From 6b64f2eeb192ee1133d3f90be2ae2854a0c00ddc Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Wed, 29 Jun 2022 19:16:53 +0200 Subject: xml: streamline interface definition filenames, drop _ Some files that described the CLI used underscores to split CLI levels, some others did not. This commit removes all underscores from the filename and only makes use of a hyphen. --- interface-definitions/intel_qat.xml.in | 21 - .../service-conntrack-sync.xml.in | 173 +++ .../service-console-server.xml.in | 92 ++ interface-definitions/service-ipoe-server.xml.in | 224 ++++ interface-definitions/service-mdns-repeater.xml.in | 30 + .../service-monitoring-telegraf.xml.in | 308 ++++++ interface-definitions/service-pppoe-server.xml.in | 356 ++++++ interface-definitions/service-router-advert.xml.in | 327 ++++++ interface-definitions/service-sla.xml.in | 36 + interface-definitions/service-upnp.xml.in | 224 ++++ interface-definitions/service-webproxy.xml.in | 636 +++++++++++ .../service_conntrack-sync.xml.in | 173 --- .../service_console-server.xml.in | 92 -- interface-definitions/service_ipoe-server.xml.in | 224 ---- interface-definitions/service_mdns-repeater.xml.in | 30 - .../service_monitoring_telegraf.xml.in | 308 ------ interface-definitions/service_pppoe-server.xml.in | 356 ------ interface-definitions/service_router-advert.xml.in | 327 ------ interface-definitions/service_sla.xml.in | 36 - interface-definitions/service_upnp.xml.in | 224 ---- interface-definitions/service_webproxy.xml.in | 636 ----------- .../system-acceleration-qat.xml.in | 21 + interface-definitions/vpn-ipsec.xml.in | 1169 ++++++++++++++++++++ interface-definitions/vpn-l2tp.xml.in | 282 +++++ interface-definitions/vpn-openconnect.xml.in | 274 +++++ interface-definitions/vpn-pptp.xml.in | 121 ++ interface-definitions/vpn-sstp.xml.in | 69 ++ interface-definitions/vpn_ipsec.xml.in | 1169 -------------------- interface-definitions/vpn_l2tp.xml.in | 282 ----- interface-definitions/vpn_openconnect.xml.in | 274 ----- interface-definitions/vpn_pptp.xml.in | 121 -- interface-definitions/vpn_sstp.xml.in | 69 -- 32 files changed, 4342 insertions(+), 4342 deletions(-) delete mode 100644 interface-definitions/intel_qat.xml.in create mode 100644 interface-definitions/service-conntrack-sync.xml.in create mode 100644 interface-definitions/service-console-server.xml.in create mode 100644 interface-definitions/service-ipoe-server.xml.in create mode 100644 interface-definitions/service-mdns-repeater.xml.in create mode 100644 interface-definitions/service-monitoring-telegraf.xml.in create mode 100644 interface-definitions/service-pppoe-server.xml.in create mode 100644 interface-definitions/service-router-advert.xml.in create mode 100644 interface-definitions/service-sla.xml.in create mode 100644 interface-definitions/service-upnp.xml.in create mode 100644 interface-definitions/service-webproxy.xml.in delete mode 100644 interface-definitions/service_conntrack-sync.xml.in delete mode 100644 interface-definitions/service_console-server.xml.in delete mode 100644 interface-definitions/service_ipoe-server.xml.in delete mode 100644 interface-definitions/service_mdns-repeater.xml.in delete mode 100644 interface-definitions/service_monitoring_telegraf.xml.in delete mode 100644 interface-definitions/service_pppoe-server.xml.in delete mode 100644 interface-definitions/service_router-advert.xml.in delete mode 100644 interface-definitions/service_sla.xml.in delete mode 100644 interface-definitions/service_upnp.xml.in delete mode 100644 interface-definitions/service_webproxy.xml.in create mode 100644 interface-definitions/system-acceleration-qat.xml.in create mode 100644 interface-definitions/vpn-ipsec.xml.in create mode 100644 interface-definitions/vpn-l2tp.xml.in create mode 100644 interface-definitions/vpn-openconnect.xml.in create mode 100644 interface-definitions/vpn-pptp.xml.in create mode 100644 interface-definitions/vpn-sstp.xml.in delete mode 100644 interface-definitions/vpn_ipsec.xml.in delete mode 100644 interface-definitions/vpn_l2tp.xml.in delete mode 100644 interface-definitions/vpn_openconnect.xml.in delete mode 100644 interface-definitions/vpn_pptp.xml.in delete mode 100644 interface-definitions/vpn_sstp.xml.in (limited to 'interface-definitions') diff --git a/interface-definitions/intel_qat.xml.in b/interface-definitions/intel_qat.xml.in deleted file mode 100644 index 812484184..000000000 --- a/interface-definitions/intel_qat.xml.in +++ /dev/null @@ -1,21 +0,0 @@ - - - - - - - Acceleration components - 50 - - - - - Enable Intel QAT (Quick Assist Technology) for cryptographic acceleration - - - - - - - - diff --git a/interface-definitions/service-conntrack-sync.xml.in b/interface-definitions/service-conntrack-sync.xml.in new file mode 100644 index 000000000..6fa6fc5f9 --- /dev/null +++ b/interface-definitions/service-conntrack-sync.xml.in @@ -0,0 +1,173 @@ + + + + + + + Connection tracking synchronization + + 799 + + + + + Protocols for which local conntrack entries will be synced + + tcp udp icmp icmp6 sctp dccp + + + tcp + Sync Transmission Control Protocol entries + + + udp + Sync User Datagram Protocol entries + + + icmp + Sync Internet Control Message Protocol entries + + + icmp6 + Sync IPv6 Internet Control Message Protocol entries + + + sctp + Sync Stream Control Transmission Protocol entries + + + dccp + Sync Datagram Congestion Control Protocol entries + + + (tcp|udp|icmp|icmp6|sctp|dccp) + + Allowed protocols: tcp udp icmp or sctp + + + + + + Directly