welterde/l2tpns
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Clean source manpages

Browse source
This commit is contained in:
Julien Rabier 2021-02-05 12:18:30 +01:00
parent a8dc396099
commit f261d4fffe
6 changed files with 559 additions and 673 deletions
Download patch file Download diff file Expand all files Collapse all files

206
docs/manpages/l2tpns.8
View file

@ -21,160 +21,138 @@ Once running, \f[B]l2tpns\f[R] may be controlled by telnetting to port
23 on the machine running the daemon and with the \f[B]nsctl\f[R] 23 on the machine running the daemon and with the \f[B]nsctl\f[R]
utility. utility.
.SH OPTIONS .SH OPTIONS
.IP \[bu] 2 .PP
\f[B]-d\f[R] Detach from terminal and fork into the background. \f[B]-d\f[R] Detach from terminal and fork into the background.
By default l2tpns will stay in the foreground. By default l2tpns will stay in the foreground
.RS 2
.PP .PP
\&.
.RE
.IP \[bu] 2
\f[B]-v\f[R] Increase verbosity for debugging. \f[B]-v\f[R] Increase verbosity for debugging.
Can be used multiple times. Can be used multiple times
.RS 2
.PP .PP
\&. \f[B]-c\f[R] \f[I]file\f[R] Specify configuration file
.RE
.IP \[bu] 2
\f[B]-c\f[R] \f[I]file\f[R]
.RS 2
.PP .PP
Specify configuration file. \f[B]-h\f[R] \f[I]hostname\f[R] Force hostname to \f[I]hostname\f[R]
.RE
.IP \[bu] 2
\f[B]-h\f[R] \f[I]hostname\f[R]
.RS 2
.PP
Force hostname to \f[I]hostname\f[R].
.RE
.SH FILES .SH FILES
.IP \[bu] 2 .PP
\f[I]/etc/l2tpns/startup-config\f[R] \f[I]/etc/l2tpns/startup-config\f[R]
.RS 2 .PD 0
.P
.PD
The default configuration file
.PP .PP
The default configuration file.
.RE
.IP \[bu] 2
\f[I]/etc/l2tpns/ip_pool\f[R] \f[I]/etc/l2tpns/ip_pool\f[R]
.RS 2 .PD 0
.P
.PD
IP address pool configuration
.PP .PP
IP address pool configuration.
.RE
.IP \[bu] 2
\f[I]/etc/l2tpns/users\f[R] \f[I]/etc/l2tpns/users\f[R]
.RS 2 .PD 0
.PP .P
Username/password configuration for access to admin interface. .PD
.RE Username/password configuration for access to admin interface
.SH SIGNALS .SH SIGNALS
.IP \[bu] 2
\f[B]SIGHUP\f[R] Reload the config from disk and re-open log file.
.RS 2
.PP .PP
\&. \f[B]SIGHUP\f[R]
.RE .PD 0
.IP \[bu] 2 .P
.PD
Reload the config from disk and re-open log file
.PP
\f[B]SIGTERM\f[R], \f[B]SIGINT\f[R] \f[B]SIGTERM\f[R], \f[B]SIGINT\f[R]
.RS 2 .PD 0
.PP .P
.PD
Stop process. Stop process.
Tunnels and sessions are not terminated. Tunnels and sessions are not terminated.
This signal should be used to stop l2tpns on a cluster node where there This signal should be used to stop l2tpns on a cluster node where there
are other machines to continue handling traffic. are other machines to continue handling traffic
.RE
.IP \[bu] 2
\f[B]SIGQUIT\f[R]
.RS 2
.PP .PP
Shut down tunnels and sessions, exit process when complete. \f[B]SIGQUIT\f[R]
.RE .PD 0
.P
.PD
Shut down tunnels and sessions, exit process when complete
.SH MANAGED RADIUS ATTRIBUTE .SH MANAGED RADIUS ATTRIBUTE
.IP \[bu] 2 .PP
\f[B]Ascend-Client-Primary-DNS\f[R], \f[B]Ascend-Client-Primary-DNS\f[R],
\f[B]Ascend-Client-Secondary-DNS\f[R] \f[B]Ascend-Client-Secondary-DNS\f[R]
.RS 2 .PD 0
.P
.PD
Specifies a primary and secondary DNS server address to send to user
.PP .PP
Specifies a primary and secondary DNS server address to send to user.
.RE
.IP \[bu] 2
\f[B]Delegated-IPv6-Prefix\f[R] \f[B]Delegated-IPv6-Prefix\f[R]
.RS 2 .PD 0
.P
.PD
Assign a network address IPv6 prefix to a user by DHCPv6
.PP .PP
Assign a network address IPv6 prefix to a user by DHCPv6.
.RE
.IP \[bu] 2
\f[B]Framed-IP-Address\f[R] \f[B]Framed-IP-Address\f[R]
.RS 2 .PD 0
.PP .P
.PD
The address to be configured for the user (IPv4 address of the interface The address to be configured for the user (IPv4 address of the interface
ppp). ppp)
.RE .PP
.IP \[bu] 2
\f[B]Framed-Route\f[R] \f[B]Framed-Route\f[R]
.RS 2 .PD 0
.P
.PD
provides routing information to be configured for the user
.PP .PP
provides routing information to be configured for the user.
.RE
.IP \[bu] 2
\f[B]Framed-IPv6-Route\f[R] \f[B]Framed-IPv6-Route\f[R]
.RS 2 .PD 0
.PP .P
.PD
Has the same action as \f[B]Delegated-IPv6-Prefix\f[R]. Has the same action as \f[B]Delegated-IPv6-Prefix\f[R].
\f[B]Delegated-IPv6-Prefix\f[R] is the correct one to use. \f[B]Delegated-IPv6-Prefix\f[R] is the correct one to use
.RE .PP
.IP \[bu] 2
\f[B]Framed-IPv6-Address\f[R] \f[B]Framed-IPv6-Address\f[R]
.RS 2 .PD 0
.PP .P
.PD
IPv6 address to be assigned to the user by DHCPv6 (IPv6 address of the IPv6 address to be assigned to the user by DHCPv6 (IPv6 address of the
interface ppp). interface ppp)
.RE .PP
.IP \[bu] 2
\f[B]Idle-Timeout\f[R] \f[B]Idle-Timeout\f[R]
.RS 2 .PD 0
.PP .P
.PD
disconnects the session if no data for more than \f[B]Idle-Timeout\f[R] disconnects the session if no data for more than \f[B]Idle-Timeout\f[R]
(in seconds). (in seconds)
.RE
.IP \[bu] 2
\f[B]Session-Timeout\f[R]
.RS 2
.PP .PP
\f[B]Session-Timeout\f[R]
.PD 0
.P
.PD
disconnects the user session when the time \f[B]Session-Timeout\f[R] is disconnects the user session when the time \f[B]Session-Timeout\f[R] is
reached (in seconds). reached (in seconds)
.RE .PP
.IP \[bu] 2
\f[B]Tunnel-Type\f[R], \f[B]Tunnel-Medium-Type\f[R], \f[B]Tunnel-Type\f[R], \f[B]Tunnel-Medium-Type\f[R],
\f[B]Tunnel-Server-Endpoint\f[R], \f[B]Tunnel-Password\f[R], \f[B]Tunnel-Server-Endpoint\f[R], \f[B]Tunnel-Password\f[R],
\f[B]Tunnel-Assignment-Id\f[R] \f[B]Tunnel-Assignment-Id\f[R]
.RS 2 .PD 0
.PP .P
.PD
attributes returned by the Radius of the remote LNS server (LAC attributes returned by the Radius of the remote LNS server (LAC
functionality). functionality)
.PP .IP
example, Radius that return the information of 2 remote LNS server with .nf
which must be open a L2TP TUNNEL: \f[C]
.IP \[bu] 2 example, Radius that return the information of 2 remote LNS server with which must be open a L2TP TUNNEL:
\f[B]Tunnel-Type\f[R]: 1 = L2TP
.IP \[bu] 2 - Tunnel-Type: 1 = L2TP
\f[B]Tunnel-Medium-Type\f[R]: 1 = IPv4 - Tunnel-Medium-Type: 1 = IPv4
.IP \[bu] 2 - Tunnel-Password: 1 = \[dq]TheSecretL2TP\[dq]
\f[B]Tunnel-Password\f[R]: 1 = \[lq]TheSecretL2TP\[rq] - Tunnel-Server-Endpoint: 1 = \[dq]88.xx.xx.x1\[dq]
.IP \[bu] 2 - Tunnel-Assignment-Id: 1 = \[dq]friendisp_lns1\[dq]
\f[B]Tunnel-Server-Endpoint\f[R]: 1 = \[lq]88.xx.xx.x1\[rq] - Tunnel-Type: 2 = L2TP
.IP \[bu] 2 - Tunnel-Medium-Type: 2 = IPv4
\f[B]Tunnel-Assignment-Id\f[R]: 1 = \[lq]friendisp_lns1\[rq] - Tunnel-Password: 2 = \[dq]TheSecretL2TP\[dq]
.IP \[bu] 2 - Tunnel-Server-Endpoint: 2 = \[dq]88.xx.xx.x2\[dq]
\f[B]Tunnel-Type\f[R]: 2 = L2TP - Tunnel-Assignment-Id: 2 = \[dq]friendisp_lns2\[dq]
.IP \[bu] 2 \f[R]
\f[B]Tunnel-Medium-Type\f[R]: 2 = IPv4 .fi
.IP \[bu] 2
\f[B]Tunnel-Password\f[R]: 2 = \[lq]TheSecretL2TP\[rq]
.IP \[bu] 2
\f[B]Tunnel-Server-Endpoint\f[R]: 2 = \[lq]88.xx.xx.x2\[rq]
.IP \[bu] 2
\f[B]Tunnel-Assignment-Id\f[R]: 2 = \[lq]friendisp_lns2\[rq]
.RE
.SH SEE ALSO .SH SEE ALSO
.PP .PP
\f[B]startup-config\f[R](5), \f[B]nsctl\f[R](8) \f[B]startup-config\f[R](5), \f[B]nsctl\f[R](8)

27
docs/manpages/nsctl.8
View file

@ -16,30 +16,29 @@ nsctl - manage running l2tpns instance
It provides both for the loading or unloading of plugins and also the It provides both for the loading or unloading of plugins and also the
management of sessions via functions provided by those plugins. management of sessions via functions provided by those plugins.
.SH OPTIONS .SH OPTIONS
.TP .PP
\f[B]-d\f[R] \f[B]-d\f[R] Enable debugging output
Enable debugging output. .PP
.TP \f[B]-h \f[BI]host\f[B][:\f[BI]port\f[B]]\f[R] The host running
\f[B]-h \f[BI]host\f[B][:\f[BI]port\f[B]]\f[R] \f[B]l2tpns\f[R] that should receive the message.
