packets" 4
.IX Item "3. Information - Parameters of control packets"
.IP "4. Calls \- For tracing the execution of the code" 4
.IX Item "4. Calls - For tracing the execution of the code"
.IP "5. Packets \- Everything, including a hex dump of all packets processed... probably twice" 4
.IX Item "5. Packets - Everything, including a hex dump of all packets processed... probably twice"
.RE
.SS BGP ROUTING
.RS 4
.PD
.Sp
Note that the higher you set the debugging level, the slower the program will run. Also, at level 5 a \s-1LOT\s0 of information will be logged. This should only ever be used for working out why it doesn't work at all.
.RE
.IP "\fBdump_speed\fR (boolean)" 4
.IX Item "dump_speed (boolean)"
If set to true, then the current bandwidth utilization will be logged every second. Even if this is disabled, you can see this information by running the uptime command on the \s-1CLI\s0.
.IP "\fBdisable_sending_hello\fR (boolean)" 4
.IX Item "disable_sending_hello (boolean)"
Disable l2tp sending \s-1HELLO\s0 message for Apple compatibility. Some \s-1OS\s0 X implementation of l2tp no manage the L2TP \*(L"\s-1HELLO\s0 message\*(R". (default: no).
.IP "\fBecho_timeout\fR (int)" 4
.IX Item "echo_timeout (int)"
Time between last packet sent and \s-1LCP\s0 \s-1ECHO\s0 generation (default: 10 (seconds)).
.IP "\fBguest_account\fR" 4
.IX Item "guest_account"
Allow multiple logins matching this specific username.
.IP "\fBicmp_rate\fR (int)" 4
.IX Item "icmp_rate (int)"
Maximum number of host unreachable \s-1ICMP\s0 packets to send per second.
.IP "\fBidle_echo_timeout\fR (int)" 4
.IX Item "idle_echo_timeout (int)"
Drop sessions who have not responded within idle_echo_timeout seconds (default: 240 (seconds))
.IP "\fBiftun_address\fR (ip address)" 4
.IX Item "iftun_address (ip address)"
This parameter is used when you want a tun interface address different from the address of \*(L"bind_address\*(R" (For use in cases of specific configuration). If no address is given to iftun_address and bind_address, 1.1.1.1 is used.
.IP "\fBl2tp_mtu\fR (int)" 4
.IX Item "l2tp_mtu (int)"
\&\s-1MTU\s0 of interface for L2TP traffic (default: 1500). Used to set link \s-1MRU\s0 and adjust \s-1TCP\s0 \s-1MSS\s0.
.IP "\fBl2tp_secret\fR (string)" 4
.IX Item "l2tp_secret (string)"
The secret used by l2tpns for authenticating tunnel request. Must be the same as the \s-1LAC\s0, or authentication will fail. Only actually be used if the \s-1LAC\s0 requests authentication.
.IP "\fBlock_pages\fR (boolean)" 4
.IX Item "lock_pages (boolean)"
Keep all pages mapped by the l2tpns process in memory.
.IP "\fBlog_file\fR (string)" 4
.IX Item "log_file (string)"
This will be where all logging and debugging information is written to.This may be either a filename, such as /var/log/l2tpns, or the string syslog:facility, where facility is any one of the syslog logging facilities, such as local5.
.IP "\fBmulti_read_count\fR (int)" 4
.IX Item "multi_read_count (int)"
Number of packets to read off each of the \s-1UDP\s0 and \s-1TUN\s0 fds when returned as readable by select (default: 10). Avoids incurring the unnecessary system call overhead of select on busy servers.
.IP "\fBpacket_limit\fR (int>" 4
.IX Item "packet_limit (int>"
Maximum number of packets of downstream traffic to be handled each tenth of a second per session. If zero, no limit is applied (default: 0). Intended as a DoS prevention mechanism and not a general throttling control (packets are dropped, not queued).
.IP "\fBpeer_address\fR (ip address)" 4
.IX Item "peer_address (ip address)"
Address to send to clients as the default gateway.
.IP "\fBpid_file\fR (string)" 4
.IX Item "pid_file (string)"
If set, the process id will be written to the specified file. The value must be an absolute path.
.IP "\fBppp_restart_time\fR (int)" 4
.IX Item "ppp_restart_time (int)"
.PD 0
.IP "\fBppp_max_configure\fR (int)" 4
.IX Item "ppp_max_configure (int)"
.IP "\fBppp_max_failure\fR (int)" 4
.IX Item "ppp_max_failure (int)"
.PD
\&\s-1PPP\s0 counter and timer values, as described in Section 4.1 of \s-1RFC1661\s0.
.Sp
\&\fIppp_restart_time\fR, Restart timer for \s-1PPP\s0 protocol negotiation in seconds (default: 3).
.Sp
\&\fIppp_max_configure\fR, Number of configure requests to send before giving up (default: 10).