injects the flow-states into the in-kernel Connection Tracking System of the backup firewall. + + + + + + Queue size for local conntrack events + + u32 + Queue size in MB + + + 8 + + + + Protocol for which expect entries need to be synchronized + + all ftp sip h323 nfs sqlnet + + + (all|ftp|sip|h323|nfs|sqlnet) + + Invalid protocol + + + + + + Failover mechanism to use for conntrack-sync + + + + + VRRP as failover-mechanism to use for conntrack-sync + + + + + VRRP sync group + + high-availability vrrp sync-group + + + + + + + + + + IP addresses for which local conntrack entries will not be synced + + ipv4 + IPv4 address to ignore + + + ipv4net + IPv4 prefix to ignore + + + ipv6 + IPv6 address to ignore + + + ipv6net + IPv6 prefix to ignore + + + + + + + + + + + Interface to use for syncing conntrack entries + + + + + + + + IP address of the peer to send the UDP conntrack info too. This disable multicast. + + ipv4 + IP address to listen for incoming connections + + + + + + + #include + + + #include + + + Multicast group to use for syncing conntrack entries + + + + + 225.0.0.50 + + + + Queue size for syncing conntrack entries + + u32 + Queue size in MB + + + 1 + + + + + + diff --git a/interface-definitions/service-console-server.xml.in b/interface-definitions/service-console-server.xml.in new file mode 100644 index 000000000..e9591ad87 --- /dev/null +++ b/interface-definitions/service-console-server.xml.in @@ -0,0 +1,92 @@ + + + + + + + Serial Console Server + + + + + System serial interface name (ttyS or ttyUSB) + + + + + + ttySxxx + Regular serial interface + + + usbxbxpx + USB based serial interface + + + (ttyS\d+|usb\d+b.*p.*) + + + + #include + + + Serial port baud rate + + 300 1200 2400 4800 9600 19200 38400 57600 115200 + + + (300|1200|2400|4800|9600|19200|38400|57600|115200) + + + + + + Serial port data bits + + 7 8 + + + + + + 8 + + + + Serial port stop bits + + 1 2 + + + + + + 1 + + + + Parity setting + + even odd none + + + (even|odd|none) + + + none + + + + SSH remote access to this console + + + #include + + + + + + + + + diff --git a/interface-definitions/service-ipoe-server.xml.in b/interface-definitions/service-ipoe-server.xml.in new file mode 100644 index 000000000..e222467b1 --- /dev/null +++ b/interface-definitions/service-ipoe-server.xml.in @@ -0,0 +1,224 @@ + + + + + + + Internet Protocol over Ethernet (IPoE) Server + 900 + + + + + Network interface to server IPoE + + + + + + + + Network Layer IPoE serves on + + L2 L3 + + + (L2|L3) + + + L2 + client share the same subnet + + + L3 + clients are behind this router + + + + + + Enables clients to share the same network or each client has its own vlan + + shared vlan + + + (shared|vlan) + + + shared + Multiple clients share the same network + + + vlan + One VLAN per client + + + + + + Client address pool + + ipv4net + IPv4 address and prefix length + + + + + + + + + DHCP requests will be forwarded + + + + + DHCP Server the request will be redirected to. + + ipv4 + IPv4 address of the DHCP Server + + + + + + + + + address of the relay agent (Relay Agent IP Address) + + + + + + + VLAN monitor for the automatic creation of vlans (user per vlan) + + + + VLAN ID needs to be between 1 and 4096 + + + + + + VLAN monitor for the automatic creation of vlans (user per vlan) + + (409[0-6]|40[0-8][0-9]|[1-3][0-9]{3}|[1-9][0-9]{0,2})-(409[0-6]|40[0-8][0-9]|[1-3][0-9]{3}|[1-9][0-9]{0,2}) + + + + + + + #include + + + Client IP pools and gateway setting + + + + + Pool name + + + #include + #include + + + + + #include + + + Client authentication methods + + + + + Authetication mode + + local radius noauth + + + (local|radius|noauth) + + + local + Authentication based on local definition + + + radius + Authentication based on a RADIUS server + + + noauth + Authentication disabled + + + + + + Network interface the client mac will appear on + + + + + + + + Client mac address allowed to receive an IP address + + macaddr + Hardware (MAC) address + + + + + + + + + Upload/Download speed limits + + + + + Upload bandwidth limit in kbits/sec + + + + + + + + Download bandwidth limit in kbits/sec + + + + + + + + + + VLAN-ID of the client network + + + + VLAN ID needs to be between 1 and 4096 + + + + + + + #include + #include + + + + + + + diff --git a/interface-definitions/service-mdns-repeater.xml.in b/interface-definitions/service-mdns-repeater.xml.in new file mode 100644 index 000000000..9a94f1488 --- /dev/null +++ b/interface-definitions/service-mdns-repeater.xml.in @@ -0,0 +1,30 @@ + + + + + + + Multicast DNS (mDNS) parameters + + + + + mDNS repeater configuration + 990 + + + #include + #include + + + Disables mDNS repeater on VRRP interfaces not in MASTER state + + + + + + + + + + diff --git a/interface-definitions/service-monitoring-telegraf.xml.in b/interface-definitions/service-monitoring-telegraf.xml.in new file mode 100644 index 000000000..d0d9202c1 --- /dev/null +++ b/interface-definitions/service-monitoring-telegraf.xml.in @@ -0,0 +1,308 @@ + + + + + + + Monitoring services + 1280 + + + + + Telegraf monitoring + + + + + Authentication parameters + + + + + Authentication organization for InfluxDB v2 + + [a-zA-Z][1-9a-zA-Z@_\-.]