The host running \f[B]l2tpns\f[R] that should receive the message. By default the message is sent to UDP port 1702 on \f[B]localhost\f[R]
By default the message is sent to UDP port 1702 on \f[B]localhost\f[R]. .PP
.TP \f[B]-t \f[BI]timeout\f[B]\f[R] Timeout in seconds to wait for a
\f[B]-t \f[BI]timeout\f[B]\f[R] response from the server
Timeout in seconds to wait for a response from the server.
.SH COMMANDS .SH COMMANDS
.PP .PP
The first argument specifies the command to send to \f[B]l2tpns .\f[R] The first argument specifies the command to send to \f[B]l2tpns.\f[R]
The following commands are as defined: The following commands are as defined:
.TP .TP
\f[B]load_plugin \f[R]\f[I]plugin\f[R] \f[B]load_plugin \f[R]\f[I]plugin\f[R]
Load the named \f[I]plugin\f[R]. Load the named \f[I]plugin\f[R]
.TP .TP
\f[B]unload_plugin \f[R]\f[I]plugin\f[R] \f[B]unload_plugin \f[R]\f[I]plugin\f[R]
Unload the named \f[I]plugin\f[R]. Unload the named \f[I]plugin\f[R]
.TP .TP
\f[B]help\f[R] \f[B]help\f[R]
Each loaded plugin is queried for what commands it supports and the Each loaded plugin is queried for what commands it supports and the
synopsis for each is output. synopsis for each is output
.PP .PP
Any other value of \f[I]command\f[R] (and \f[I]args\f[R] if any) are Any other value of \f[I]command\f[R] (and \f[I]args\f[R] if any) are
sent to \f[B]l2tpns\f[R] as-is, to be passed to each plugin which sent to \f[B]l2tpns\f[R] as-is, to be passed to each plugin which

590
docs/manpages/startup-config.5
View file

@ -18,308 +18,269 @@ Comments are indicated by either the character # or !.
.SS SETTINGS .SS SETTINGS
.PP .PP
Settings are specified with Settings are specified with
.IP \[bu] 2 .PP
\f[B]set\f[R] \f[C]variable\f[R] \f[C]value\f[R] \f[B]set\f[R] \f[C]variable\f[R] \f[C]value\f[R]
.PP .PP
A list of the possible configuration directives follows. A list of the possible configuration directives follows.
Each of these should be set by a line like: Each of these should be set by a line like:
.IP \[bu] 2 .PP
\f[B]set\f[R] \f[I]configstring\f[R] \f[I]\[lq]value\[rq]\f[R] \f[B]set\f[R] \f[I]configstring\f[R] \f[I]\[lq]value\[rq]\f[R]
.IP \[bu] 2 .PD 0
.P
.PD
\f[B]set\f[R] \f[I]ipaddress\f[R] \f[I]192.168.1.1\f[R] \f[B]set\f[R] \f[I]ipaddress\f[R] \f[I]192.168.1.1\f[R]
.IP \[bu] 2 .PD 0
.P
.PD
\f[B]set\f[R] \f[I]boolean\f[R] \f[I]true\f[R] \f[B]set\f[R] \f[I]boolean\f[R] \f[I]true\f[R]
.PP .PP
The following \f[C]variables\f[R] may be set: The following \f[C]variables\f[R] may be set:
.IP \[bu] 2 .PP
\f[B]accounting_dir\f[R] (string) \f[B]accounting_dir\f[R] (string)
.RS 2 .IP
.nf
\f[C]
If set to a directory, then every 5 minutes the current usage for every connected use will be dumped to a file in this directory. Each file dumped begins with a header, where each line is prefixed by #. Following the header is a single line for every connected user, fields separated by a space.
The fields are username, ip, qos, uptxoctets, downrxoctets, origin (optional). The qos field is 1 if a standard user, and 2 if the user is throttled. The origin field is dump if account_all_origin is set to true (origin value: L=LAC data, R=Remote LNS data, P=PPPOE data).
\f[R]
.fi
.PP .PP
If set to a directory, then every 5 minutes the current usage for every
connected use will be dumped to a file in this directory.
Each file dumped begins with a header, where each line is prefixed by #.
Following the header is a single line for every connected user, fields
separated by a space.
.PP
The fields are username, ip, qos, uptxoctets, downrxoctets, origin
(optional).
The qos field is 1 if a standard user, and 2 if the user is throttled.
The origin field is dump if \f[B]account_all_origin\f[R] is set to true
(origin value: L=LAC data, R=Remote LNS data, P=PPPOE data).
.RE
.IP \[bu] 2
\f[B]account_all_origin\f[R] (boolean) \f[B]account_all_origin\f[R] (boolean)
.RS 2 .IP
.nf
\f[C]
If set to true, all origin of the usage is dumped to the accounting file (LAC+Remote LNS+PPPOE)(default false).
\f[R]
.fi
.PP .PP
If set to true, all origin of the usage is dumped to the accounting file
(LAC+Remote LNS+PPPOE)(default false).
.RE
.IP \[bu] 2
\f[B]allow_duplicate_users\f[R] (boolean) \f[B]allow_duplicate_users\f[R] (boolean)
.RS 2 .IP
.nf
\f[C]
Allow multiple logins with the same username. If false (the default), any prior session with the same username will be dropped when a new session is established.
\f[R]
.fi
.PP .PP
Allow multiple logins with the same username.
If false (the default), any prior session with the same username will be
dropped when a new session is established.
.RE
.IP \[bu] 2
\f[B]auth_tunnel_change_addr_src\f[R] (boolean) \f[B]auth_tunnel_change_addr_src\f[R] (boolean)
.RS 2 .IP
.nf
\f[C]
This parameter authorize to change the source IP of the tunnels l2tp. This parameter can be used when the remotes BAS/LAC are l2tpns server configured in cluster mode, but that the interface to remote LNS are not clustered (the tunnel can be coming from different source IP) (default: no).
\f[R]
.fi
.PP .PP
This parameter authorize to change the source IP of the tunnels l2tp.
This parameter can be used when the remotes BAS/LAC are l2tpns server
configured in cluster mode, but that the interface to remote LNS are not
clustered (the tunnel can be coming from different source IP) (default:
no).
.RE
.IP \[bu] 2
\f[B]bind_address\f[R] (ip address) \f[B]bind_address\f[R] (ip address)
.RS 2 .IP
.nf
\f[C]
It\[aq]s the listen address of the l2tp udp protocol sent and received to LAC. This address is also assigned to the tun interface if no iftun_address is specified. Packets containing user traffic should be routed via this address if given, otherwise the primary address of the machine.
\f[R]
.fi
.PP .PP
It\[cq]s the listen address of the l2tp udp protocol sent and received
to LAC.
This address is also assigned to the tun interface if no iftun_address
is specified.
Packets containing user traffic should be routed via this address if
given, otherwise the primary address of the machine.
.RE
.IP \[bu] 2
\f[B]bind_multi_address\f[R] (ip address) \f[B]bind_multi_address\f[R] (ip address)
.RS 2 .IP
.PP .nf
This parameter permit one to listen several address of the l2tp udp \f[C]
protocol (and set several address to the tun interface). This parameter permit one to listen several address of the l2tp udp protocol (and set several address to the tun interface).
.PP
WHEN this parameter is set, It OVERWRITE the parameters WHEN this parameter is set, It OVERWRITE the parameters \[dq]bind_address\[dq] and \[dq]iftun_address\[dq].
\[lq]bind_address\[rq] and \[lq]iftun_address\[rq].
.PP these can be interesting when you want do load-balancing in cluster mode of the uploaded from the LAC. For example you can set a bgp.prepend(MY_AS) for Address1 on LNS1 and a bgp.prepend(MY_AS) for Address2 on LNS2 (see BGP AS-path prepending).
these can be interesting when you want do load-balancing in cluster mode
of the uploaded from the LAC.
For example you can set a bgp.prepend(MY_AS) for Address1 on LNS1 and a
bgp.prepend(MY_AS) for Address2 on LNS2 (see BGP AS-path prepending).
.PP
example of use with 2 address: example of use with 2 address:
set bind_multi_address \[dq]64.14.13.41, 64.14.13.42\[dq]
\f[R]
.fi
.PP .PP
\f[B]set\f[R] \f[I]bind_multi_address\f[R] \[lq]64.14.13.41,
64.14.13.42\[rq]
.RE
.IP \[bu] 2
\f[B]cluster_address\f[R] (ip address) \f[B]cluster_address\f[R] (ip address)
.RS 2 .IP
.nf
\f[C]
Multicast cluster address (default: 239.192.13.13). See the section on Clustering for more information.
\f[R]
.fi
.PP .PP
Multicast cluster address (default: 239.192.13.13). \f[B]cluster_port\f[R] (int)
See the section on Clustering for more information. .IP
.RE .nf
.IP \[bu] 2 \f[C]
\f[B]Bcluster_port\f[R] (int) UDP cluster port (default: 32792). See the section on Clustering for more information.
.RS 2 \f[R]
.fi
.PP .PP
UDP cluster port (default: 32792).
See the section on Clustering for more information.
.RE
.IP \[bu] 2
\f[B]cluster_interface\f[R] (string) \f[B]cluster_interface\f[R] (string)
.RS 2 .IP
.PP .nf
\f[C]
Interface for cluster packets (default: eth0). Interface for cluster packets (default: eth0).
.RE \f[R]
.IP \[bu] 2 .fi
.PP
\f[B]cluster_mcast_ttl\f[R] (int) \f[B]cluster_mcast_ttl\f[R] (int)
.RS 2 .IP
.PP .nf
\f[C]
TTL for multicast packets (default: 1). TTL for multicast packets (default: 1).
.RE \f[R]
.IP \[bu] 2 .fi
.PP
\f[B]cluster_hb_interval\f[R] (int) \f[B]cluster_hb_interval\f[R] (int)
.RS 2 .IP
.PP .nf
\f[C]
Interval in tenths of a second between cluster heartbeat/pings. Interval in tenths of a second between cluster heartbeat/pings.
.RE \f[R]
.IP \[bu] 2 .fi
.PP
\f[B]cluster_hb_timeout\f[R] (int) \f[B]cluster_hb_timeout\f[R] (int)
.RS 2 .IP
.nf
\f[C]
Cluster heartbeat timeout in tenths of a second. A new master will be elected when this interval has been passed without seeing a heartbeat from the master.
\f[R]
.fi
.PP .PP
Cluster heartbeat timeout in tenths of a second.
A new master will be elected when this interval has been passed without
seeing a heartbeat from the master.
.RE
.IP \[bu] 2
\f[B]cluster_master_min_adv\f[R] (int) \f[B]cluster_master_min_adv\f[R] (int)
.RS 2 .IP
.nf
\f[C]
Determines the minimum number of up to date slaves required before the master will drop routes (default: 1).
\f[R]
.fi
.PP .PP
Determines the minimum number of up to date slaves required before the
master will drop routes (default: 1).