.Sp
\&\fIppp_max_failure\fR, Number of Configure-Nak requests to send before sending a Configure-Reject (default: 5).
.IP "\fBprimary_dns\fR (ip address), \fBsecondary_dns\fR (ip address)" 4
.IX Item "primary_dns (ip address), secondary_dns (ip address)"
Whenever a \s-1PPP\s0 connection is established, \s-1DNS\s0 servers will be sent to the user, both a primary and a secondary. If either is set to 0.0.0.0, then that one will not be sent.
.IP "\fBprimary_radius\fR (ip address), \fBsecondary_radius\fR (ip address)" 4
.IX Item "primary_radius (ip address), secondary_radius (ip address)"
Sets the \s-1RADIUS\s0 servers used for both authentication and accounting. If the primary server does not respond, then the secondary \s-1RADIUS\s0 server will be tried.
.Sp
Note: in addition to the source \s-1IP\s0 address and identifier, the \s-1RADIUS\s0 server must include the source port when detecting duplicates to supress (in order to cope with a large number of sessions comming on-line simultaneously l2tpns uses a set of udp sockets, each with a seperate identifier).
.IP "\fBprimary_radius_port\fR (short), \fBsecondary_radius_port\fR (short)" 4
.IX Item "primary_radius_port (short), secondary_radius_port (short)"
Sets the authentication ports for the primary and secondary \s-1RADIUS\s0 servers. The accounting port is one more than the authentication port. If no \s-1RADIUS\s0 ports are given, the authentication port defaults to 1645, and the accounting port to 1646.
.IP "\fBradius_accounting\fR (boolean)" 4
.IX Item "radius_accounting (boolean)"
If set to true, then \s-1RADIUS\s0 accounting packets will be sent. This means that a \fBStart\fR record will be sent when the session is successfully authenticated, and a \fBStop\fR record will be sent when the session is closed.
.IP "\fBradius_interim\fR (int)" 4
.IX Item "radius_interim (int)"
If radius_accounting is on, defines the interval between sending of \s-1RADIUS\s0 interim accounting records (in seconds).
.IP "\fBradius_secret\fR (string)" 4
.IX Item "radius_secret (string)"
This secret will be used in all \s-1RADIUS\s0 queries. If this is not set then \s-1RADIUS\s0 queries will fail.
.IP "\fBradius_authtypes\fR (string)" 4
.IX Item "radius_authtypes (string)"
A comma separated list of supported \s-1RADIUS\s0 authentication methods (\*(L"pap\*(R" or \*(L"chap\*(R"), in order of preference (default \*(L"pap\*(R").
.IP "\fBradius_dae_port\fR (short)" 4
.IX Item "radius_dae_port (short)"
Port for \s-1DAE\s0 \s-1RADIUS\s0 (Packet of Death/Disconnect, Change of Authorization) requests (default: 3799).
.IP "\fBradius_bind_min\fR, \fBradius_bind_max\fR (int)" 4
.IX Item "radius_bind_min, radius_bind_max (int)"
Define a port range in which to bind sockets used to send and receive \s-1RADIUS\s0 packets. Must be at least \s-1RADIUS_FDS\s0 (64) wide. Simplifies firewalling of \s-1RADIUS\s0 ports (default: dynamically assigned).
.IP "\fBrandom_device\fR (string)" 4
.IX Item "random_device (string)"
Path to random data source (default /dev/urandom). Use "" to use the \fIrand()\fR library function.
.IP "\fBscheduler_fifo\fR (boolean)" 4
.IX Item "scheduler_fifo (boolean)"
Sets the scheduling policy for the l2tpns process to \s-1SCHED_FIFO\s0. This causes the kernel to immediately preempt any currently running \s-1SCHED_OTHER\s0 (normal) process in favour of l2tpns when it becomes runnable. Ignored on uniprocessor systems.
.IP "\fBsend_garp\fR (boolean)" 4
.IX Item "send_garp (boolean)"
Determines whether or not to send a gratuitous \s-1ARP\s0 for the bind_address when the server is ready to handle traffic (default: true). This value is ignored if \s-1BGP\s0 is configured.
.IP "\fBtundevicename\fR (string)" 4
.IX Item "tundevicename (string)"
Name of the tun interface (default: \*(L"tun0\*(R").
.IP "\fBthrottle_speed\fR (int)" 4
.IX Item "throttle_speed (int)"
Sets the default speed (in kbits/s) which sessions will be limited to. If this is set to 0, then throttling will not be used at all. Note: You can set this by the \s-1CLI\s0, but changes will not affect currently connected users.
.IP "\fBthrottle_buckets\fR (int)" 4
.IX Item "throttle_buckets (int)"
Number of token buckets to allocate for throttling. Each throttled session requires two buckets (in and out).
.SS "DHCPv6 And IPv6 \s-1SETTINGS\s0"
.IX Subsection "DHCPv6 And IPv6 SETTINGS"
.IP "\fBdhcp6_preferred_lifetime\fR (int)" 4
.IX Item "dhcp6_preferred_lifetime (int)"
The preferred lifetime for the IPv6 address and the IPv6 prefix address, expressed in units of seconds (see rfc3315).