{2,50} + + Organization name must be alphanumeric and can contain hyphens, underscores and at symbol. + + + + + Authentication token for InfluxDB v2 + + txt + Authentication token + + + [a-zA-Z0-9-_]{86}== + + Token must be 88 characters long and must contain only [a-zA-Z0-9-_] and '==' characters. + + + + + + + Output plugin Azure Data Explorer + + + + + Authentication parameters + + + + + Application client id + + [-_a-zA-Z0-9]+ + + Client-id is limited to alphanumerical characters and can contain hyphen and underscores + + + + + Application client secret + + [-_a-zA-Z0-9]+ + + Client-secret is limited to alphanumerical characters and can contain hyphen and underscores + + + + + Set tenant id + + [-_a-zA-Z0-9]+ + + Tenant-id is limited to alphanumerical characters and can contain hyphen and underscores + + + + + + + Remote database name + + txt + Remote database name + + + [-_a-zA-Z0-9]+ + + Database is limited to alphanumerical characters and can contain hyphen and underscores + + + + + Type of metrics grouping when push to Azure Data Explorer + + single-table table-per-metric + + + single-table + Metrics stores in one table + + + table-per-metric + One table per gorups of metric by the metric name + + + (single-table|table-per-metric) + + + table-per-metric + + + + Name of the single table [Only if set group-metrics single-table] + + txt + Table name + + + [-_a-zA-Z0-9]+ + + Table is limited to alphanumerical characters and can contain hyphen and underscores + + + #include + + + + + Remote bucket + + main + + + + Source parameters for monitoring + + all hardware-utilization logs network system telegraf + + + all + All parameters + + + hardware-utilization + Hardware-utilization parameters (CPU, disk, memory) + + + logs + Logs parameters + + + network + Network parameters (net, netstat, nftables) + + + system + System parameters (system, processes, interrupts) + + + telegraf + Telegraf internal statistics + + + (all|hardware-utilization|logs|network|system|telegraf) + + + + all + + + + Output plugin Prometheus client + + + + + HTTP basic authentication parameters + + + + + Authentication username + + + + + Authentication password + + txt + Authentication password + + + + + + + + Networks allowed to query this server + + ipv4net + IP address and prefix length + + + ipv6net + IPv6 address and prefix length + + + + + + + + + + Local IP addresses to listen on + + + + + ipv4 + IPv4 address to listen for incoming connections + + + ipv6 + IPv6 address to listen for incoming connections + + + + + + + + + + + Metric version control mapping from Telegraf to Prometheus format + + u32:1-2 + Metric version (default: 2) + + + + + + 2 + + #include + + 9273 + + + + + + Output plugin Splunk + + + + + HTTP basic authentication parameters + + + + + Authorization token + + + + + Use TLS but skip host validation + + + + + + + + Remote URL + + url + Remote URL to Splunk collector + + + ^(http(s?):\/\/.*):(\d*)\/?(.*) + + Incorrect URL format + + + + + #include + #include + + 8086 + + + + + + + + diff --git a/interface-definitions/service-pppoe-server.xml.in b/interface-definitions/service-pppoe-server.xml.in new file mode 100644 index 000000000..50f42849b --- /dev/null +++ b/interface-definitions/service-pppoe-server.xml.in @@ -0,0 +1,356 @@ + + + + + + + Point to Point over Ethernet (PPPoE) Server + 900 + + + #include + + vyos-ac + + + + Authentication for remote access PPPoE Server + + + #include + #include + #include + #include + #include + + + #include + + + Format of Called-Station-Id attribute + + ifname ifname:mac + + + (ifname|ifname:mac) + + Invalid Called-Station-Id format + + ifname + NAS-Port-Id - should contain root interface name (NAS-Port-Id=eth1) + + + ifname:mac + NAS-Port-Id - should contain root interface name and mac address (NAS-Port-Id=eth1:00:00:00:00:00:00) + + + + + + + + + + Pool of client IP addresses (must be within a /24) + + + #include + #include + + + #include + #include + + + interface(s) to listen on + + + + + + + + VLAN monitor for the automatic creation of single vlan + + u32:1-4094 + VLAN monitor for the automatic creation of single vlan + + + + + VLAN ID needs to be between 1 and 4094 + + + + + + VLAN monitor for the automatic creation of vlans range + + start-end + VLAN monitor range for the automatic creation of vlans (e.g. 1-4094) + + + + + + + + + + #include + #include + + + Limits the connection rate from a single source + + + + + Acceptable rate of connections (e.g. 1/min, 60/sec) + + [0-9]+\/(min|sec) + + illegal value + + + + + Burst count + + + + + Timeout in seconds + + + + + + + Service name + + [a-zA-Z0-9\-]{1,100} + + Service-name can contain aplhanumerical characters and dashes only (max. 100) + + + + #include + + + Advanced protocol options + + + + + Minimum acceptable MTU (68-65535) + + + + + + + + Preferred MRU (68-65535) + + + + + + + + CCP negotiation (default disabled) + + + + #include + #include + #include + #include + + + IPv4 (IPCP) negotiation algorithm + + (deny|allow|prefer|require) + + invalid value + + deny + Do not negotiate IPv4 + + + allow + Negotiate IPv4 only if client requests + + + prefer + Ask client for IPv4 negotiation, do not fail if it rejects + + + require + Require IPv4 negotiation + + + deny allow prefer require + + + + #include + + + Fixed or random interface identifier for IPv6 + + random + + + random + Random interface identifier for IPv6 + + + x:x:x:x + specify interface identifier for IPv6 + + + + + + Peer interface identifier for IPv6 + + random calling-sid ipv4 + + + x:x:x:x + Interface identifier for IPv6 + + + random + Use a random interface identifier for IPv6 + + + ipv4 + Calculate interface identifier from IPv4 address, for example 192:168:0:1 + + + calling-sid + Calculate interface identifier from calling-station-id + + + + + + Accept peer interface identifier + + + + + + + + PADO delays + + u32:1-999999 + Number in ms + + + + + Invalid PADO delay + + + + + Number of sessions + + u32:1-999999 + Number of sessions + + + + + Invalid number of delayed sessions + + + + + + + control sessions count + + (deny|disable|replace) + + Invalid value + + disable + Disables session control + + + deny + Deny second session authorization + + + replace + Terminate first session when second is authorized + + + deny disable replace + + + replace + + + + Enable SNMP + + + + + enable SNMP master agent mode + + + + + + + + Extended script execution + + + + + Script to run before PPPoE session interface comes up + + + + + + + + Script to run when PPPoE session interface is completely configured and started + + + + + + + + Script to run when PPPoE session interface going to terminate + + + + + + + + Script to run when PPPoE session interface changed by RADIUS CoA handling + + + + + + + + + + + + diff --git a/interface-definitions/service-router-advert.xml.in b/interface-definitions/service-router-advert.xml.in new file mode 100644 index 000000000..40dac23ca --- /dev/null +++ b/interface-definitions/service-router-advert.xml.in @@ -0,0 +1,327 @@ + + + + + + + IPv6 Router Advertisements (RAs) service + 900 + + + + + Interface to send RA on + + + + + + + + Set Hop Count field of the IP header for outgoing packets + + u32:0 + Unspecified (by this router) + + + u32:1-255 + Value should represent current diameter of the Internet + + + + + Hop count must be between 0 and 255 + + 64 + + + + Lifetime associated with the default router in units of seconds + + u32:4-9000 + Router Lifetime in seconds + + + 0 + Not a default router + + + + + Default router livetime bust be 0 or between 4 and 9000 + + + + + Preference associated with the default router, + + low medium high + + + low + Default router has low preference + + + medium + Default router has medium preference + + + high + Default router has high preference + + + (low|medium|high) + + Default preference must be low, medium or high + + medium + + + + DNS search list + + + + + + Link MTU value placed in RAs, exluded in RAs if unset + + u32:1280-9000 + Link MTU value in RAs + + + + + Link MTU must be between 1280 and 9000 + + + + + Hosts use the administered (stateful) protocol for address autoconfiguration in addition to any addresses autoconfigured using SLAAC + + + + + + Set interval between unsolicited multicast RAs + + + + + Maximum interval between unsolicited multicast RAs + + u32:4-1800 + Maximum interval in seconds + + + + + Maximum interval must be between 4 and 1800 seconds + + 600 + + + + Minimum interval between unsolicited multicast RAs + + u32:3-1350 + Minimum interval in seconds + + + + + Minimum interval must be between 3 and 1350 seconds + + + + + #include + + + Hosts use the administered (stateful) protocol for autoconfiguration of other (non-address) information + + + + + + IPv6 route to be advertised in Router Advertisements (RAs) + + ipv6net + IPv6 route to be advertized + + + + + + + + + Time in seconds that the route will remain valid + + infinity + + + u32:1-4294967295 + Time in seconds that the route will remain valid + + + infinity + Route will remain preferred forever + + + + (infinity) + + + 1800 + + + + Preference associated with the route, + + low medium high + + + low + Route has low preference + + + medium + Route has medium preference + + + high + Route has high preference + + + (low|medium|high) + + Route preference must be low, medium or high + + medium + + + + Do not announce this route with a zero second lifetime upon shutdown + + + + + + + + IPv6 prefix to be advertised in Router Advertisements (RAs) + + ipv6net + IPv6 prefix to be advertized + + + + + + + + + Prefix can not be used for stateless address auto-configuration + + + + + + Prefix can not be used for on-link determination + + + + + + Time in seconds that the prefix will remain preferred + + infinity + + + u32 + Time in seconds that the prefix will remain preferred + + + infinity + Prefix will remain preferred forever + + + + (infinity) + + + 14400 + + + + Time in seconds that the prefix will remain valid + + infinity + + + u32:1-4294967295 + Time in seconds that the prefix will remain valid + + + infinity + Prefix will remain preferred forever + + + + (infinity) + + + 2592000 + + + + + + Time, in milliseconds, that a node assumes a neighbor is reachable after having received a reachability confirmation + + u32:0 + Reachable Time unspecified by this router + + + u32:1-3600000 + Reachable Time value in RAs (in milliseconds) + + + + + Reachable time must be 0 or between 1 and 3600000 milliseconds + + 0 + + + + Time in milliseconds between retransmitted Neighbor Solicitation messages + + u32:0 + Time, in milliseconds, between retransmitted Neighbor Solicitation messages + + + u32:1-4294967295 + Minimum interval in milliseconds + + + + + Retransmit interval must be 0 or between 1 and 4294967295 milliseconds + + 0 + + + + Do not send router adverts + + + + + + + + + + diff --git a/interface-definitions/service-sla.xml.in b/interface-definitions/service-sla.xml.in new file mode 100644 index 000000000..0c4f8a591 --- /dev/null +++ b/interface-definitions/service-sla.xml.in @@ -0,0 +1,36 @@ + + + + + + + Service level agreement (SLA) + + + + + One-way active measurement protocol (OWAMP) server + + + #include + + 861 + + + + + + Two-way active measurement protocol (TWAMP) server + + + #include + + 862 + + + + + + + + diff --git