.RE
.IP \[bu] 2
\f[B]debug\f[R] (int) \f[B]debug\f[R] (int)
.RS 2 .IP
.PP .nf
Set the level of debugging messages written to the log file. \f[C]
The value should be between 0 and 5, with 0 being no debugging, and 5 Set the level of debugging messages written to the log file. The value should
being the highest. be between 0 and 5, with 0 being no debugging, and 5 being the highest.
A rough description of the levels is: A rough description of the levels is:
\[bu] .RS 2
.IP "0." 3 - 0. Critical Errors - Things are probably broken
Critical Errors - Things are probably broken - 1. Errors - Things might have gone wrong, but probably will recover
.RE - 2. Warnings - Just in case you care what is not quite perfect
\[bu] .RS 2 - 3. Information - Parameters of control packets
.IP "1." 3 - 4. Calls - For tracing the execution of the code
Errors - Things might have gone wrong, but probably will recover - 5. Packets - Everything, including a hex dump of all packets processed... probably twice
.RE
\[bu] .RS 2 Note that the higher you set the debugging level, the slower the program will run. Also, at level 5 a LOT of information will be logged. This should only ever be used for working out why it doesn\[aq]t work at all.
.IP "2." 3 \f[R]
Warnings - Just in case you care what is not quite perfect .fi
.RE
\[bu] .RS 2
.IP "3." 3
Information - Parameters of control packets
.RE
\[bu] .RS 2
.IP "4." 3
Calls - For tracing the execution of the code
.RE
\[bu] .RS 2
.IP "5." 3
Packets - Everything, including a hex dump of all packets processed\&...
probably twice
.RE
.PP .PP
Note that the higher you set the debugging level, the slower the program
will run.
Also, at level 5 a LOT of information will be logged.
This should only ever be used for working out why it doesn\[cq]t work at
all.
.RE
.IP \[bu] 2
\f[B]dump_speed\f[R] (boolean) \f[B]dump_speed\f[R] (boolean)
.RS 2 .IP
.nf
\f[C]
If set to true, then the current bandwidth utilization will be logged every second. Even if this is disabled, you can see this information by running the uptime command on the CLI.
\f[R]
.fi
.PP .PP
If set to true, then the current bandwidth utilization will be logged
every second.
Even if this is disabled, you can see this information by running the
uptime command on the CLI.
.RE
.IP \[bu] 2
\f[B]disable_sending_hello\f[R] (boolean) \f[B]disable_sending_hello\f[R] (boolean)
.RS 2 .IP
.nf
\f[C]
Disable l2tp sending HELLO message for Apple compatibility. Some OS X implementation of l2tp no manage the L2TP \[dq]HELLO message\[dq]. (default: no).
\f[R]
.fi
.PP .PP
Disable l2tp sending HELLO message for Apple compatibility.
Some OS X implementation of l2tp no manage the L2TP \[lq]HELLO
message\[rq].
(default: no).
.RE
.IP \[bu] 2
\f[B]echo_timeout\f[R] (int) \f[B]echo_timeout\f[R] (int)
.RS 2 .IP
.nf
\f[C]
Time between last packet sent and LCP ECHO generation (default: 10 (seconds)).
\f[R]
.fi
.PP .PP
Time between last packet sent and LCP ECHO generation (default: 10
(seconds)).
.RE
.IP \[bu] 2
\f[B]guest_account\f[R] \f[B]guest_account\f[R]
.RS 2 .IP
.PP .nf
\f[C]
Allow multiple logins matching this specific username. Allow multiple logins matching this specific username.
.RE \f[R]
.IP \[bu] 2 .fi
.PP
\f[B]icmp_rate\f[R] (int) \f[B]icmp_rate\f[R] (int)
.RS 2 .IP
.PP .nf
\f[C]
Maximum number of host unreachable ICMP packets to send per second. Maximum number of host unreachable ICMP packets to send per second.
.RE \f[R]
.IP \[bu] 2 .fi
.PP
\f[B]idle_echo_timeout\f[R] (int) \f[B]idle_echo_timeout\f[R] (int)
.RS 2 .IP
.nf
\f[C]
Drop sessions who have not responded within idle_echo_timeout seconds (default: 240 (seconds))
\f[R]
.fi
.PP .PP
Drop sessions who have not responded within idle_echo_timeout seconds
(default: 240 (seconds))
.RE
.IP \[bu] 2
\f[B]iftun_address\f[R] (ip address) \f[B]iftun_address\f[R] (ip address)
.RS 2 .IP
.nf
\f[C]
This parameter is used when you want a tun interface address different from the address of \[dq]bind_address\[dq] (For use in cases of specific configuration). If no address is given to iftun_address and bind_address, 1.1.1.1 is used.
\f[R]
.fi
.PP .PP
This parameter is used when you want a tun interface address different
from the address of \[lq]bind_address\[rq] (For use in cases of specific
configuration).
If no address is given to iftun_address and bind_address, 1.1.1.1 is
used.
.RE
.IP \[bu] 2
\f[B]l2tp_mtu\f[R] (int) \f[B]l2tp_mtu\f[R] (int)
.RS 2 .IP
.nf
\f[C]
MTU of interface for L2TP traffic (default: 1500). Used to set link MRU and adjust TCP MSS.
\f[R]
.fi
.PP .PP
MTU of interface for L2TP traffic (default: 1500).
Used to set link MRU and adjust TCP MSS.
.RE
.IP \[bu] 2
\f[B]l2tp_secret\f[R] (string) \f[B]l2tp_secret\f[R] (string)
.RS 2
.PP .PP
The secret used by l2tpns for authenticating tunnel request. The secret used by l2tpns for authenticating tunnel request.
Must be the same as the LAC, or authentication will fail. Must be the same as the LAC, or authentication will fail.
Only actually be used if the LAC requests authentication. Only actually be used if the LAC requests authentication.
.RE .PP
.IP \[bu] 2
\f[B]lock_pages\f[R] (boolean) \f[B]lock_pages\f[R] (boolean)
.RS 2
.PP .PP
Keep all pages mapped by the l2tpns process in memory. Keep all pages mapped by the l2tpns process in memory.
.RE .PP
.IP \[bu] 2
\f[B]log_file\f[R] (string) \f[B]log_file\f[R] (string)
.RS 2
.PP .PP
This will be where all logging and debugging information is written This will be where all logging and debugging information is written
to.This may be either a filename, such as /var/log/l2tpns, or the string to.This may be either a filename, such as /var/log/l2tpns, or the string
syslog:facility, where facility is any one of the syslog logging syslog:facility, where facility is any one of the syslog logging
facilities, such as local5. facilities, such as local5.
.RE .PP
.IP \[bu] 2
\f[B]multi_read_count\f[R] (int) \f[B]multi_read_count\f[R] (int)
.RS 2
.PP .PP
Number of packets to read off each of the UDP and TUN fds when returned Number of packets to read off each of the UDP and TUN fds when returned
as readable by select (default: 10). as readable by select (default: 10).
Avoids incurring the unnecessary system call overhead of select on busy Avoids incurring the unnecessary system call overhead of select on busy
servers. servers.
.RE .PP
.IP \[bu] 2
\f[B]packet_limit\f[R] (int> \f[B]packet_limit\f[R] (int>
.RS 2
.PP .PP
Maximum number of packets of downstream traffic to be handled each tenth Maximum number of packets of downstream traffic to be handled each tenth
of a second per session. of a second per session.
If zero, no limit is applied (default: 0). If zero, no limit is applied (default: 0).
Intended as a DoS prevention mechanism and not a general throttling Intended as a DoS prevention mechanism and not a general throttling
control (packets are dropped, not queued). control (packets are dropped, not queued).
.RE .PP
.IP \[bu] 2
\f[B]peer_address\f[R] (ip address) \f[B]peer_address\f[R] (ip address)
.RS 2
.PP .PP
Address to send to clients as the default gateway. Address to send to clients as the default gateway.
.RE .PP
.IP \[bu] 2
\f[B]pid_file\f[R] (string) \f[B]pid_file\f[R] (string)
.RS 2
.PP .PP
If set, the process id will be written to the specified file. If set, the process id will be written to the specified file.
The value must be an absolute path. The value must be an absolute path.
.RE .PP
.IP \[bu] 2
\f[B]ppp_keepalive\f[R] (boolean) \f[B]ppp_keepalive\f[R] (boolean)
.RS 2
.PP .PP
Change this value to no to force generation of LCP ECHO every Change this value to no to force generation of LCP ECHO every
echo_timeout seconds, even there are activity on the link (default: yes) echo_timeout seconds, even there are activity on the link (default: yes)
.RE .PP
.IP \[bu] 2 \f[B]ppp_restart_time\f[R] (int) \f[B]ppp_max_configure\f[R] (int)
\f[B]ppp_restart_time\f[R] (int)
.IP \[bu] 2
\f[B]ppp_max_configure\f[R] (int)
.IP \[bu] 2
\f[B]ppp_max_failure\f[R] (int) \f[B]ppp_max_failure\f[R] (int)
.RS 2
.PP .PP
PPP counter and timer values, as described in Section 4.1 of RFC1661. PPP counter and timer values, as described in Section 4.1 of RFC1661.
.PP .PP
@ -331,19 +292,15 @@ giving up (default: 10).
.PP .PP
\f[I]ppp_max_failure\f[R], Number of Configure-Nak requests to send \f[I]ppp_max_failure\f[R], Number of Configure-Nak requests to send
before sending a Configure-Reject (default: 5). before sending a Configure-Reject (default: 5).
.RE .PP
.IP \[bu] 2
\f[B]primary_dns\f[R] (ip address), \f[B]secondary_dns\f[R] (ip address) \f[B]primary_dns\f[R] (ip address), \f[B]secondary_dns\f[R] (ip address)
.RS 2
.PP .PP
Whenever a PPP connection is established, DNS servers will be sent to Whenever a PPP connection is established, DNS servers will be sent to
the user, both a primary and a secondary. the user, both a primary and a secondary.
If either is set to 0.0.0.0, then that one will not be sent. If either is set to 0.0.0.0, then that one will not be sent.
.RE .PP
.IP \[bu] 2
\f[B]primary_radius\f[R] (ip address), \f[B]secondary_radius\f[R] (ip \f[B]primary_radius\f[R] (ip address), \f[B]secondary_radius\f[R] (ip
address) address)
.RS 2
.PP .PP
Sets the RADIUS servers used for both authentication and accounting. Sets the RADIUS servers used for both authentication and accounting.
If the primary server does not respond, then the secondary RADIUS server If the primary server does not respond, then the secondary RADIUS server
@ -354,173 +311,129 @@ server must include the source port when detecting duplicates to
suppress (in order to cope with a large number of sessions coming suppress (in order to cope with a large number of sessions coming
on-line simultaneously l2tpns uses a set of udp sockets, each with a on-line simultaneously l2tpns uses a set of udp sockets, each with a
separate identifier). separate identifier).