.IP "\fBdhcp6_valid_lifetime\fR (int)" 4
.IX Item "dhcp6_valid_lifetime (int)"
The valid lifetime for the IPv6 address and the IPv6 prefix address, expressed in units of seconds (see rfc3315).
.IP "\fBdhcp6_server_duid\fR (int)" 4
.IX Item "dhcp6_server_duid (int)"
\&\s-1DUID\s0 Based on Link-layer Address (DUID-LL) (see rfc3315).
.IP "\fBprimary_ipv6_dns\fR, \fBsecondary_ipv6_dns\fR (Ipv6 address)" 4
.IX Item "primary_ipv6_dns, secondary_ipv6_dns (Ipv6 address)"
IPv6 \s-1DNS\s0 servers will be sent to the user (see rfc3646).
.IP "\fBdefault_ipv6_domain_list\fR (string)" 4
.IX Item "default_ipv6_domain_list (string)"
The Domain Search List (ex: \*(L"fdn.fr\*(R") (see rfc3646).
.IP "\fBipv6_prefix\fR (Ipv6 address)" 4
.IX Item "ipv6_prefix (Ipv6 address)"
Enable negotiation of IPv6. This forms the the first 64 bits of the client allocated address. The remaining 64 come from the allocated IPv4 address and 4 bytes of 0.
.SS "\s-1LAC\s0 \s-1SETTINGS\s0"
.IX Subsection "LAC SETTINGS"
.IP "\fBbind_address_remotelns\fR (ip address)" 4
.IX Item "bind_address_remotelns (ip address)"
Address of the interface to listen the remote \s-1LNS\s0 tunnels. If no address is given, all interfaces are listened (Any Address).
.IP "\fBbind_portremotelns\fR (short)" 4
.IX Item "bind_portremotelns (short)"
Port to bind for the Remote \s-1LNS\s0 (default: 65432).
.PP
A static \s-1REMOTES\s0 \s-1LNS\s0 configuration can be entered by the command:
.IP "\fBsetforward\fR \fI\s-1MASK\s0\fR \fI\s-1IP\s0\fR \fI\s-1PORT\s0\fR \fI\s-1SECRET\s0\fR" 4
.IX Item "setforward MASK IP PORT SECRET"
where \s-1MASK\s0 specifies the mask of users who have forwarded to remote \s-1LNS\s0 (ex: \*(L"/friendISP@company.com\*(R").
.Sp
where \s-1IP\s0 specifies the \s-1IP\s0 of the remote \s-1LNS\s0 (ex: \*(L"66.66.66.55\*(R").
.Sp
where \s-1PORT\s0 specifies the L2TP Port of the remote \s-1LNS\s0 (Normally should be 1701) (ex: 1701).
.Sp
where \s-1SECRET\s0 specifies the secret password the remote \s-1LNS\s0 (ex: mysecret).
.PP
The static \s-1REMOTE\s0 \s-1LNS\s0 configuration can be used when the friend \s-1ISP\s0 not have a proxied Radius.
.PP
If a proxied Radius is used, It will return the \s-1RADIUS\s0 attributes:
.IP "Tunnel\-Type:1 = L2TP" 4
.IX Item "Tunnel-Type:1 = L2TP"
.PD 0
.IP "Tunnel\-Medium\-Type:1 = IPv4" 4
.IX Item "Tunnel-Medium-Type:1 = IPv4"
.ie n .IP "Tunnel\-Password:1 = ""\s-1LESECRETL2TP\s0""" 4
.el .IP "Tunnel\-Password:1 = ``\s-1LESECRETL2TP\s0''" 4
.IX Item "Tunnel-Password:1 = LESECRETL2TP"
.ie n .IP "Tunnel\-Server\-Endpoint:1 = ""88.xx.xx.x1""" 4
.el .IP "Tunnel\-Server\-Endpoint:1 = ``88.xx.xx.x1''" 4
.IX Item "Tunnel-Server-Endpoint:1 = 88.xx.xx.x1"
.ie n .IP "Tunnel\-Assignment\-Id:1 = ""friendisp_lns1""" 4
.el .IP "Tunnel\-Assignment\-Id:1 = ``friendisp_lns1''" 4
.IX Item "Tunnel-Assignment-Id:1 = friendisp_lns1"
.IP "Tunnel\-Type:2 += L2TP" 4
.IX Item "Tunnel-Type:2 += L2TP"
.IP "Tunnel\-Medium\-Type:2 += IPv4" 4
.IX Item "Tunnel-Medium-Type:2 += IPv4"
.ie n .IP "Tunnel\-Password:2 += ""\s-1LESECRETL2TP\s0""" 4
.el .IP "Tunnel\-Password:2 += ``\s-1LESECRETL2TP\s0''" 4
.IX Item "Tunnel-Password:2 += LESECRETL2TP"
.ie n .IP "Tunnel\-Server\-Endpoint:2 += ""88.xx.xx.x2""" 4
.el .IP "Tunnel\-Server\-Endpoint:2 += ``88.xx.xx.x2''" 4
.IX Item "Tunnel-Server-Endpoint:2 += 88.xx.xx.x2"
.ie n .IP "Tunnel\-Assignment\-Id:2 += ""friendisp_lns2""" 4
.el .IP "Tunnel\-Assignment\-Id:2 += ``friendisp_lns2''" 4
.IX Item "Tunnel-Assignment-Id:2 += friendisp_lns2"
.PD
.SS "\s-1PPPOE\s0 \s-1SETTINGS\s0"
.IX Subsection "PPPOE SETTINGS"
.IP "\fBpppoe_if_to_bind\fR (string)" 4
.IX Item "pppoe_if_to_bind (string)"
\&\s-1PPPOE\s0 server interface to bind (ex: \*(L"eth0.12\*(R"), If not specified the server \s-1PPPOE\s0 is not enabled. For the pppoe clustering, all the interfaces \s-1PPPOE\s0 of the clusters must use the same \s-1HW\s0 address (\s-1MAC\s0 address).