a/interface-definitions/service-upnp.xml.in b/interface-definitions/service-upnp.xml.in new file mode 100644 index 000000000..a129b7260 --- /dev/null +++ b/interface-definitions/service-upnp.xml.in @@ -0,0 +1,224 @@ + + + + + + + Universal Plug and Play (UPnP) service + 900 + + + + + Name of this service + + txt + Friendly name + + + + + + WAN network interface + + + + + + + + + + + WAN network IP + + ipv4 + IPv4 address + + + ipv6 + IPv6 address + + + + + + + + + + + Enable NAT-PMP support + + + + + + Enable Secure Mode + + + + + + Presentation Url + + txt + Presentation Url + + + + + + PCP-base lifetime Option + + + + + Max lifetime time + + + + + + + + Min lifetime time + + + + + + + + + + Local IP addresses for service to listen on + + + + + + <interface> + Monitor interface address + + + ipv4 + IP address to listen for incoming connections + + + ipv4-prefix + IP prefix to listen for incoming connections + + + ipv6 + IP address to listen for incoming connections + + + ipv6-prefix + IP prefix to listen for incoming connections + + + + + + + + + + + + + + Enable STUN probe support (can be used with NAT 1:1 support for WAN interfaces) + + + + + The STUN server address + + txt + The STUN server host address + + + + + + + #include + + + + + UPnP Rule + + u32:0-65535 + Rule number + + + + + + + #include + + + Port range (REQUIRE) + + <port> + single port + + + <portN>-<portM> + Port range (use '-' as delimiter) + + + + + + + + + Port range (REQUIRE) + + <port> + single port + + + <portN>-<portM> + Port range (use '-' as delimiter) + + + + + + + + + The IP to which this rule applies (REQUIRE) + + ipv4 + The IPv4 to which this rule applies + + + + + + + + + Actions against the rule (REQUIRE) + + allow deny + + + (allow|deny) + + + + + + + + + + diff --git a/interface-definitions/service-webproxy.xml.in b/interface-definitions/service-webproxy.xml.in new file mode 100644 index 000000000..e4609b699 --- /dev/null +++ b/interface-definitions/service-webproxy.xml.in @@ -0,0 +1,636 @@ + + + + + + + Webproxy service settings + 500 + + + + + Default domain name + + domain + Domain to use for urls that do not contain a '.' + + + [.][A-Za-z0-9][-.A-Za-z0-9]* + + Must start append-domain with a '.' + + + + + Proxy Authentication Settings + + + + + Number of authentication helper processes + + n + Number of authentication helper processes + + + + + + 5 + + + + Authenticated session time to live in minutes + + n + Authenticated session timeout + + + + + + 60 + + + + LDAP authentication settings + + + + + LDAP Base DN to search + + + + + LDAP DN used to bind to server + + + + + Filter expression to perform LDAP search with + + + + + LDAP password to bind with + + + + + Use persistent LDAP connection + + + + #include + + 389 + + + + LDAP server to use + + + + + Use SSL/TLS for LDAP connection + + + + + + LDAP username attribute + + + + + LDAP protocol version + + 2 3 + + + 2 + LDAP protocol version 2 + + + 3 + LDAP protocol version 2 + + + + + + 3 + + + + + + Authentication Method + + ldap + + + ldap + Lightweight Directory Access Protocol + + + (ldap) + + The only supported method currently is LDAP + + + + + Name of authentication realm (e.g. "My Company proxy server") + + + + + + + Specify other caches in a hierarchy + + hostname + Cache peers FQDN + + + + + + Hostname or IP address of peer + + ipv4 + Squid cache-peer IPv4 address + + + hostname + Squid cache-peer hostname + + + + + + Invalid FQDN or IP address + + + + + Default Proxy Port + + u32:1025-65535 + Default port number + + + + + + 3128 + + + + Cache peer ICP port + + u32:0 + Cache peer disabled + + + u32:1-65535 + Cache peer ICP port + + + + + + 0 + + + + Cache peer options + + txt + Cache peer options + + + no-query default + + + + Squid peer type (default parent) + + parent sibling multicast + + + parent + Peer is a parent + + + sibling + Peer is a sibling + + + multicast + Peer is a member of a multicast group + + + (parent|sibling|multicast) + + + parent + + + + + + Disk cache size in MB + + u32 + Disk cache size in MB + + + 0 + Disable disk caching + + + 100 + + + + Default Proxy Port + + u32:1025-65535 + Default port number + + + + + + 3128 + + + + Disable logging of HTTP accesses + + + + + + Domain name to block + + + + + + Domain name to access without caching + + + + + + IPv4 listen-address for WebProxy + + + + + ipv4 + IPv4 address listen on + + + + + + Default Proxy Port + + u32:1025-65535 + Default port number + + + + + + + + + + Disable transparent mode + + + + + + + + Maximum size of object to be stored in cache in kilobytes + + u32 + Object size in KB + + + + + + + + + Memory cache size in MB + + u32 + Memory cache size in MB + + + + + + 20 + + + + Maximum size of object to be stored in cache in kilobytes + + u32 + Object size in KB + + + + + + + + + Outgoing IP address for webproxy + + + + + MIME type to block + + image/gif www/mime application/macbinary application/oda application/octet-stream application/pdf application/postscript application/postscript application/postscript text/rtf application/octet-stream application/octet-stream application/x-tar application/x-csh application/x-dvi application/x-hdf application/x-latex text/plain application/x-netcdf application/x-netcdf application/x-sh application/x-tcl application/x-tex application/x-texinfo application/x-texinfo application/x-troff application/x-troff application/x-troff application/x-troff-man application/x-troff-me application/x-troff-ms application/x-wais-source application/zip application/x-bcpio