.RE .PP
.IP \[bu] 2
\f[B]primary_radius_port\f[R] (short), \f[B]secondary_radius_port\f[R] \f[B]primary_radius_port\f[R] (short), \f[B]secondary_radius_port\f[R]
(short) (short)
.RS 2
.PP .PP
Sets the authentication ports for the primary and secondary RADIUS Sets the authentication ports for the primary and secondary RADIUS
servers. servers.
The accounting port is one more than the authentication port. The accounting port is one more than the authentication port.
If no RADIUS ports are given, the authentication port defaults to 1645, If no RADIUS ports are given, the authentication port defaults to 1645,
and the accounting port to 1646. and the accounting port to 1646.
.RE .PP
.IP \[bu] 2
\f[B]radius_accounting\f[R] (boolean) \f[B]radius_accounting\f[R] (boolean)
.RS 2
.PP .PP
If set to true, then RADIUS accounting packets will be sent. If set to true, then RADIUS accounting packets will be sent.
This means that a \f[B]Start\f[R] record will be sent when the session This means that a \f[B]Start\f[R] record will be sent when the session
is successfully authenticated, and a \f[B]Stop\f[R] record will be sent is successfully authenticated, and a \f[B]Stop\f[R] record will be sent
when the session is closed. when the session is closed.
.RE .PP
.IP \[bu] 2
\f[B]radius_interim\f[R] (int) \f[B]radius_interim\f[R] (int)
.RS 2
.PP .PP
If radius_accounting is on, defines the interval between sending of If radius_accounting is on, defines the interval between sending of
RADIUS interim accounting records (in seconds). RADIUS interim accounting records (in seconds).
.RE .PP
.IP \[bu] 2
\f[B]radius_secret\f[R] (string) \f[B]radius_secret\f[R] (string)
.RS 2
.PP .PP
This secret will be used in all RADIUS queries. This secret will be used in all RADIUS queries.
If this is not set then RADIUS queries will fail. If this is not set then RADIUS queries will fail.
.RE .PP
.IP \[bu] 2
\f[B]radius_authtypes\f[R] (string) \f[B]radius_authtypes\f[R] (string)
.RS 2
.PP .PP
A comma separated list of supported RADIUS authentication methods A comma separated list of supported RADIUS authentication methods
(\[lq]pap\[rq] or \[lq]chap\[rq]), in order of preference (default (\[lq]pap\[rq] or \[lq]chap\[rq]), in order of preference (default
\[lq]pap\[rq]). \[lq]pap\[rq]).
.RE .PP
.IP \[bu] 2
\f[B]radius_dae_port\f[R] (short) \f[B]radius_dae_port\f[R] (short)
.RS 2
.PP .PP
Port for DAE RADIUS (Packet of Death/Disconnect, Change of Port for DAE RADIUS (Packet of Death/Disconnect, Change of
Authorization) requests (default: 3799). Authorization) requests (default: 3799).
.RE .PP
.IP \[bu] 2
\f[B]radius_bind_min\f[R], \f[B]radius_bind_max\f[R] (int) \f[B]radius_bind_min\f[R], \f[B]radius_bind_max\f[R] (int)
.RS 2
.PP .PP
Define a port range in which to bind sockets used to send and receive Define a port range in which to bind sockets used to send and receive
RADIUS packets. RADIUS packets.
Must be at least RADIUS_FDS (64) wide. Must be at least RADIUS_FDS (64) wide.
Simplifies firewalling of RADIUS ports (default: dynamically assigned). Simplifies firewalling of RADIUS ports (default: dynamically assigned).
.RE .PP
.IP \[bu] 2
\f[B]random_device\f[R] (string) \f[B]random_device\f[R] (string)
.RS 2
.PP .PP
Path to random data source (default /dev/urandom). Path to random data source (default /dev/urandom).
Use \[dq]\[dq] to use the rand() library function. Use \[dq]\[dq] to use the rand() library function.
.RE .PP
.IP \[bu] 2
\f[B]scheduler_fifo\f[R] (boolean) \f[B]scheduler_fifo\f[R] (boolean)
.RS 2
.PP .PP
Sets the scheduling policy for the l2tpns process to SCHED_FIFO. Sets the scheduling policy for the l2tpns process to SCHED_FIFO.
This causes the kernel to immediately preempt any currently running This causes the kernel to immediately preempt any currently running
SCHED_OTHER (normal) process in favour of l2tpns when it becomes SCHED_OTHER (normal) process in favour of l2tpns when it becomes
runnable. runnable.
Ignored on uniprocessor systems. Ignored on uniprocessor systems.
.RE .PP
.IP \[bu] 2
\f[B]send_garp\f[R] (boolean) \f[B]send_garp\f[R] (boolean)
.RS 2
.PP .PP
Determines whether or not to send a gratuitous ARP for the bind_address Determines whether or not to send a gratuitous ARP for the bind_address
when the server is ready to handle traffic (default: true). when the server is ready to handle traffic (default: true).
This value is ignored if BGP is configured. This value is ignored if BGP is configured.
.RE .PP
.IP \[bu] 2
\f[B]tundevicename\f[R] (string) \f[B]tundevicename\f[R] (string)
.RS 2
.PP .PP
Name of the tun interface (default: \[lq]tun0\[rq]). Name of the tun interface (default: \[lq]tun0\[rq]).
.RE .PP
.IP \[bu] 2
\f[B]throttle_speed\f[R] (int) \f[B]throttle_speed\f[R] (int)
.RS 2
.PP .PP
Sets the default speed (in kbits/s) which sessions will be limited to. Sets the default speed (in kbits/s) which sessions will be limited to.
If this is set to 0, then throttling will not be used at all. If this is set to 0, then throttling will not be used at all.
Note: You can set this by the CLI, but changes will not affect currently Note: You can set this by the CLI, but changes will not affect currently
connected users. connected users.
.RE .PP
.IP \[bu] 2
\f[B]throttle_buckets\f[R] (int) \f[B]throttle_buckets\f[R] (int)
.RS 2
.PP .PP
Number of token buckets to allocate for throttling. Number of token buckets to allocate for throttling.
Each throttled session requires two buckets (in and out). Each throttled session requires two buckets (in and out).
.RE
.SS DHCPv6 And IPv6 SETTINGS .SS DHCPv6 And IPv6 SETTINGS
.IP \[bu] 2 .PP
\f[B]dhcp6_preferred_lifetime\f[R] (int) \f[B]dhcp6_preferred_lifetime\f[R] (int)
.RS 2
.PP .PP
The preferred lifetime for the IPv6 address and the IPv6 prefix address, The preferred lifetime for the IPv6 address and the IPv6 prefix address,
expressed in units of seconds (see rfc3315). expressed in units of seconds (see rfc3315).
.RE .PP
.IP \[bu] 2
\f[B]dhcp6_valid_lifetime\f[R] (int) \f[B]dhcp6_valid_lifetime\f[R] (int)
.RS 2
.PP .PP
The valid lifetime for the IPv6 address and the IPv6 prefix address, The valid lifetime for the IPv6 address and the IPv6 prefix address,
expressed in units of seconds (see rfc3315). expressed in units of seconds (see rfc3315).
.RE .PP
.IP \[bu] 2
\f[B]dhcp6_server_duid\f[R] (int) \f[B]dhcp6_server_duid\f[R] (int)
.RS 2
.PP .PP
DUID Based on Link-layer Address (DUID-LL) (see rfc3315). DUID Based on Link-layer Address (DUID-LL) (see rfc3315).
.RE .PP
.IP \[bu] 2
\f[B]primary_ipv6_dns\f[R], \f[B]secondary_ipv6_dns\f[R] (Ipv6 address) \f[B]primary_ipv6_dns\f[R], \f[B]secondary_ipv6_dns\f[R] (Ipv6 address)
.RS 2
.PP .PP
IPv6 DNS servers will be sent to the user (see rfc3646). IPv6 DNS servers will be sent to the user (see rfc3646).
.RE .PP
.IP \[bu] 2
\f[B]default_ipv6_domain_list\f[R] (string) \f[B]default_ipv6_domain_list\f[R] (string)
.RS 2
.PP .PP
The Domain Search List (ex: \[lq]fdn.fr\[rq]) (see rfc3646). The Domain Search List (ex: \[lq]fdn.fr\[rq]) (see rfc3646).
.RE .PP
.IP \[bu] 2
\f[B]ipv6_prefix\f[R] (Ipv6 address) \f[B]ipv6_prefix\f[R] (Ipv6 address)
.RS 2
.PP .PP
Enable negotiation of IPv6. Enable negotiation of IPv6.
This forms the the first 64 bits of the client allocated address. This forms the the first 64 bits of the client allocated address.
The remaining 64 come from the allocated IPv4 address and 4 bytes of 0. The remaining 64 come from the allocated IPv4 address and 4 bytes of 0.
.RE
.SS LAC SETTINGS .SS LAC SETTINGS
.IP \[bu] 2 .PP
\f[B]bind_address_remotelns\f[R] (ip address) \f[B]bind_address_remotelns\f[R] (ip address)
.RS 2
.PP .PP
Address of the interface to listen the remote LNS tunnels. Address of the interface to listen the remote LNS tunnels.
If no address is given, all interfaces are listened (Any Address). If no address is given, all interfaces are listened (Any Address).
.RE .PP
.IP \[bu] 2
\f[B]bind_portremotelns\f[R] (short) \f[B]bind_portremotelns\f[R] (short)
.RS 2
.PP .PP
Port to bind for the Remote LNS (default: 65432). Port to bind for the Remote LNS (default: 65432).
.RE
.PP .PP
A static REMOTES LNS configuration can be entered by the command: A static REMOTES LNS configuration can be entered by the command:
.IP \[bu] 2 .PP
\f[B]setforward\f[R] \f[I]MASK\f[R] \f[I]IP\f[R] \f[I]PORT\f[R] \f[B]setforward\f[R] \f[I]MASK\f[R] \f[I]IP\f[R] \f[I]PORT\f[R]
\f[I]SECRET\f[R] \f[I]SECRET\f[R]
.RS 2
.PP .PP
where MASK specifies the mask of users who have forwarded to remote LNS where MASK specifies the mask of users who have forwarded to remote LNS
(ex: \[lq]/friendISP\[at]company.com\[rq]). (ex: \[lq]/friendISP\[at]company.com\[rq]).
@ -532,62 +445,71 @@ where PORT specifies the L2TP Port of the remote LNS (Normally should be
.PP .PP
where SECRET specifies the secret password the remote LNS (ex: where SECRET specifies the secret password the remote LNS (ex:
mysecret). mysecret).
.RE
.PP .PP
The static REMOTE LNS configuration can be used when the friend ISP not The static REMOTE LNS configuration can be used when the friend ISP not
have a proxied Radius. have a proxied Radius.