.IP "\fBpppoe_service_name\fR (string)" 4
.IX Item "pppoe_service_name (string)"
\&\s-1PPPOE\s0 service name (default: \s-1NULL\s0).
.IP "\fBpppoe_ac_name\fR (string)" 4
.IX Item "pppoe_ac_name (string)"
\&\s-1PPPOE\s0 access concentrator name (default: \*(L"l2tpns\-pppoe\*(R").
.IP "\fBpppoe_only_equal_svc_name\fR (boolean)" 4
.IX Item "pppoe_only_equal_svc_name (boolean)"
If set to yes, the \s-1PPPOE\s0 server only accepts clients with a \*(L"service-name\*(R" different from \s-1NULL\s0 and a \*(L"service-name\*(R" equal to server \*(L"service-name\*(R" (default: no).
.SS "\s-1BGP\s0 \s-1ROUTING\s0"
.IX Subsection "BGP ROUTING"
The routing configuration section is entered by the command
.IP
.BI "router bgp " as
.PP
where
.I as
specifies the local AS number.
\&\fBrouter\fR \fBbgp\fR \fIas\fR
.PP
Subsequent lines prefixed with
.BI "neighbour " peer
define the attributes of BGP neighhbours. Valid commands are:
.IP
.BI "neighbour " peer " remote-as " as
.br
.BI "neighbour " peer " timers " "keepalive hold"
where \fIas\fR specifies the local \s-1AS\s0 number.
.PP
Where
.I peer
specifies the BGP neighbour as either a hostname or IP address,
.I as
is the remote AS number and
.IR keepalive ,
.I hold
are the timer values in seconds.
.SS NAMED ACCESS LISTS
Subsequent lines prefixed with \fBneighbour\fR \fIpeer\fR define the attributes of \s-1BGP\s0 neighhbours. Valid commands are:
.PP
\&\fBneighbour\fR \fIpeer\fR \fBremote-as\fR \fIas\fR
.PP
\&\fBneighbour\fR \fIpeer\fR \fBtimers\fR \fIkeepalive\fR \fIhold\fR
.PP
Where \fIpeer\fR specifies the \s-1BGP\s0 neighbour as either a hostname or \s-1IP\s0 address, \fIas\fR is the remote \s-1AS\s0 number and \fIkeepalive\fR, \fIhold\fR are the timer values in seconds.
.SS "\s-1NAMED\s0 \s-1ACCESS\s0 \s-1LISTS\s0"
.IX Subsection "NAMED ACCESS LISTS"
Named access lists may be defined with either of
.IP
.BI "ip access\-list standard " name
.br
.BI "ip access\-list extended " name
.IP "\(bu" 4
\&\fBip\fR \fBaccess-list\fR \fBstandard\fR \fIname\fR
.IP "\(bu" 4
\&\fBip\fR \fBaccess-list\fR \fBextended\fR \fIname\fR
.PP
Subsequent lines starting with
.B permit
or
.B deny
define the body of the access\-list.
Subsequent lines starting with permit or deny define the body of the access-list.
.PP
\fIStandard Access Lists\fR
.IX Subsection "Standard Access Lists"
.PP
.B Standard Access Lists
.RS 4n
Standard access lists are defined with:
.IP
.RB { permit | deny }
.IR source " [" dest ]
.IP "\(bu" 4
{\fBpermit\fR|\fBdeny\fR} \fIsource\fR [\fIdest\fR]
.PP
Where
.I source
and
.I dest
specify IP matches using one of:
.IP
.I address
.I wildard
.br
.B host
.I address
.br
.B any
Where \fIsource\fR and \fIdest\fR specify \s-1IP\s0 matches using one of:
.IP "\(bu" 4
\&\fIaddress\fR \fIwildard\fR
.IP "\(bu" 4
\&\fBhost\fR \fIaddress\fR
.IP "\(bu" 4
\&\fBany\fR
.PP
.I address
and
.I wildard
are in dotted-quad notation, bits in the
.I wildard
indicate which address bits in
.I address
are relevant to the match (0 = exact match; 1 = don't care).