application/x-cpio application/x-gtar application/x-rpm application/x-shar application/x-sv4cpio application/x-sv4crc application/x-tar application/x-ustar audio/basic audio/basic audio/mpeg audio/mpeg audio/mpeg audio/x-aiff audio/x-aiff audio/x-aiff audio/x-wav image/bmp image/ief image/jpeg image/jpeg image/jpeg image/tiff image/tiff image/x-cmu-raster image/x-portable-anymap image/x-portable-bitmap image/x-portable-graymap image/x-portable-pixmap image/x-rgb image/x-xbitmap image/x-xpixmap image/x-xwindowdump text/html text/html text/css application/x-javascript text/plain text/plain text/plain text/plain text/plain text/plain text/plain text/plain text/plain text/richtext text/tab-separated-values text/x-setext video/mpeg video/mpeg video/mpeg video/quicktime video/quicktime video/x-msvideo video/x-sgi-movie application/mac-compactpro application/mac-binhex40 application/macwriteii application/msword application/msword application/vnd.ms-excel application/vnd.ms-powerpoint application/vnd.lotus-1-2-3 application/vnd.mif application/x-stuffit application/pict application/pict application/x-arj-compressed application/x-lha-compressed application/x-lha-compressed application/x-deflate text/plain application/octet-stream application/octet-stream image/png application/octet-stream application/x-xpinstall application/octet-stream text/plain application/x-director application/x-director application/x-director image/vnd.djvu image/vnd.djvu application/octet-stream application/octet-stream application/andrew-inset x-conference/x-cooltalk model/iges model/iges audio/midi audio/midi audio/midi model/mesh model/mesh video/vnd.mpegurl chemical/x-pdb application/x-chess-pgn audio/x-realaudio audio/x-pn-realaudio audio/x-pn-realaudio text/sgml text/sgml application/x-koan application/x-koan application/x-koan application/x-koan application/smil application/smil application/octet-stream application/x-futuresplash application/x-shockwave-flash application/x-cdlink model/vrml image/vnd.wap.wbmp application/vnd.wap.wbxml application/vnd.wap.wmlc application/vnd.wap.wmlscriptc application/vnd.wap.wmlscript application/xhtml application/xhtml text/xml text/xml chemical/x-xyz text/plain + + + (image/gif|www/mime|application/macbinary|application/oda|application/octet-stream|application/pdf|application/postscript|application/postscript|application/postscript|text/rtf|application/octet-stream|application/octet-stream|application/x-tar|application/x-csh|application/x-dvi|application/x-hdf|application/x-latex|text/plain|application/x-netcdf|application/x-netcdf|application/x-sh|application/x-tcl|application/x-tex|application/x-texinfo|application/x-texinfo|application/x-troff|application/x-troff|application/x-troff|application/x-troff-man|application/x-troff-me|application/x-troff-ms|application/x-wais-source|application/zip|application/x-bcpio|application/x-cpio|application/x-gtar|application/x-rpm|application/x-shar|application/x-sv4cpio|application/x-sv4crc|application/x-tar|application/x-ustar|audio/basic|audio/basic|audio/mpeg|audio/mpeg|audio/mpeg|audio/x-aiff|audio/x-aiff|audio/x-aiff|audio/x-wav|image/bmp|image/ief|image/jpeg|image/jpeg|image/jpeg|image/tiff|image/tiff|image/x-cmu-raster|image/x-portable-anymap|image/x-portable-bitmap|image/x-portable-graymap|image/x-portable-pixmap|image/x-rgb|image/x-xbitmap|image/x-xpixmap|image/x-xwindowdump|text/html|text/html|text/css|application/x-javascript|text/plain|text/plain|text/plain|text/plain|text/plain|text/plain|text/plain|text/plain|text/plain|text/richtext|text/tab-separated-values|text/x-setext|video/mpeg|video/mpeg|video/mpeg|video/quicktime|video/quicktime|video/x-msvideo|video/x-sgi-movie|application/mac-compactpro|application/mac-binhex40|application/macwriteii|application/msword|application/msword|application/vnd.ms-excel|application/vnd.ms-powerpoint|application/vnd.lotus-1-2-3|application/vnd.mif|application/x-stuffit|application/pict|application/pict|application/x-arj-compressed|application/x-lha-compressed|application/x-lha-compressed|application/x-deflate|text/plain|application/octet-stream|application/octet-stream|image/png|application/octet-stream|application/x-xpinstall|application/octet-stream|text/plain|application/x-director|application/x-director|application/x-director|image/vnd.djvu|image/vnd.djvu|application/octet-stream|application/octet-stream|application/andrew-inset|x-conference/x-cooltalk|model/iges|model/iges|audio/midi|audio/midi|audio/midi|model/mesh|model/mesh|video/vnd.mpegurl|chemical/x-pdb|application/x-chess-pgn|audio/x-realaudio|audio/x-pn-realaudio|audio/x-pn-realaudio|text/sgml|text/sgml|application/x-koan|application/x-koan|application/x-koan|application/x-koan|application/smil|application/smil|application/octet-stream|application/x-futuresplash|application/x-shockwave-flash|application/x-cdlink|model/vrml|image/vnd.wap.wbmp|application/vnd.wap.wbxml|application/vnd.wap.wmlc|application/vnd.wap.wmlscriptc|application/vnd.wap.wmlscript|application/xhtml|application/xhtml|text/xml|text/xml|chemical/x-xyz|text/plain) + + + + + + + Maximum reply body size in KB + + u32 + Reply size in KB + + + + + + + + + URL filtering settings + + + #include + + + URL filtering via squidGuard redirector + + + #include + + + Auto update settings + + + + + Hour of day for database update + + u32:0-23 + Hour for database update + + + + + + 0 + + + + + + Redirect URL for filtered websites + + url + URL for redirect + + + block.vyos.net + + + + URL filter rule for a source-group + + u32:1-1024 + Rule Number + + + + + SquidGuard rule must between 1-1024 + + + #include + + + Redirect URL for filtered websites + + url + URL for redirect + + + + + + Source-group for this rule + + group + Source group identifier for this rule + + + service webproxy url-filtering squidguard source-group + + + + + + Time-period for this rule + + period + Time period for this rule + + + service webproxy url-filtering squidguard time-period + + + + + + + + Source group name + + name + Name of source group + + + [^0-9][a-zA-Z_][a-zA-Z0-9][\w\-\.]