.PP .PP
If a proxied Radius is used, It will return the RADIUS attributes: If a proxied Radius is used, It will return the RADIUS attributes:
.IP \[bu] 2 .PP
Tunnel-Type:1 = L2TP Tunnel-Type:1 = L2TP
.IP \[bu] 2 .PD 0
.P
.PD
Tunnel-Medium-Type:1 = IPv4 Tunnel-Medium-Type:1 = IPv4
.IP \[bu] 2 .PD 0
.P
.PD
Tunnel-Password:1 = \[lq]LESECRETL2TP\[rq] Tunnel-Password:1 = \[lq]LESECRETL2TP\[rq]
.IP \[bu] 2 .PD 0
.P
.PD
Tunnel-Server-Endpoint:1 = \[lq]88.xx.xx.x1\[rq] Tunnel-Server-Endpoint:1 = \[lq]88.xx.xx.x1\[rq]
.IP \[bu] 2 .PD 0
.P
.PD
Tunnel-Assignment-Id:1 = \[lq]friendisp_lns1\[rq] Tunnel-Assignment-Id:1 = \[lq]friendisp_lns1\[rq]
.IP \[bu] 2 .PD 0
.P
.PD
Tunnel-Type:2 += L2TP Tunnel-Type:2 += L2TP
.IP \[bu] 2 .PD 0
.P
.PD
Tunnel-Medium-Type:2 += IPv4 Tunnel-Medium-Type:2 += IPv4
.IP \[bu] 2 .PD 0
.P
.PD
Tunnel-Password:2 += \[lq]LESECRETL2TP\[rq] Tunnel-Password:2 += \[lq]LESECRETL2TP\[rq]
.IP \[bu] 2 .PD 0
.P
.PD
Tunnel-Server-Endpoint:2 += \[lq]88.xx.xx.x2\[rq] Tunnel-Server-Endpoint:2 += \[lq]88.xx.xx.x2\[rq]
.IP \[bu] 2 .PD 0
.P
.PD
Tunnel-Assignment-Id:2 += \[lq]friendisp_lns2\[rq] Tunnel-Assignment-Id:2 += \[lq]friendisp_lns2\[rq]
.SS PPPOE SETTINGS .SS PPPOE SETTINGS
.IP \[bu] 2 .PP
\f[B]pppoe_if_to_bind\f[R] (string) \f[B]pppoe_if_to_bind\f[R] (string)
.RS 2
.PP .PP
PPPOE server interface to bind (ex: \[lq]eth0.12\[rq]), If not specified PPPOE server interface to bind (ex: \[lq]eth0.12\[rq]), If not specified
the server PPPOE is not enabled. the server PPPOE is not enabled.
For the pppoe clustering, all the interfaces PPPOE of the clusters must For the pppoe clustering, all the interfaces PPPOE of the clusters must
use the same HW address (MAC address). use the same HW address (MAC address).
.RE .PP
.IP \[bu] 2
\f[B]pppoe_service_name\f[R] (string) \f[B]pppoe_service_name\f[R] (string)
.RS 2
.PP .PP
PPPOE service name (default: NULL). PPPOE service name (default: NULL).
.RE .PP
.IP \[bu] 2
\f[B]pppoe_ac_name\f[R] (string) \f[B]pppoe_ac_name\f[R] (string)
.RS 2
.PP .PP
PPPOE access concentrator name (default: \[lq]l2tpns-pppoe\[rq]). PPPOE access concentrator name (default: \[lq]l2tpns-pppoe\[rq]).
.RE .PP
.IP \[bu] 2
\f[B]pppoe_only_equal_svc_name\f[R] (boolean) \f[B]pppoe_only_equal_svc_name\f[R] (boolean)
.RS 2
.PP .PP
If set to yes, the PPPOE server only accepts clients with a If set to yes, the PPPOE server only accepts clients with a
\[lq]service-name\[rq] different from NULL and a \[lq]service-name\[rq] \[lq]service-name\[rq] different from NULL and a \[lq]service-name\[rq]
equal to server \[lq]service-name\[rq] (default: no). equal to server \[lq]service-name\[rq] (default: no).
.RE
.SS BGP ROUTING .SS BGP ROUTING
.PP .PP
The routing configuration section is entered by the command The routing configuration section is entered by the command
@ -611,9 +533,11 @@ IP address, \f[I]as\f[R] is the remote AS number and
.SS NAMED ACCESS LISTS .SS NAMED ACCESS LISTS
.PP .PP
Named access lists may be defined with either of Named access lists may be defined with either of
.IP \[bu] 2 .PP
\f[B]ip\f[R] \f[B]access-list\f[R] \f[B]standard\f[R] \f[I]name\f[R] \f[B]ip\f[R] \f[B]access-list\f[R] \f[B]standard\f[R] \f[I]name\f[R]
.IP \[bu] 2 .PD 0
.P
.PD
\f[B]ip\f[R] \f[B]access-list\f[R] \f[B]extended\f[R] \f[I]name\f[R] \f[B]ip\f[R] \f[B]access-list\f[R] \f[B]extended\f[R] \f[I]name\f[R]
.PP .PP
Subsequent lines starting with permit or deny define the body of the Subsequent lines starting with permit or deny define the body of the
@ -621,16 +545,20 @@ access-list.
.SS Standard Access Lists .SS Standard Access Lists
.PP .PP
Standard access lists are defined with: Standard access lists are defined with:
.IP \[bu] 2 .PP
{\f[B]permit\f[R]|\f[B]deny\f[R]} \f[I]source\f[R] [\f[I]dest\f[R]] {\f[B]permit\f[R]|\f[B]deny\f[R]} \f[I]source\f[R] [\f[I]dest\f[R]]
.PP .PP
Where \f[I]source\f[R] and \f[I]dest\f[R] specify IP matches using one Where \f[I]source\f[R] and \f[I]dest\f[R] specify IP matches using one
of: of:
.IP \[bu] 2 .PP
\f[I]address\f[R] \f[I]wildard\f[R] \f[I]address\f[R] \f[I]wildard\f[R]
.IP \[bu] 2 .PD 0
.P
.PD
\f[B]host\f[R] \f[I]address\f[R] \f[B]host\f[R] \f[I]address\f[R]
.IP \[bu] 2 .PD 0
.P
.PD
\f[B]any\f[R] \f[B]any\f[R]
.PP .PP
\f[I]address\f[R] and \f[I]wildard\f[R] are in dotted-quad notation, \f[I]address\f[R] and \f[I]wildard\f[R] are in dotted-quad notation,
@ -644,7 +572,7 @@ The shorthand `host address' is equivalent to `\f[I]address\f[R]
.SS Extended Access Lists .SS Extended Access Lists
.PP .PP
Extended access lists are defined with: Extended access lists are defined with:
.IP \[bu] 2 .PP
{\f[B]permit\f[R]|\f[B]deny\f[R]} \f[I]proto\f[R] \f[I]source\f[R] {\f[B]permit\f[R]|\f[B]deny\f[R]} \f[I]proto\f[R] \f[I]source\f[R]
[\f[I]ports\f[R]] \f[I]dest\f[R] [\f[I]ports\f[R]] [\f[I]flags\f[R]] [\f[I]ports\f[R]] \f[I]dest\f[R] [\f[I]ports\f[R]] [\f[I]flags\f[R]]
.PP .PP
@ -654,33 +582,39 @@ above for standard lists.
.PP .PP
For TCP and UDP matches, source and destination may be optionally For TCP and UDP matches, source and destination may be optionally
followed by a ports specification: followed by a ports specification:
.IP \[bu] 2 .PP
{\f[B]eq|neq|gt|lt\f[R]} \f[I]port\f[R] {\f[B]eq|neq|gt|lt\f[R]} \f[I]port\f[R]
.IP \[bu] 2 .PD 0
.P
.PD
\f[B]range\f[R] \f[I]from\f[R] \f[I]to\f[R] \f[B]range\f[R] \f[I]from\f[R] \f[I]to\f[R]
.PP .PP
\f[I]flags\f[R] may be one of: \f[I]flags\f[R] may be one of:
.IP \[bu] 2 .PP
{\f[B]match-any|match-all\f[R]} {\f[B]match-any|match-all\f[R]}
{\f[B]+|-\f[R]}{\f[B]fin|syn|rst|psh|ack|urg\f[R]} \&... {\f[B]+|-\f[R]}{\f[B]fin|syn|rst|psh|ack|urg\f[R]} \&...
.RS 2 .IP
.PP .nf
\f[C]
Match packets with any or all of the tcp flags set (+) or clear (-). Match packets with any or all of the tcp flags set (+) or clear (-).
.RE \f[R]
.IP \[bu] 2 .fi
.PP
\f[B]established\f[R] \f[B]established\f[R]
.RS 2 .IP
.nf
\f[C]
Match \[dq]established\[dq] TCP connections: packets with RST or ACK set, and SYN clear.
\f[R]
.fi
.PP .PP
Match \[lq]established\[rq] TCP connections: packets with RST or ACK
set, and SYN clear.
.RE
.IP \[bu] 2
\f[B]fragments\f[R] \f[B]fragments\f[R]
.RS 2 .IP
.PP .nf
Match IP fragments. \f[C]
May not be specified on rules with layer 4 matches. Match IP fragments. May not be specified on rules with layer 4 matches.
.RE \f[R]
.fi
.SH SEE ALSO .SH SEE ALSO
.PP .PP
l2tpns(8), nsctl(8) l2tpns(8), nsctl(8)

113
docs/src/man/l2tpns.8.md
View file

@ -20,100 +20,79 @@ Once running, **l2tpns** may be controlled by telnetting to port 23 on the machi
# OPTIONS # OPTIONS
- **-d** Detach from terminal and fork into the background. By default l2tpns will stay in the foreground. **-d** Detach from terminal and fork into the background. By default l2tpns will stay in the foreground
. **-v** Increase verbosity for debugging. Can be used multiple times
- **-v** Increase verbosity for debugging. Can be used multiple times. **-c** _file_
Specify configuration file
. **-h** _hostname_
Force hostname to _hostname_
- **-c** _file_
Specify configuration file.
- **-h** _hostname_
Force hostname to _hostname_.
# FILES # FILES
- _/etc/l2tpns/startup-config_ _/etc/l2tpns/startup-config_
The default configuration file
The default configuration file. _/etc/l2tpns/ip\_pool_
IP address pool configuration
- _/etc/l2tpns/ip\_pool_ _/etc/l2tpns/users_
Username/password configuration for access to admin interface
IP address pool configuration.
- _/etc/l2tpns/users_
Username/password configuration for access to admin interface.
# SIGNALS # SIGNALS
- **SIGHUP** Reload the config from disk and re-open log file. **SIGHUP**
Reload the config from disk and re-open log file
. **SIGTERM**, **SIGINT**
Stop process. Tunnels and sessions are not terminated. This signal should be used to stop l2tpns on a cluster node where there are other machines to continue handling traffic
- **SIGTERM**, **SIGINT** **SIGQUIT**
Shut down tunnels and sessions, exit process when complete
Stop process. Tunnels and sessions are not terminated. This signal should be used to stop l2tpns on a cluster node where there are other machines to continue handling traffic.