\&\fIaddress\fR and \fIwildard\fR are in dotted-quad notation, bits in the \fIwildard\fR indicate which address bits in \fIaddress\fR are relevant to the match (0 = exact match; 1 = don't care).
.PP
The shorthand
.RB ' host
.IR address '
is equivalent to
.RI ' address
.BR 0.0.0.0 ';
.RB ' any '
to
.RB ' 0.0.0.0
.BR 255.255.255.255 '.
.RE
The shorthand 'host address' is equivalent to '\fIaddress\fR \fB0.0.0.0\fR'; '\fBany\fR' to '\fB0.0.0.0\fR \fB255.255.255.255\fR'.
.PP
\fIExtended Access Lists\fR
.IX Subsection "Extended Access Lists"
.PP
.B Extended Access Lists
.RS 4n
Extended access lists are defined with:
.IP
.RB { permit | deny }
.I proto
.IR source " [" ports "] " dest " [" ports "] [" flags ]
.IP "\(bu" 4
{\fBpermit\fR|\fBdeny\fR} \fIproto\fR \fIsource\fR [\fIports\fR] \fIdest\fR [\fIports\fR] [\fIflags\fR]
.PP
Where
.I proto
is one of
.BR ip ,
.B tcp
or
.BR udp ,
and
.I source
and
.I dest
are as described above for standard lists.
Where \fIproto\fR is one of \fBip\fR, \fBtcp\fR or \fBudp\fR, and \fIsource\fR and \fIdest\fR are as described above for standard lists.
.PP
For TCP and UDP matches, source and destination may be optionally
followed by a
.I ports
specification:
.IP
.RB { eq | neq | gt | lt }
.I port
.br
.B
range
.I from to
For \s-1TCP\s0 and \s-1UDP\s0 matches, source and destination may be optionally followed by a ports specification:
.IP "\(bu" 4
{\fBeq|neq|gt|lt\fR} \fIport\fR
.IP "\(bu" 4
\&\fBrange\fR \fIfrom\fR \fIto\fR
.PP
.I flags
may be one of:
.RS
.HP
.RB { match\-any | match\-all }
.RB { + | - }{ fin | syn | rst | psh | ack | urg }
\&...
.br
Match packets with any or all of the tcp flags set
.RB ( + )
or clear
.RB ( - ).
.HP
.B established
.br
Match "established" TCP connections: packets with
.B RST
or
.B ACK
set, and
.B SYN
clear.
.HP
.B fragments
.br
Match IP fragments. May not be specified on rules with layer 4
matches.
.RE
.SH SEE ALSO
.BR l2tpns (8)
\&\fIflags\fR may be one of:
.IP "{\fBmatch\-any|match\-all\fR} {\fB+|\-\fR}{\fBfin|syn|rst|psh|ack|urg\fR} ..." 4
.IX Item "{match-any|match-all} {+|-}{fin|syn|rst|psh|ack|urg} ..."
Match packets with any or all of the tcp flags set (+) or clear (\-).
.IP "\fBestablished\fR" 4
.IX Item "established"
Match \*(L"established\*(R" \s-1TCP\s0 connections: packets with \s-1RST\s0 or \s-1ACK\s0 set, and \s-1SYN\s0 clear.
.IP "\fBfragments\fR" 4
.IX Item "fragments"
Match \s-1IP\s0 fragments. May not be specified on rules with layer 4 matches.
.SH "SEE ALSO"
.IX Header "SEE ALSO"
\&\fIl2tpns\fR\|(8)

493
Docs/startup-config.5.pod Normal file
View file

@ -0,0 +1,493 @@
=pod
=head1 NAME
startup-config - configuration file for l2tpns
=head1 SYNOPSIS
/etc/l2tpns/startup-config
=head1 DESCRIPTION
B<startup-config> is the configuration file for B<l2tpns>
The format is plain text, in the same format as accepted by
the configuration mode of l2tpns's telnet administrative
interface. Comments are indicated by either the character # or !.
=head2 SETTINGS
Settings are specified with
=over
=item B<set> F<variable> F<value>
=back
A list of the possible configuration directives follows. Each of these should be set by a line like:
=over
=item B<set> I<configstring> I<"value">
=item B<set> I<ipaddress> I<192.168.1.1>
=item B<set> I<boolean> I<true>
=back
The following F<variables> may be set:
=over
=item B<accounting_dir> (string)
If set to a directory, then every 5 minutes the current usage for every connected use will be dumped to a file in this directory. Each file dumped begins with a header, where each line is prefixed by #. Following the header is a single line for every connected user, fields separated by a space.