* + + URL-filter source-group cannot start with a number! + + + + + Address for source-group + + ipv4 + IPv4 address to match + + + ipv4net + IPv4 prefix to match + + + ipv4range + IPv4 address range to match + + + + + + + + + + + + Description for source-group + + + + + Domain for source-group + + domain + Domain name for the source-group + + + + + + + LDAP search expression for an IP address list + + + + + + LDAP search expression for a user group + + + + + + List of user names + + + + + + + Time period name + + + + + Time-period days + + Sun Mon Tue Wed Thu Fri Sat weekdays weekend all + + + Sun + Sunday + + + Mon + Monday + + + Tue + Tuesday + + + Wed + Wednesday + + + Thu + Thursday + + + Fri + Friday + + + Sat + Saturday + + + weekdays + Monday through Friday + + + weekend + Saturday and Sunday + + + all + All days of the week + + + (Sun|Mon|Tue|Wed|Thu|Fri|Sat|weekdays|weekend|all) + + + + + + Time for time-period + + <hh:mm - hh:mm> + Time range in 24hr time + + + + (\d\d:\d\d)-(\d\d:\d\d) + + Expected time format hh:mm - hh:mm in 24hr time + + + + + + + Time-period description + + + + + + + + + + + + + diff --git a/interface-definitions/service_conntrack-sync.xml.in b/interface-definitions/service_conntrack-sync.xml.in deleted file mode 100644 index 6fa6fc5f9..000000000 --- a/interface-definitions/service_conntrack-sync.xml.in +++ /dev/null @@ -1,173 +0,0 @@ - - - - - - - Connection tracking synchronization - - 799 - - - - - Protocols for which local conntrack entries will be synced - - tcp udp icmp icmp6 sctp dccp - - - tcp - Sync Transmission Control Protocol entries - - - udp - Sync User Datagram Protocol entries - - - icmp - Sync Internet Control Message Protocol entries - - - icmp6 - Sync IPv6 Internet Control Message Protocol entries - - - sctp - Sync Stream Control Transmission Protocol entries - - - dccp - Sync Datagram Congestion Control Protocol entries - - - (tcp|udp|icmp|icmp6|sctp|dccp) - - Allowed protocols: tcp udp icmp or sctp - - - - - - Directly injects the flow-states into the in-kernel Connection Tracking System of the backup firewall. - - - - - - Queue size for local conntrack events - - u32 - Queue size in MB - - - 8 - - - - Protocol for which expect entries need to be synchronized - - all ftp sip h323 nfs sqlnet - - - (all|ftp|sip|h323|nfs|sqlnet) - - Invalid protocol - - - - - - Failover mechanism to use for conntrack-sync - - - - - VRRP as failover-mechanism to use for conntrack-sync - - - - - VRRP sync group - - high-availability vrrp sync-group - - - - - - - - - - IP addresses for which local conntrack entries will not be synced - - ipv4 - IPv4 address to ignore - - - ipv4net - IPv4 prefix to ignore - - - ipv6 - IPv6 address to ignore - - - ipv6net - IPv6 prefix to ignore - - - - - - - - - - - Interface to use for syncing conntrack entries - - - - - - - - IP address of the peer to send the UDP conntrack info too. This disable multicast. - - ipv4 - IP address to listen for incoming connections - - - - - - - #include - - - #include - - - Multicast group to use for syncing conntrack entries - - - - - 225.0.0.50 - - - - Queue size for syncing conntrack entries - - u32 - Queue size in MB - - - 1 - - - - - - diff --git a/interface-definitions/service_console-server.xml.in b/interface-definitions/service_console-server.xml.in deleted file mode 100644 index e9591ad87..000000000 --- a/interface-definitions/service_console-server.xml.in +++ /dev/null @@ -1,92 +0,0 @@ - - - - - - - Serial Console Server - - - - - System serial interface name (ttyS or ttyUSB) - - - - - - ttySxxx - Regular serial interface - - - usbxbxpx - USB based serial interface - - - (ttyS\d+|usb\d+b.*p.*) - - - - #include - - - Serial port baud rate - - 300 1200 2400 4800 9600 19200 38400 57600 115200 - - - (300|1200|2400|4800|9600|19200|38400|57600|115200) - - - - - - Serial port data bits - - 7 8 - - - - - - 8 - - - - Serial port stop bits - - 1 2 - - - - - - 1 - - - - Parity setting - - even odd none - - - (even|odd|none) - - - none - - - - SSH remote access to this console - - - #include - - - - - - - - - diff --git a/interface-definitions/service_ipoe-server.xml.in b/interface-definitions/service_ipoe-server.xml.in deleted file mode 100644 index e222467b1..000000000 --- a/interface-definitions/service_ipoe-server.xml.in +++ /dev/null @@ -1,224 +0,0 @@ - - - - - - - Internet Protocol over Ethernet (IPoE) Server - 900 - - - - - Network interface to server IPoE - - - - - - - - Network Layer IPoE serves on - - L2 L3 - - - (L2|L3) - - - L2 - client share the same subnet - - - L3 - clients are behind this router - - - - - - Enables clients to share the same network or each client has its own vlan - - shared vlan - - - (shared|vlan) - - - shared - Multiple clients share the same network - - - vlan - One VLAN per client - - - - - - Client address pool - - ipv4net - IPv4 address and prefix length - - - - - - - - - DHCP requests will be