- **SIGQUIT**
Shut down tunnels and sessions, exit process when complete.
# MANAGED RADIUS ATTRIBUTE # MANAGED RADIUS ATTRIBUTE
- **Ascend-Client-Primary-DNS**, **Ascend-Client-Secondary-DNS** **Ascend-Client-Primary-DNS**, **Ascend-Client-Secondary-DNS**
Specifies a primary and secondary DNS server address to send to user
Specifies a primary and secondary DNS server address to send to user. **Delegated-IPv6-Prefix**
Assign a network address IPv6 prefix to a user by DHCPv6
- **Delegated-IPv6-Prefix** **Framed-IP-Address**
The address to be configured for the user (IPv4 address of the interface ppp)
Assign a network address IPv6 prefix to a user by DHCPv6. **Framed-Route**
provides routing information to be configured for the user
- **Framed-IP-Address** **Framed-IPv6-Route**
Has the same action as **Delegated-IPv6-Prefix**. **Delegated-IPv6-Prefix** is the correct one to use
The address to be configured for the user (IPv4 address of the interface ppp). **Framed-IPv6-Address**
IPv6 address to be assigned to the user by DHCPv6 (IPv6 address of the interface ppp)
- **Framed-Route** **Idle-Timeout**
disconnects the session if no data for more than **Idle-Timeout** (in seconds)
provides routing information to be configured for the user. **Session-Timeout**
disconnects the user session when the time **Session-Timeout** is reached (in seconds)
- **Framed-IPv6-Route** **Tunnel-Type**, **Tunnel-Medium-Type**, **Tunnel-Server-Endpoint**, **Tunnel-Password**, **Tunnel-Assignment-Id**
attributes returned by the Radius of the remote LNS server (LAC functionality)
Has the same action as **Delegated-IPv6-Prefix**. **Delegated-IPv6-Prefix** is the correct one to use.
- **Framed-IPv6-Address**
IPv6 address to be assigned to the user by DHCPv6 (IPv6 address of the interface ppp).
- **Idle-Timeout**
disconnects the session if no data for more than **Idle-Timeout** (in seconds).
- **Session-Timeout**
disconnects the user session when the time **Session-Timeout** is reached (in seconds).
- **Tunnel-Type**, **Tunnel-Medium-Type**, **Tunnel-Server-Endpoint**, **Tunnel-Password**, **Tunnel-Assignment-Id**
attributes returned by the Radius of the remote LNS server (LAC functionality).
example, Radius that return the information of 2 remote LNS server with which must be open a L2TP TUNNEL: example, Radius that return the information of 2 remote LNS server with which must be open a L2TP TUNNEL:
- **Tunnel-Type**: 1 = L2TP - Tunnel-Type: 1 = L2TP
- **Tunnel-Medium-Type**: 1 = IPv4 - Tunnel-Medium-Type: 1 = IPv4
- **Tunnel-Password**: 1 = "TheSecretL2TP" - Tunnel-Password: 1 = "TheSecretL2TP"
- **Tunnel-Server-Endpoint**: 1 = "88.xx.xx.x1" - Tunnel-Server-Endpoint: 1 = "88.xx.xx.x1"
- **Tunnel-Assignment-Id**: 1 = "friendisp\_lns1" - Tunnel-Assignment-Id: 1 = "friendisp_lns1"
- **Tunnel-Type**: 2 = L2TP - Tunnel-Type: 2 = L2TP
- **Tunnel-Medium-Type**: 2 = IPv4 - Tunnel-Medium-Type: 2 = IPv4
- **Tunnel-Password**: 2 = "TheSecretL2TP" - Tunnel-Password: 2 = "TheSecretL2TP"
- **Tunnel-Server-Endpoint**: 2 = "88.xx.xx.x2" - Tunnel-Server-Endpoint: 2 = "88.xx.xx.x2"
- **Tunnel-Assignment-Id**: 2 = "friendisp\_lns2" - Tunnel-Assignment-Id: 2 = "friendisp_lns2"
# SEE ALSO # SEE ALSO

20
docs/src/man/nsctl.8.md
View file

@ -23,37 +23,33 @@ sessions via functions provided by those plugins.
OPTIONS OPTIONS
======= =======
**-d** **-d** Enable debugging output
: Enable debugging output.
**-h *host*\[:*port*\]** **-h *host*\[:*port*\]**
The host running **l2tpns** that should receive the message. By
: The host running **l2tpns** that should receive the message. By default the message is sent to UDP port 1702 on **localhost**
default the message is sent to UDP port 1702 on **localhost**.
**-t *timeout*** **-t *timeout***
Timeout in seconds to wait for a response from the server
: Timeout in seconds to wait for a response from the server.
COMMANDS COMMANDS
======== ========
The first argument specifies the command to send to **l2tpns .** The The first argument specifies the command to send to **l2tpns.** The
following commands are as defined: following commands are as defined:
**load\_plugin ***plugin* **load\_plugin ***plugin*
: Load the named *plugin*. : Load the named *plugin*
**unload\_plugin ***plugin* **unload\_plugin ***plugin*
: Unload the named *plugin*. : Unload the named *plugin*
**help** **help**
: Each loaded plugin is queried for what commands it supports and the : Each loaded plugin is queried for what commands it supports and the
synopsis for each is output. synopsis for each is output
Any other value of *command* (and *args* if any) are sent to **l2tpns** Any other value of *command* (and *args* if any) are sent to **l2tpns**
as-is, to be passed to each plugin which registers a **plugin\_control** as-is, to be passed to each plugin which registers a **plugin\_control**

276
docs/src/man/startup-config.5.md
View file

@ -22,79 +22,79 @@ interface. Comments are indicated by either the character # or !.
Settings are specified with Settings are specified with
- **set** `variable` `value` **set** `variable` `value`
A list of the possible configuration directives follows. Each of these should be set by a line like: A list of the possible configuration directives follows. Each of these should be set by a line like:
- **set** _configstring_ _"value"_ **set** _configstring_ _"value"_
- **set** _ipaddress_ _192.168.1.1_ **set** _ipaddress_ _192.168.1.1_
- **set** _boolean_ _true_ **set** _boolean_ _true_
The following `variables` may be set: The following `variables` may be set:
- **accounting\_dir** (string) **accounting\_dir** (string)
If set to a directory, then every 5 minutes the current usage for every connected use will be dumped to a file in this directory. Each file dumped begins with a header, where each line is prefixed by #. Following the header is a single line for every connected user, fields separated by a space. If set to a directory, then every 5 minutes the current usage for every connected use will be dumped to a file in this directory. Each file dumped begins with a header, where each line is prefixed by #. Following the header is a single line for every connected user, fields separated by a space.
The fields are username, ip, qos, uptxoctets, downrxoctets, origin (optional). The qos field is 1 if a standard user, and 2 if the user is throttled. The origin field is dump if **account\_all\_origin** is set to true (origin value: L=LAC data, R=Remote LNS data, P=PPPOE data). The fields are username, ip, qos, uptxoctets, downrxoctets, origin (optional). The qos field is 1 if a standard user, and 2 if the user is throttled. The origin field is dump if account_all_origin is set to true (origin value: L=LAC data, R=Remote LNS data, P=PPPOE data).
- **account\_all\_origin** (boolean) **account\_all\_origin** (boolean)
If set to true, all origin of the usage is dumped to the accounting file (LAC+Remote LNS+PPPOE)(default false). If set to true, all origin of the usage is dumped to the accounting file (LAC+Remote LNS+PPPOE)(default false).
- **allow\_duplicate\_users** (boolean) **allow\_duplicate\_users** (boolean)
Allow multiple logins with the same username. If false (the default), any prior session with the same username will be dropped when a new session is established. Allow multiple logins with the same username. If false (the default), any prior session with the same username will be dropped when a new session is established.
- **auth\_tunnel\_change\_addr\_src** (boolean) **auth\_tunnel\_change\_addr\_src** (boolean)
This parameter authorize to change the source IP of the tunnels l2tp. This parameter can be used when the remotes BAS/LAC are l2tpns server configured in cluster mode, but that the interface to remote LNS are not clustered (the tunnel can be coming from different source IP) (default: no). This parameter authorize to change the source IP of the tunnels l2tp. This parameter can be used when the remotes BAS/LAC are l2tpns server configured in cluster mode, but that the interface to remote LNS are not clustered (the tunnel can be coming from different source IP) (default: no).
- **bind\_address** (ip address) **bind\_address** (ip address)
It's the listen address of the l2tp udp protocol sent and received to LAC. This address is also assigned to the tun interface if no iftun\_address is specified. Packets containing user traffic should be routed via this address if given, otherwise the primary address of the machine. It's the listen address of the l2tp udp protocol sent and received to LAC. This address is also assigned to the tun interface if no iftun_address is specified. Packets containing user traffic should be routed via this address if given, otherwise the primary address of the machine.
- **bind\_multi\_address** (ip address) **bind\_multi\_address** (ip address)
This parameter permit one to listen several address of the l2tp udp protocol (and set several address to the tun interface). This parameter permit one to listen several address of the l2tp udp protocol (and set several address to the tun interface).
WHEN this parameter is set, It OVERWRITE the parameters "bind\_address" and "iftun\_address". WHEN this parameter is set, It OVERWRITE the parameters "bind_address" and "iftun_address".
these can be interesting when you want do load-balancing in cluster mode of the uploaded from the LAC. For example you can set a bgp.prepend(MY\_AS) for Address1 on LNS1 and a bgp.prepend(MY\_AS) for Address2 on LNS2 (see BGP AS-path prepending). these can be interesting when you want do load-balancing in cluster mode of the uploaded from the LAC. For example you can set a bgp.prepend(MY_AS) for Address1 on LNS1 and a bgp.prepend(MY_AS) for Address2 on LNS2 (see BGP AS-path prepending).
example of use with 2 address: example of use with 2 address:
**set** _bind\_multi\_address_ "64.14.13.41, 64.14.13.42" set bind_multi_address "64.14.13.41, 64.14.13.42"
- **cluster\_address** (ip address) **cluster\_address** (ip address)
Multicast cluster address (default: 239.192.13.13). See the section on Clustering for more information. Multicast cluster address (default: 239.192.13.13). See the section on Clustering for more information.
- **Bcluster\_port** (int) **cluster\_port** (int)
UDP cluster port (default: 32792). See the section on Clustering for more information. UDP cluster port (default: 32792). See the section on Clustering for more information.
- **cluster\_interface** (string) **cluster\_interface** (string)
Interface for cluster packets (default: eth0). Interface for cluster packets (default: eth0).
- **cluster\_mcast\_ttl** (int) **cluster\_mcast\_ttl** (int)
TTL for multicast packets (default: 1). TTL for multicast packets (default: 1).