The fields are username, ip, qos, uptxoctets, downrxoctets, origin (optional). The qos field is 1 if a standard user, and 2 if the user is throttled. The origin field is dump if B<account_all_origin> is set to true (origin value: L=LAC data, R=Remote LNS data, P=PPPOE data).
=item B<account_all_origin> (boolean)
If set to true, all origin of the usage is dumped to the accounting file (LAC+Remote LNS+PPPOE)(default false).
=item B<allow_duplicate_users> (boolean)
Allow multiple logins with the same username. If false (the default), any prior session with the same username will be dropped when a new session is established.
=item B<auth_tunnel_change_addr_src> (boolean)
This parameter authorize to change the source IP of the tunnels l2tp. This parameter can be used when the remotes BAS/LAC are l2tpns server configured in cluster mode, but that the interface to remote LNS are not clustered (the tunnel can be coming from different source IP) (default: no).
=item B<bind_address> (ip address)
It's the listen address of the l2tp udp protocol sent and received to LAC. This address is also assigned to the tun interface if no iftun_address is specified. Packets containing user traffic should be routed via this address if given, otherwise the primary address of the machine.
=item B<bind_multi_address> (ip address)
This parameter permit to listen several addresss of the l2tp udp protocol (and set several address to the tun interface).
WHEN this parameter is set, It OVERWRITE the parameters "bind_address" and "iftun_address".
these can be interesting when you want do load-balancing in cluster mode of the uploaded from the LAC. For example you can set a bgp.prepend(MY_AS) for Address1 on LNS1 and a bgp.prepend(MY_AS) for Address2 on LNS2 (see BGP AS-path prepending).
example of use with 2 address:
B<set> I<bind_multi_address> "64.14.13.41, 64.14.13.42"
=item B<cluster_address> (ip address)
Multicast cluster address (default: 239.192.13.13). See the section on Clustering for more information.
=item B<cluster_interface> (string)
Interface for cluster packets (default: eth0).
=item B<cluster_mcast_ttl> (int)
TTL for multicast packets (default: 1).
=item B<cluster_hb_interval> (int)
Interval in tenths of a second between cluster heartbeat/pings.
=item B<cluster_hb_timeout> (int)
Cluster heartbeat timeout in tenths of a second. A new master will be elected when this interval has been passed without seeing a heartbeat from the master.
=item B<cluster_master_min_adv> (int)
Determines the minumum number of up to date slaves required before the master will drop routes (default: 1).
=item B<debug> (int)
Set the level of debugging messages written to the log file. The value should
be between 0 and 5, with 0 being no debugging, and 5 being the highest.
A rough description of the levels is:
=over
=item 0. Critical Errors - Things are probably broken
=item 1. Errors - Things might have gone wrong, but probably will recover
=item 2. Warnings - Just in case you care what is not quite perfect
=item 3. Information - Parameters of control packets
=item 4. Calls - For tracing the execution of the code
=item 5. Packets - Everything, including a hex dump of all packets processed... probably twice
=back
Note that the higher you set the debugging level, the slower the program will run. Also, at level 5 a LOT of information will be logged. This should only ever be used for working out why it doesn't work at all.
=item B<dump_speed> (boolean)
If set to true, then the current bandwidth utilization will be logged every second. Even if this is disabled, you can see this information by running the uptime command on the CLI.
=item B<disable_sending_hello> (boolean)
Disable l2tp sending HELLO message for Apple compatibility. Some OS X implementation of l2tp no manage the L2TP "HELLO message". (default: no).
=item B<echo_timeout> (int)
Time between last packet sent and LCP ECHO generation (default: 10 (seconds)).
=item B<guest_account>
Allow multiple logins matching this specific username.
=item B<icmp_rate> (int)
Maximum number of host unreachable ICMP packets to send per second.
=item B<idle_echo_timeout> (int)
Drop sessions who have not responded within idle_echo_timeout seconds (default: 240 (seconds))
=item B<iftun_address> (ip address)
This parameter is used when you want a tun interface address different from the address of "bind_address" (For use in cases of specific configuration). If no address is given to iftun_address and bind_address, 1.1.1.1 is used.
=item B<l2tp_mtu> (int)
MTU of interface for L2TP traffic (default: 1500). Used to set link MRU and adjust TCP MSS.
=item B<l2tp_secret> (string)
The secret used by l2tpns for authenticating tunnel request. Must be the same as the LAC, or authentication will fail. Only actually be used if the LAC requests authentication.
=item B<lock_pages> (boolean)
Keep all pages mapped by the l2tpns process in memory.
=item B<log_file> (string)
This will be where all logging and debugging information is written to.This may be either a filename, such as /var/log/l2tpns, or the string syslog:facility, where facility is any one of the syslog logging facilities, such as local5.
