X-Git-Url: https://www.tinc-vpn.org/git/browse?p=tinc;a=blobdiff_plain;f=doc%2Ftinc.conf.5.in;h=cd7d1a0d2e268e26a3550055b1f22fe18696d240;hp=0548628f623e2fc53c89e0dd697e1f114a3d8260;hb=dff4955ddec1d318a56997388f367186c5b8078c;hpb=110ca1958af2465e383b4ca20b67fd0e780f3fb5 diff --git a/doc/tinc.conf.5.in b/doc/tinc.conf.5.in index 0548628f..cd7d1a0d 100644 --- a/doc/tinc.conf.5.in +++ b/doc/tinc.conf.5.in @@ -1,4 +1,4 @@ -.Dd 2014-05-11 +.Dd 2016-10-29 .Dt TINC.CONF 5 .\" Manual page created by: .\" Ivo Timmermans @@ -54,7 +54,7 @@ But it is highly recommended that you use this feature of because it will be so much clearer whom your daemon talks to. Hence, we will assume that you use it. .Sh NAMES -Each tinc daemon should have a name that is unique in the network which it will be part of. +Each tinc daemon must have a name that is unique in the network which it will be part of. The name will be used by other tinc daemons for identification. The name has to be declared in the .Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /tinc.conf @@ -222,7 +222,7 @@ Also note that this can cause decrypted VPN packets to be sent out on a real net Create a UNIX socket with the filename specified by .Va Device , or -.Pa @localstatedir@/run/ Ns Ar NETNAME Ns Pa .umlsocket +.Pa @runstatedir@/ Ns Ar NETNAME Ns Pa .umlsocket if not specified. .Nm tinc will wait for a User Mode Linux instance to connect to this socket. @@ -231,7 +231,7 @@ Uses the libvdeplug library to connect to a Virtual Distributed Ethernet switch, using the UNIX socket specified by .Va Device , or -.Pa @localstatedir@/run/vde.ctl +.Pa @runstatedir@/vde.ctl if not specified. .El Also, in case tinc does not seem to correctly interpret packets received from the virtual network device, @@ -250,6 +250,10 @@ Tinc will expect packets read from the virtual network device to start with a four byte header containing the address family, followed by an IP header. This mode should support both IPv4 and IPv6 packets. +.It utun Pq OS X +Set type to utun. +This is only supported on OS X version 10.6.8 and higher, but doesn't require the tuntaposx module. +This mode should support both IPv4 and IPv6 packets. .It tap Pq BSD and Linux Set type to tap. Tinc will expect packets read from the virtual network device @@ -362,7 +366,7 @@ If .Va Name is .Li $HOST , -but no such environment variable exist, the hostname will be read using the gethostnname() system call. +but no such environment variable exist, the hostname will be read using the gethostname() system call. .It Va PingInterval Li = Ar seconds Pq 60 The number of seconds of inactivity that .Nm tinc @@ -464,9 +468,9 @@ Multiple .Va Address variables can be specified, in which case each address will be tried until a working connection has been established. -.It Va Cipher Li = Ar cipher Pq blowfish +.It Va Cipher Li = Ar cipher Pq aes-256-cbc The symmetric cipher algorithm used to encrypt UDP packets. -Any cipher supported by OpenSSL is recognised. +Any cipher supported by LibreSSL or OpenSSL is recognised. Furthermore, specifying .Qq none will turn off packet encryption. @@ -479,19 +483,16 @@ Fragmentation Needed or Packet too Big messages are dropped by firewalls. This option sets the level of compression used for UDP packets. Possible values are 0 (off), 1 (fast zlib) and any integer up to 9 (best zlib), 10 (fast lzo) and 11 (best lzo). -.It Va Digest Li = Ar digest Pq sha1 +.It Va Digest Li = Ar digest Pq sha256 The digest algorithm used to authenticate UDP packets. -Any digest supported by OpenSSL is recognised. +Any digest supported by LibreSSL or OpenSSL is recognised. Furthermore, specifying .Qq none will turn off packet authentication. .It Va IndirectData Li = yes | no Pq no -This option specifies whether other tinc daemons besides the one you specified with -.Va ConnectTo -can make a direct connection to you. -This is especially useful if you are behind a firewall -and it is impossible to make a connection from the outside to your tinc daemon. -Otherwise, it is best to leave this option out or set it to no. +When set to yes, only nodes which already have a meta connection to you +will try to establish direct communication with you. +It is best to leave this option out or set it to no. .It Va MACLength Li = Ar length Pq 4 The length of the message authentication code used to authenticate UDP packets. Can be anything from @@ -559,7 +560,15 @@ UDP is possible or not. .Sh SCRIPTS Apart from reading the server and host configuration files, tinc can also run scripts at certain moments. -Under Windows (not Cygwin), the scripts should have the extension +Below is a list of filenames of scripts and a description of when they are run. +A script is only run if it exists and if it is executable. +.Pp +Scripts are run synchronously; +this means that tinc will temporarily stop processing packets until the called script finishes executing. +This guarantees that scripts will execute in the exact same order as the events that trigger them. +If you need to run commands asynchronously, you have to ensure yourself that they are being run in the background. +.Pp +Under Windows (not Cygwin), the scripts must have the extension .Pa .bat . .Bl -tag -width indent .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /tinc-up @@ -567,6 +576,7 @@ This is the most important script. If it is present it will be executed right after the tinc daemon has been started and has connected to the virtual network device. It should be used to set up the corresponding network interface, but can also be used to start other things. +.Pp Under Windows you can use the Network Connections control panel instead of creating this script. .It Pa @sysconfdir@/tinc/ Ns Ar NETNAME Ns Pa /tinc-down This script is started right before the tinc daemon quits. @@ -647,7 +657,7 @@ its connection to the virtual network device. .El .Sh SEE ALSO .Xr tincd 8 , -.Pa http://www.tinc-vpn.org/ , +.Pa https://www.tinc-vpn.org/ , .Pa http://www.tldp.org/LDP/nag2/ . .Pp The full documentation for