- **cluster\_hb\_interval** (int) **cluster\_hb\_interval** (int)
Interval in tenths of a second between cluster heartbeat/pings. Interval in tenths of a second between cluster heartbeat/pings.
- **cluster\_hb\_timeout** (int) **cluster\_hb\_timeout** (int)
Cluster heartbeat timeout in tenths of a second. A new master will be elected when this interval has been passed without seeing a heartbeat from the master. Cluster heartbeat timeout in tenths of a second. A new master will be elected when this interval has been passed without seeing a heartbeat from the master.
- **cluster\_master\_min\_adv** (int) **cluster\_master\_min\_adv** (int)
Determines the minimum number of up to date slaves required before the master will drop routes (default: 1). Determines the minimum number of up to date slaves required before the master will drop routes (default: 1).
- **debug** (int) **debug** (int)
Set the level of debugging messages written to the log file. The value should Set the level of debugging messages written to the log file. The value should
be between 0 and 5, with 0 being no debugging, and 5 being the highest. be between 0 and 5, with 0 being no debugging, and 5 being the highest.
@ -109,224 +109,224 @@ The following `variables` may be set:
Note that the higher you set the debugging level, the slower the program will run. Also, at level 5 a LOT of information will be logged. This should only ever be used for working out why it doesn't work at all. Note that the higher you set the debugging level, the slower the program will run. Also, at level 5 a LOT of information will be logged. This should only ever be used for working out why it doesn't work at all.
- **dump\_speed** (boolean) **dump\_speed** (boolean)
If set to true, then the current bandwidth utilization will be logged every second. Even if this is disabled, you can see this information by running the uptime command on the CLI. If set to true, then the current bandwidth utilization will be logged every second. Even if this is disabled, you can see this information by running the uptime command on the CLI.
- **disable\_sending\_hello** (boolean) **disable\_sending\_hello** (boolean)
Disable l2tp sending HELLO message for Apple compatibility. Some OS X implementation of l2tp no manage the L2TP "HELLO message". (default: no). Disable l2tp sending HELLO message for Apple compatibility. Some OS X implementation of l2tp no manage the L2TP "HELLO message". (default: no).
- **echo\_timeout** (int) **echo\_timeout** (int)
Time between last packet sent and LCP ECHO generation (default: 10 (seconds)). Time between last packet sent and LCP ECHO generation (default: 10 (seconds)).
- **guest\_account** **guest\_account**
Allow multiple logins matching this specific username. Allow multiple logins matching this specific username.
- **icmp\_rate** (int) **icmp\_rate** (int)
Maximum number of host unreachable ICMP packets to send per second. Maximum number of host unreachable ICMP packets to send per second.
- **idle\_echo\_timeout** (int) **idle\_echo\_timeout** (int)
Drop sessions who have not responded within idle\_echo\_timeout seconds (default: 240 (seconds)) Drop sessions who have not responded within idle_echo_timeout seconds (default: 240 (seconds))
- **iftun\_address** (ip address) **iftun\_address** (ip address)
This parameter is used when you want a tun interface address different from the address of "bind\_address" (For use in cases of specific configuration). If no address is given to iftun\_address and bind\_address, 1.1.1.1 is used. This parameter is used when you want a tun interface address different from the address of "bind_address" (For use in cases of specific configuration). If no address is given to iftun_address and bind_address, 1.1.1.1 is used.
- **l2tp\_mtu** (int) **l2tp\_mtu** (int)
MTU of interface for L2TP traffic (default: 1500). Used to set link MRU and adjust TCP MSS. MTU of interface for L2TP traffic (default: 1500). Used to set link MRU and adjust TCP MSS.
- **l2tp\_secret** (string) **l2tp\_secret** (string)
The secret used by l2tpns for authenticating tunnel request. Must be the same as the LAC, or authentication will fail. Only actually be used if the LAC requests authentication. The secret used by l2tpns for authenticating tunnel request. Must be the same as the LAC, or authentication will fail. Only actually be used if the LAC requests authentication.
- **lock\_pages** (boolean) **lock\_pages** (boolean)
Keep all pages mapped by the l2tpns process in memory. Keep all pages mapped by the l2tpns process in memory.
- **log\_file** (string) **log\_file** (string)
This will be where all logging and debugging information is written to.This may be either a filename, such as /var/log/l2tpns, or the string syslog:facility, where facility is any one of the syslog logging facilities, such as local5. This will be where all logging and debugging information is written to.This may be either a filename, such as /var/log/l2tpns, or the string syslog:facility, where facility is any one of the syslog logging facilities, such as local5.
- **multi\_read\_count** (int) **multi\_read\_count** (int)
Number of packets to read off each of the UDP and TUN fds when returned as readable by select (default: 10). Avoids incurring the unnecessary system call overhead of select on busy servers. Number of packets to read off each of the UDP and TUN fds when returned as readable by select (default: 10). Avoids incurring the unnecessary system call overhead of select on busy servers.
- **packet\_limit** (int> **packet\_limit** (int>
Maximum number of packets of downstream traffic to be handled each tenth of a second per session. If zero, no limit is applied (default: 0). Intended as a DoS prevention mechanism and not a general throttling control (packets are dropped, not queued). Maximum number of packets of downstream traffic to be handled each tenth of a second per session. If zero, no limit is applied (default: 0). Intended as a DoS prevention mechanism and not a general throttling control (packets are dropped, not queued).
- **peer\_address** (ip address) **peer\_address** (ip address)
Address to send to clients as the default gateway. Address to send to clients as the default gateway.
- **pid\_file** (string) **pid\_file** (string)
If set, the process id will be written to the specified file. The value must be an absolute path. If set, the process id will be written to the specified file. The value must be an absolute path.
- **ppp\_keepalive** (boolean) **ppp\_keepalive** (boolean)
Change this value to no to force generation of LCP ECHO every echo\_timeout seconds, even there are activity on the link (default: yes) Change this value to no to force generation of LCP ECHO every echo\_timeout seconds, even there are activity on the link (default: yes)
- **ppp\_restart\_time** (int) **ppp\_restart\_time** (int)
- **ppp\_max\_configure** (int) **ppp\_max\_configure** (int)
- **ppp\_max\_failure** (int) **ppp\_max\_failure** (int)
PPP counter and timer values, as described in Section 4.1 of RFC1661. PPP counter and timer values, as described in Section 4.1 of RFC1661.
_ppp\_restart\_time_, Restart timer for PPP protocol negotiation in seconds (default: 3). _ppp\_restart\_time_, Restart timer for PPP protocol negotiation in seconds (default: 3).
_ppp\_max\_configure_, Number of configure requests to send before giving up (default: 10). _ppp\_max\_configure_, Number of configure requests to send before giving up (default: 10).
_ppp\_max\_failure_, Number of Configure-Nak requests to send before sending a Configure-Reject (default: 5). _ppp\_max\_failure_, Number of Configure-Nak requests to send before sending a Configure-Reject (default: 5).
- **primary\_dns** (ip address), **secondary\_dns** (ip address) **primary\_dns** (ip address), **secondary\_dns** (ip address)
Whenever a PPP connection is established, DNS servers will be sent to the user, both a primary and a secondary. If either is set to 0.0.0.0, then that one will not be sent. Whenever a PPP connection is established, DNS servers will be sent to the user, both a primary and a secondary. If either is set to 0.0.0.0, then that one will not be sent.
- **primary\_radius** (ip address), **secondary\_radius** (ip address) **primary\_radius** (ip address), **secondary\_radius** (ip address)
Sets the RADIUS servers used for both authentication and accounting. If the primary server does not respond, then the secondary RADIUS server will be tried. Sets the RADIUS servers used for both authentication and accounting. If the primary server does not respond, then the secondary RADIUS server will be tried.
Note: in addition to the source IP address and identifier, the RADIUS server must include the source port when detecting duplicates to suppress (in order to cope with a large number of sessions coming on-line simultaneously l2tpns uses a set of udp sockets, each with a separate identifier). Note: in addition to the source IP address and identifier, the RADIUS server must include the source port when detecting duplicates to suppress (in order to cope with a large number of sessions coming on-line simultaneously l2tpns uses a set of udp sockets, each with a separate identifier).
- **primary\_radius\_port** (short), **secondary\_radius\_port** (short) **primary\_radius\_port** (short), **secondary\_radius\_port** (short)
Sets the authentication ports for the primary and secondary RADIUS servers. The accounting port is one more than the authentication port. If no RADIUS ports are given, the authentication port defaults to 1645, and the accounting port to 1646. Sets the authentication ports for the primary and secondary RADIUS servers. The accounting port is one more than the authentication port. If no RADIUS ports are given, the authentication port defaults to 1645, and the accounting port to 1646.
- **radius\_accounting** (boolean) **radius\_accounting** (boolean)
If set to true, then RADIUS accounting packets will be sent. This means that a **Start** record will be sent when the session is successfully authenticated, and a **Stop** record will be sent when the session is closed. If set to true, then RADIUS accounting packets will be sent. This means that a **Start** record will be sent when the session is successfully authenticated, and a **Stop** record will be sent when the session is closed.
- **radius\_interim** (int) **radius\_interim** (int)
If radius\_accounting is on, defines the interval between sending of RADIUS interim accounting records (in seconds). If radius\_accounting is on, defines the interval between sending of RADIUS interim accounting records (in seconds).
- **radius\_secret** (string) **radius\_secret** (string)
This secret will be used in all RADIUS queries. If this is not set then RADIUS queries will fail. This secret will be used in all RADIUS queries. If this is not set then RADIUS queries will fail.
- **radius\_authtypes** (string) **radius\_authtypes** (string)
A comma separated list of supported RADIUS authentication methods ("pap" or "chap"), in order of preference (default "pap"). A comma separated list of supported RADIUS authentication methods ("pap" or "chap"), in order of preference (default "pap").
- **radius\_dae\_port** (short) **radius\_dae\_port** (short)
Port for DAE RADIUS (Packet of Death/Disconnect, Change of Authorization) requests (default: 3799). Port for DAE RADIUS (Packet of Death/Disconnect, Change of Authorization) requests (default: 3799).
- **radius\_bind\_min**, **radius\_bind\_max** (int) **radius\_bind\_min**, **radius\_bind\_max** (int)
Define a port range in which to bind sockets used to send and receive RADIUS packets. Must be at least RADIUS\_FDS (64) wide. Simplifies firewalling of RADIUS ports (default: dynamically assigned). Define a port range in which to bind sockets used to send and receive RADIUS packets. Must be at least RADIUS\_FDS (64) wide. Simplifies firewalling of RADIUS ports (default: dynamically assigned).
- **random\_device** (string) **random\_device** (string)
Path to random data source (default /dev/urandom). Use "" to use the rand() library function. Path to random data source (default /dev/urandom). Use "" to use the rand() library function.