=item B<multi_read_count> (int)
Number of packets to read off each of the UDP and TUN fds when returned as readable by select (default: 10). Avoids incurring the unnecessary system call overhead of select on busy servers.
=item B<packet_limit> (int>
Maximum number of packets of downstream traffic to be handled each tenth of a second per session. If zero, no limit is applied (default: 0). Intended as a DoS prevention mechanism and not a general throttling control (packets are dropped, not queued).
=item B<peer_address> (ip address)
Address to send to clients as the default gateway.
=item B<pid_file> (string)
If set, the process id will be written to the specified file. The value must be an absolute path.
=item B<ppp_restart_time> (int)
=item B<ppp_max_configure> (int)
=item B<ppp_max_failure> (int)
PPP counter and timer values, as described in Section 4.1 of RFC1661.
I<ppp_restart_time>, Restart timer for PPP protocol negotiation in seconds (default: 3).
I<ppp_max_configure>, Number of configure requests to send before giving up (default: 10).
I<ppp_max_failure>, Number of Configure-Nak requests to send before sending a Configure-Reject (default: 5).
=item B<primary_dns> (ip address), B<secondary_dns> (ip address)
Whenever a PPP connection is established, DNS servers will be sent to the user, both a primary and a secondary. If either is set to 0.0.0.0, then that one will not be sent.
=item B<primary_radius> (ip address), B<secondary_radius> (ip address)
Sets the RADIUS servers used for both authentication and accounting. If the primary server does not respond, then the secondary RADIUS server will be tried.
Note: in addition to the source IP address and identifier, the RADIUS server must include the source port when detecting duplicates to supress (in order to cope with a large number of sessions comming on-line simultaneously l2tpns uses a set of udp sockets, each with a seperate identifier).
=item B<primary_radius_port> (short), B<secondary_radius_port> (short)
Sets the authentication ports for the primary and secondary RADIUS servers. The accounting port is one more than the authentication port. If no RADIUS ports are given, the authentication port defaults to 1645, and the accounting port to 1646.
=item B<radius_accounting> (boolean)
If set to true, then RADIUS accounting packets will be sent. This means that a B<Start> record will be sent when the session is successfully authenticated, and a B<Stop> record will be sent when the session is closed.
=item B<radius_interim> (int)
If radius_accounting is on, defines the interval between sending of RADIUS interim accounting records (in seconds).
=item B<radius_secret> (string)
This secret will be used in all RADIUS queries. If this is not set then RADIUS queries will fail.
=item B<radius_authtypes> (string)
A comma separated list of supported RADIUS authentication methods ("pap" or "chap"), in order of preference (default "pap").
=item B<radius_dae_port> (short)
Port for DAE RADIUS (Packet of Death/Disconnect, Change of Authorization) requests (default: 3799).
=item B<radius_bind_min>, B<radius_bind_max> (int)
Define a port range in which to bind sockets used to send and receive RADIUS packets. Must be at least RADIUS_FDS (64) wide. Simplifies firewalling of RADIUS ports (default: dynamically assigned).
=item B<random_device> (string)
Path to random data source (default /dev/urandom). Use "" to use the rand() library function.
=item B<scheduler_fifo> (boolean)
Sets the scheduling policy for the l2tpns process to SCHED_FIFO. This causes the kernel to immediately preempt any currently running SCHED_OTHER (normal) process in favour of l2tpns when it becomes runnable. Ignored on uniprocessor systems.
=item B<send_garp> (boolean)
Determines whether or not to send a gratuitous ARP for the bind_address when the server is ready to handle traffic (default: true). This value is ignored if BGP is configured.
=item B<tundevicename> (string)
Name of the tun interface (default: "tun0").
=item B<throttle_speed> (int)
Sets the default speed (in kbits/s) which sessions will be limited to. If this is set to 0, then throttling will not be used at all. Note: You can set this by the CLI, but changes will not affect currently connected users.
=item B<throttle_buckets> (int)
Number of token buckets to allocate for throttling. Each throttled session requires two buckets (in and out).
=back
=head2 DHCPv6 And IPv6 SETTINGS
=over
=item B<dhcp6_preferred_lifetime> (int)
The preferred lifetime for the IPv6 address and the IPv6 prefix address, expressed in units of seconds (see rfc3315).
=item B<dhcp6_valid_lifetime> (int)
The valid lifetime for the IPv6 address and the IPv6 prefix address, expressed in units of seconds (see rfc3315).
=item B<dhcp6_server_duid> (int)
DUID Based on Link-layer Address (DUID-LL) (see rfc3315).
=item B<primary_ipv6_dns>, B<secondary_ipv6_dns> (Ipv6 address)
IPv6 DNS servers will be sent to the user (see rfc3646).
=item B<default_ipv6_domain_list> (string)
The Domain Search List (ex: "fdn.fr") (see rfc3646).
=item B<ipv6_prefix> (Ipv6 address)
Enable negotiation of IPv6. This forms the the first 64 bits of the client allocated address. The remaining 64 come from the allocated IPv4 address and 4 bytes of 0.
