X-Git-Url: https://tinc-vpn.org/git/browse?p=tinc;a=blobdiff_plain;f=doc%2Ftinc.conf.5.in;h=1d2f17f99459415c8c3862c1552176dad8e26e7b;hp=ce690308c05bec244d655b30e624ae47312a2a6a;hb=a7dbb50c23f447a23b543c92ec096ff178bc2de3;hpb=23acc19bc090051156ad895caed61848f5afb144 diff --git a/doc/tinc.conf.5.in b/doc/tinc.conf.5.in index ce690308..1d2f17f9 100644 --- a/doc/tinc.conf.5.in +++ b/doc/tinc.conf.5.in @@ -129,12 +129,24 @@ If is selected, then depending on the operating system both IPv4 and IPv6 or just IPv6 listening sockets will be created. -.It Va BindToAddress Li = Ar address Bq experimental +.It Va BindToAddress Li = Ar address Oo Ar port Oc Bq experimental If your computer has more than one IPv4 or IPv6 address, .Nm tinc will by default listen on all of them for incoming connections. -It is possible to bind only to a single address with this variable. - +Multiple +.Va BindToAddress +variables may be specified, +in which case listening sockets for each specified address are made. +.Pp +If no +.Ar port +is specified, the socket will be bound to the port specified by the +.Va Port +option, or to port 655 if neither is given. +To only bind to a specific port but not to a specific address, use +.Li * +for the +.Ar address . .Pp This option may not work on all platforms. @@ -147,6 +159,9 @@ It is possible to bind only to a single interface with this variable. .Pp This option may not work on all platforms. +.It Va Broadcast Li = yes | no Po yes Pc Bq experimental +When disabled, tinc will drop all broadcast and multicast packets, in both router and switch mode. + .It Va ConnectTo Li = Ar name Specifies which other tinc daemon to connect to on startup. Multiple @@ -165,6 +180,14 @@ If you don't specify a host with won't try to connect to other daemons at all, and will instead just listen for incoming connections. +.It Va DecrementTTL Li = yes | no Po yes Pc +When enabled, +.Nm tinc +will decrement the Time To Live field in IPv4 packets, or the Hop Limit field in IPv6 packets, +before forwarding a received packet to the virtual network device or to another node, +and will drop packets that have a TTL value of zero, +in which case it will send an ICMP Time Exceeded packet back. + .It Va Device Li = Ar device Po Pa /dev/tap0 , Pa /dev/net/tun No or other depending on platform Pc The virtual network device to use. .Nm tinc @@ -177,30 +200,65 @@ instead of The info pages of the tinc package contain more information about configuring the virtual network device. -.It Va DeviceType Li = tun | tunnohead | tunifhead | tap Po only supported on BSD platforms Pc +.It Va DeviceType Li = Ar type Pq platform dependent The type of the virtual network device. -Tinc will normally automatically select the right type, and this option should not be used. -However, in case tinc does not seem to correctly interpret packets received from the virtual network device, -using this option might help. +Tinc will normally automatically select the right type of tun/tap interface, and this option should not be used. +However, this option can be used to select one of the special interface types, if support for them is compiled in. .Bl -tag -width indent -.It tun +.It dummy +Use a dummy interface. +No packets are ever read or written to a virtual network device. +Useful for testing, or when setting up a node that only forwards packets for other nodes. + +.It raw_socket +Open a raw socket, and bind it to a pre-existing +.Va Interface +(eth0 by default). +All packets are read from this interface. +Packets received for the local node are written to the raw socket. +However, at least on Linux, the operating system does not process IP packets destined for the local host. + +.It uml Pq not compiled in by default +Create a UNIX socket with the filename specified by +.Va Device , +or +.Pa @localstatedir@/run/ Ns Ar NETNAME Ns Pa .umlsocket +if not specified. +.Nm tinc +will wait for a User Mode Linux instance to connect to this socket. + +.It vde Pq not compiled in by default +Uses the libvdeplug library to connect to a Virtual Distributed Ethernet switch, +using the UNIX socket specified by +.Va Device , +or +.Pa @localstatedir@/run/vde.ctl +if not specified. +.El + +Also, in case tinc does not seem to correctly interpret packets received from the virtual network device, +it can be used to change the way packets are interpreted: + +.Bl -tag -width indent + +.It tun Pq BSD and Linux Set type to tun. Depending on the platform, this can either be with or without an address family header (see below). -.It tunnohead +.It tunnohead Pq BSD Set type to tun without an address family header. Tinc will expect packets read from the virtual network device to start with an IP header. On some platforms IPv6 packets cannot be read from or written to the device in this mode. -.It tunifhead +.It tunifhead Pq BSD Set type to tun with an address family header. Tinc will expect packets read from the virtual network device to start with a four byte header containing the address family, followed by an IP header. This mode should support both IPv4 and IPv6 packets. -.It tap +.It tap Pq BSD and Linux Set type to tap. Tinc will expect packets read from the virtual network device to start with an Ethernet header. @@ -271,6 +329,18 @@ This option controls the period the encryption keys used to encrypt the data are It is common practice to change keys at regular intervals to make it even harder for crackers, even though it is thought to be nearly impossible to crack a single key. +.It Va LocalDiscovery Li = yes | no Po no Pc Bq experimental +When enabled, +.Nm tinc +will try to detect peers that are on the same local network. +This will allow direct communication using LAN addresses, even if both peers are behind a NAT +and they only ConnectTo a third node outside the NAT, +which normally would prevent the peers from learning each other's LAN address. + +.Pp +Currently, local discovery is implemented by sending broadcast packets to the LAN during path MTU discovery. +This feature may not work in all possible situations. + .It Va MACExpire Li = Ar seconds Pq 600 This option controls the amount of time MAC addresses are kept before they are removed. This only has effect when @@ -391,7 +461,7 @@ Since host configuration files only contain public keys, no secrets are revealed by sending out this information. .Bl -tag -width indent -.It Va Address Li = Ar address Oo port Oc Bq recommended +.It Va Address Li = Ar address Oo Ar port Oc Bq recommended The IP address or hostname of this tinc daemon on the real network. This will only be used when trying to make an outgoing connection to this tinc daemon. Optionally, a port can be specified to use for this address.