- **scheduler\_fifo** (boolean) **scheduler\_fifo** (boolean)
Sets the scheduling policy for the l2tpns process to SCHED\_FIFO. This causes the kernel to immediately preempt any currently running SCHED\_OTHER (normal) process in favour of l2tpns when it becomes runnable. Ignored on uniprocessor systems. Sets the scheduling policy for the l2tpns process to SCHED\_FIFO. This causes the kernel to immediately preempt any currently running SCHED\_OTHER (normal) process in favour of l2tpns when it becomes runnable. Ignored on uniprocessor systems.
- **send\_garp** (boolean) **send\_garp** (boolean)
Determines whether or not to send a gratuitous ARP for the bind\_address when the server is ready to handle traffic (default: true). This value is ignored if BGP is configured. Determines whether or not to send a gratuitous ARP for the bind\_address when the server is ready to handle traffic (default: true). This value is ignored if BGP is configured.
- **tundevicename** (string) **tundevicename** (string)
Name of the tun interface (default: "tun0"). Name of the tun interface (default: "tun0").
- **throttle\_speed** (int) **throttle\_speed** (int)
Sets the default speed (in kbits/s) which sessions will be limited to. If this is set to 0, then throttling will not be used at all. Note: You can set this by the CLI, but changes will not affect currently connected users. Sets the default speed (in kbits/s) which sessions will be limited to. If this is set to 0, then throttling will not be used at all. Note: You can set this by the CLI, but changes will not affect currently connected users.
- **throttle\_buckets** (int) **throttle\_buckets** (int)
Number of token buckets to allocate for throttling. Each throttled session requires two buckets (in and out). Number of token buckets to allocate for throttling. Each throttled session requires two buckets (in and out).
## DHCPv6 And IPv6 SETTINGS ## DHCPv6 And IPv6 SETTINGS
- **dhcp6\_preferred\_lifetime** (int) **dhcp6\_preferred\_lifetime** (int)
The preferred lifetime for the IPv6 address and the IPv6 prefix address, expressed in units of seconds (see rfc3315). The preferred lifetime for the IPv6 address and the IPv6 prefix address, expressed in units of seconds (see rfc3315).
- **dhcp6\_valid\_lifetime** (int) **dhcp6\_valid\_lifetime** (int)
The valid lifetime for the IPv6 address and the IPv6 prefix address, expressed in units of seconds (see rfc3315). The valid lifetime for the IPv6 address and the IPv6 prefix address, expressed in units of seconds (see rfc3315).
- **dhcp6\_server\_duid** (int) **dhcp6\_server\_duid** (int)
DUID Based on Link-layer Address (DUID-LL) (see rfc3315). DUID Based on Link-layer Address (DUID-LL) (see rfc3315).
- **primary\_ipv6\_dns**, **secondary\_ipv6\_dns** (Ipv6 address) **primary\_ipv6\_dns**, **secondary\_ipv6\_dns** (Ipv6 address)
IPv6 DNS servers will be sent to the user (see rfc3646). IPv6 DNS servers will be sent to the user (see rfc3646).
- **default\_ipv6\_domain\_list** (string) **default\_ipv6\_domain\_list** (string)
The Domain Search List (ex: "fdn.fr") (see rfc3646). The Domain Search List (ex: "fdn.fr") (see rfc3646).
- **ipv6\_prefix** (Ipv6 address) **ipv6\_prefix** (Ipv6 address)
Enable negotiation of IPv6. This forms the the first 64 bits of the client allocated address. The remaining 64 come from the allocated IPv4 address and 4 bytes of 0. Enable negotiation of IPv6. This forms the the first 64 bits of the client allocated address. The remaining 64 come from the allocated IPv4 address and 4 bytes of 0.
## LAC SETTINGS ## LAC SETTINGS
- **bind\_address\_remotelns** (ip address) **bind\_address\_remotelns** (ip address)
Address of the interface to listen the remote LNS tunnels. If no address is given, all interfaces are listened (Any Address). Address of the interface to listen the remote LNS tunnels. If no address is given, all interfaces are listened (Any Address).
- **bind\_portremotelns** (short) **bind\_portremotelns** (short)
Port to bind for the Remote LNS (default: 65432). Port to bind for the Remote LNS (default: 65432).
A static REMOTES LNS configuration can be entered by the command: A static REMOTES LNS configuration can be entered by the command:
- **setforward** _MASK_ _IP_ _PORT_ _SECRET_ **setforward** _MASK_ _IP_ _PORT_ _SECRET_
where MASK specifies the mask of users who have forwarded to remote LNS (ex: "/friendISP@company.com"). where MASK specifies the mask of users who have forwarded to remote LNS (ex: "/friendISP@company.com").
where IP specifies the IP of the remote LNS (ex: "66.66.66.55"). where IP specifies the IP of the remote LNS (ex: "66.66.66.55").
where PORT specifies the L2TP Port of the remote LNS (Normally should be 1701) (ex: 1701). where PORT specifies the L2TP Port of the remote LNS (Normally should be 1701) (ex: 1701).
where SECRET specifies the secret password the remote LNS (ex: mysecret). where SECRET specifies the secret password the remote LNS (ex: mysecret).
The static REMOTE LNS configuration can be used when the friend ISP not have a proxied Radius. The static REMOTE LNS configuration can be used when the friend ISP not have a proxied Radius.
If a proxied Radius is used, It will return the RADIUS attributes: If a proxied Radius is used, It will return the RADIUS attributes:
- Tunnel-Type:1 = L2TP Tunnel-Type:1 = L2TP
- Tunnel-Medium-Type:1 = IPv4 Tunnel-Medium-Type:1 = IPv4
- Tunnel-Password:1 = "LESECRETL2TP" Tunnel-Password:1 = "LESECRETL2TP"
- Tunnel-Server-Endpoint:1 = "88.xx.xx.x1" Tunnel-Server-Endpoint:1 = "88.xx.xx.x1"
- Tunnel-Assignment-Id:1 = "friendisp\_lns1" Tunnel-Assignment-Id:1 = "friendisp\_lns1"
- Tunnel-Type:2 += L2TP Tunnel-Type:2 += L2TP
- Tunnel-Medium-Type:2 += IPv4 Tunnel-Medium-Type:2 += IPv4
- Tunnel-Password:2 += "LESECRETL2TP" Tunnel-Password:2 += "LESECRETL2TP"
- Tunnel-Server-Endpoint:2 += "88.xx.xx.x2" Tunnel-Server-Endpoint:2 += "88.xx.xx.x2"
- Tunnel-Assignment-Id:2 += "friendisp\_lns2" Tunnel-Assignment-Id:2 += "friendisp\_lns2"
## PPPOE SETTINGS ## PPPOE SETTINGS
- **pppoe\_if\_to\_bind** (string) **pppoe\_if\_to\_bind** (string)
PPPOE server interface to bind (ex: "eth0.12"), If not specified the server PPPOE is not enabled. For the pppoe clustering, all the interfaces PPPOE of the clusters must use the same HW address (MAC address). PPPOE server interface to bind (ex: "eth0.12"), If not specified the server PPPOE is not enabled. For the pppoe clustering, all the interfaces PPPOE of the clusters must use the same HW address (MAC address).
- **pppoe\_service\_name** (string) **pppoe\_service\_name** (string)
PPPOE service name (default: NULL). PPPOE service name (default: NULL).
- **pppoe\_ac\_name** (string) **pppoe\_ac\_name** (string)
PPPOE access concentrator name (default: "l2tpns-pppoe"). PPPOE access concentrator name (default: "l2tpns-pppoe").
- **pppoe\_only\_equal\_svc\_name** (boolean) **pppoe\_only\_equal\_svc\_name** (boolean)
If set to yes, the PPPOE server only accepts clients with a "service-name" different from NULL and a "service-name" equal to server "service-name" (default: no). If set to yes, the PPPOE server only accepts clients with a "service-name" different from NULL and a "service-name" equal to server "service-name" (default: no).
## BGP ROUTING ## BGP ROUTING
@ -348,8 +348,8 @@ Where _peer_ specifies the BGP neighbour as either a hostname or IP address, _as
Named access lists may be defined with either of Named access lists may be defined with either of
- **ip** **access-list** **standard** _name_ **ip** **access-list** **standard** _name_
- **ip** **access-list** **extended** _name_ **ip** **access-list** **extended** _name_
Subsequent lines starting with permit or deny define the body of the access-list. Subsequent lines starting with permit or deny define the body of the access-list.
@ -357,13 +357,13 @@ Subsequent lines starting with permit or deny define the body of the access-list
Standard access lists are defined with: Standard access lists are defined with:
- {**permit**|**deny**} _source_ \[_dest_\] {**permit**|**deny**} _source_ \[_dest_\]
Where _source_ and _dest_ specify IP matches using one of: Where _source_ and _dest_ specify IP matches using one of:
- _address_ _wildard_ _address_ _wildard_
- **host** _address_ **host** _address_
- **any** **any**
_address_ and _wildard_ are in dotted-quad notation, bits in the _wildard_ indicate which address bits in _address_ are relevant to the match (0 = exact match; 1 = don't care). _address_ and _wildard_ are in dotted-quad notation, bits in the _wildard_ indicate which address bits in _address_ are relevant to the match (0 = exact match; 1 = don't care).
@ -373,26 +373,26 @@ The shorthand 'host address' is equivalent to '_address_ **0.0.0.0**'; '**any**'
Extended access lists are defined with: Extended access lists are defined with:
- {**permit**|**deny**} _proto_ _source_ \[_ports_\] _dest_ \[_ports_\] \[_flags_\] {**permit**|**deny**} _proto_ _source_ \[_ports_\] _dest_ \[_ports_\] \[_flags_\]
Where _proto_ is one of **ip**, **tcp** or **udp**, and _source_ and _dest_ are as described above for standard lists. Where _proto_ is one of **ip**, **tcp** or **udp**, and _source_ and _dest_ are as described above for standard lists.
For TCP and UDP matches, source and destination may be optionally followed by a ports specification: For TCP and UDP matches, source and destination may be optionally followed by a ports specification:
- {**eq|neq|gt|lt**} _port_ {**eq|neq|gt|lt**} _port_
- **range** _from_ _to_ **range** _from_ _to_
_flags_ may be one of: _flags_ may be one of:
- {**match-any|match-all**} {**+|-**}{**fin|syn|rst|psh|ack|urg**} ... {**match-any|match-all**} {**+|-**}{**fin|syn|rst|psh|ack|urg**} ...
Match packets with any or all of the tcp flags set (+) or clear (-). Match packets with any or all of the tcp flags set (+) or clear (-).
- **established** **established**
Match "established" TCP connections: packets with RST or ACK set, and SYN clear. Match "established" TCP connections: packets with RST or ACK set, and SYN clear.
- **fragments** **fragments**
Match IP fragments. May not be specified on rules with layer 4 matches. Match IP fragments. May not be specified on rules with layer 4 matches.