=back
=head2 LAC SETTINGS
=over
=item B<bind_address_remotelns> (ip address)
Address of the interface to listen the remote LNS tunnels. If no address is given, all interfaces are listened (Any Address).
=item B<bind_portremotelns> (short)
Port to bind for the Remote LNS (default: 65432).
=back
A static REMOTES LNS configuration can be entered by the command:
=over
=item B<setforward> I<MASK> I<IP> I<PORT> I<SECRET>
where MASK specifies the mask of users who have forwarded to remote LNS (ex: "/friendISP@company.com").
where IP specifies the IP of the remote LNS (ex: "66.66.66.55").
where PORT specifies the L2TP Port of the remote LNS (Normally should be 1701) (ex: 1701).
where SECRET specifies the secret password the remote LNS (ex: mysecret).
=back
The static REMOTE LNS configuration can be used when the friend ISP not have a proxied Radius.
If a proxied Radius is used, It will return the RADIUS attributes:
=over
=item Tunnel-Type:1 = L2TP
=item Tunnel-Medium-Type:1 = IPv4
=item Tunnel-Password:1 = "LESECRETL2TP"
=item Tunnel-Server-Endpoint:1 = "88.xx.xx.x1"
=item Tunnel-Assignment-Id:1 = "friendisp_lns1"
=item Tunnel-Type:2 += L2TP
=item Tunnel-Medium-Type:2 += IPv4
=item Tunnel-Password:2 += "LESECRETL2TP"
=item Tunnel-Server-Endpoint:2 += "88.xx.xx.x2"
=item Tunnel-Assignment-Id:2 += "friendisp_lns2"
=back
=head2 PPPOE SETTINGS
=over
=item B<pppoe_if_to_bind> (string)
PPPOE server interface to bind (ex: "eth0.12"), If not specified the server PPPOE is not enabled. For the pppoe clustering, all the interfaces PPPOE of the clusters must use the same HW address (MAC address).
=item B<pppoe_service_name> (string)
PPPOE service name (default: NULL).
=item B<pppoe_ac_name> (string)
PPPOE access concentrator name (default: "l2tpns-pppoe").
=item B<pppoe_only_equal_svc_name> (boolean)
If set to yes, the PPPOE server only accepts clients with a "service-name" different from NULL and a "service-name" equal to server "service-name" (default: no).
=back
=head2 BGP ROUTING
The routing configuration section is entered by the command
B<router> B<bgp> I<as>
where I<as> specifies the local AS number.
Subsequent lines prefixed with B<neighbour> I<peer> define the attributes of BGP neighhbours. Valid commands are:
B<neighbour> I<peer> B<remote-as> I<as>
B<neighbour> I<peer> B<timers> I<keepalive> I<hold>
Where I<peer> specifies the BGP neighbour as either a hostname or IP address, I<as> is the remote AS number and I<keepalive>, I<hold> are the timer values in seconds.
=head2 NAMED ACCESS LISTS
Named access lists may be defined with either of
=over
=item
B<ip> B<access-list> B<standard> I<name>
=item
B<ip> B<access-list> B<extended> I<name>
=back
Subsequent lines starting with permit or deny define the body of the access-list.
=head3 Standard Access Lists
Standard access lists are defined with:
=over
=item
{B<permit>|B<deny>} I<source> [I<dest>]
=back
Where I<source> and I<dest> specify IP matches using one of:
=over
=item
I<address> I<wildard>
=item
B<host> I<address>
=item
B<any>
=back
I<address> and I<wildard> are in dotted-quad notation, bits in the I<wildard> indicate which address bits in I<address> are relevant to the match (0 = exact match; 1 = don't care).
The shorthand 'host address' is equivalent to 'I<address> B<0.0.0.0>'; 'B<any>' to 'B<0.0.0.0> B<255.255.255.255>'.
=head3 Extended Access Lists
Extended access lists are defined with:
=over
=item
{B<permit>|B<deny>} I<proto> I<source> [I<ports>] I<dest> [I<ports>] [I<flags>]
=back
Where I<proto> is one of B<ip>, B<tcp> or B<udp>, and I<source> and I<dest> are as described above for standard lists.
For TCP and UDP matches, source and destination may be optionally followed by a ports specification:
=over
=item
{B<eq|neq|gt|lt>} I<port>
=item
B<range> I<from> I<to>
=back
I<flags> may be one of:
=over
=item {B<match-any|match-all>} {B<+|->}{B<fin|syn|rst|psh|ack|urg>} ...
Match packets with any or all of the tcp flags set (+) or clear (-).
=item B<established>
Match "established" TCP connections: packets with RST or ACK set, and SYN clear.
=item B<fragments>
Match IP fragments. May not be specified on rules with layer 4 matches.
=back
=head1 SEE ALSO
L<l2tpns(8)>
=cut