forwarded - - - - - DHCP Server the request will be redirected to. - - ipv4 - IPv4 address of the DHCP Server - - - - - - - - - address of the relay agent (Relay Agent IP Address) - - - - - - - VLAN monitor for the automatic creation of vlans (user per vlan) - - - - VLAN ID needs to be between 1 and 4096 - - - - - - VLAN monitor for the automatic creation of vlans (user per vlan) - - (409[0-6]|40[0-8][0-9]|[1-3][0-9]{3}|[1-9][0-9]{0,2})-(409[0-6]|40[0-8][0-9]|[1-3][0-9]{3}|[1-9][0-9]{0,2}) - - - - - - - #include - - - Client IP pools and gateway setting - - - - - Pool name - - - #include - #include - - - - - #include - - - Client authentication methods - - - - - Authetication mode - - local radius noauth - - - (local|radius|noauth) - - - local - Authentication based on local definition - - - radius - Authentication based on a RADIUS server - - - noauth - Authentication disabled - - - - - - Network interface the client mac will appear on - - - - - - - - Client mac address allowed to receive an IP address - - macaddr - Hardware (MAC) address - - - - - - - - - Upload/Download speed limits - - - - - Upload bandwidth limit in kbits/sec - - - - - - - - Download bandwidth limit in kbits/sec - - - - - - - - - - VLAN-ID of the client network - - - - VLAN ID needs to be between 1 and 4096 - - - - - - - #include - #include - - - - - - - diff --git a/interface-definitions/service_mdns-repeater.xml.in b/interface-definitions/service_mdns-repeater.xml.in deleted file mode 100644 index 9a94f1488..000000000 --- a/interface-definitions/service_mdns-repeater.xml.in +++ /dev/null @@ -1,30 +0,0 @@ - - - - - - - Multicast DNS (mDNS) parameters - - - - - mDNS repeater configuration - 990 - - - #include - #include - - - Disables mDNS repeater on VRRP interfaces not in MASTER state - - - - - - - - - - diff --git a/interface-definitions/service_monitoring_telegraf.xml.in b/interface-definitions/service_monitoring_telegraf.xml.in deleted file mode 100644 index d0d9202c1..000000000 --- a/interface-definitions/service_monitoring_telegraf.xml.in +++ /dev/null @@ -1,308 +0,0 @@ - - - - - - - Monitoring services - 1280 - - - - - Telegraf monitoring - - - - - Authentication parameters - - - - - Authentication organization for InfluxDB v2 - - [a-zA-Z][1-9a-zA-Z@_\-.]{2,50} - - Organization name must be alphanumeric and can contain hyphens, underscores and at symbol. - - - - - Authentication token for InfluxDB v2 - - txt - Authentication token - - - [a-zA-Z0-9-_]{86}== - - Token must be 88 characters long and must contain only [a-zA-Z0-9-_] and '==' characters. - - - - - - - Output plugin Azure Data Explorer - - - - - Authentication parameters - - - - - Application client id - - [-_a-zA-Z0-9]+ - - Client-id is limited to alphanumerical characters and can contain hyphen and underscores - - - - - Application client secret - - [-_a-zA-Z0-9]+ - - Client-secret is limited to alphanumerical characters and can contain hyphen and underscores - - - - - Set tenant id - - [-_a-zA-Z0-9]+ - - Tenant-id is limited to alphanumerical characters and can contain hyphen and underscores - - - - - - - Remote database name - - txt - Remote database name - - - [-_a-zA-Z0-9]+ - - Database is limited to alphanumerical characters and can contain hyphen and underscores - - - - - Type of metrics grouping when push to Azure Data Explorer - - single-table table-per-metric - - - single-table - Metrics stores in one table - - - table-per-metric - One table per gorups of metric by the metric name - - - (single-table|table-per-metric) - - - table-per-metric - - - - Name of the single table [Only if set group-metrics single-table] - - txt - Table name - - - [-_a-zA-Z0-9]+ - - Table is limited to alphanumerical characters and can contain hyphen and underscores - - - #include - - - - - Remote bucket - - main - - - - Source parameters for monitoring - - all hardware-utilization logs network system telegraf - - - all - All parameters - - - hardware-utilization - Hardware-utilization parameters (CPU, disk, memory) - - - logs - Logs parameters - - - network - Network parameters (net, netstat, nftables) - - - system - System parameters (system, processes, interrupts) - - - telegraf - Telegraf internal statistics - - - (all|hardware-utilization|logs|network|system|telegraf) - - - - all - - - - Output plugin Prometheus client - - - - - HTTP basic authentication parameters - - - - - Authentication username - - - - - Authentication password - - txt - Authentication password - - - - - - - - Networks allowed to query this server - - ipv4net - IP address and prefix length - - - ipv6net - IPv6 address and prefix length - - - - - - - - - - Local IP addresses to listen on - - - - - ipv4 - IPv4 address to listen for incoming connections - - - ipv6 - IPv6 address to listen for incoming connections - - - - - - - - - - - Metric version control mapping from Telegraf to Prometheus format - - u32:1-2 - Metric version (default: 2) - - - - - - 2 - - #include - - 9273 - - - - - - Output plugin Splunk - - - - - HTTP basic authentication parameters - - - - - Authorization token - - - - - Use TLS but skip host validation - - - - - - - - Remote URL - - url - Remote URL to Splunk collector - - - ^(http(s?):\/\/.*):(\d*)\/?(.*) - - Incorrect URL format - - - - - #include - #include - - 8086 - - - - - - - - diff --git a/interface-definitions/service_pppoe-server.xml.in b/interface-definitions/service_pppoe-server.xml.in deleted file mode 100644 index 50f42849b..000000000 --- a/interface-definitions/service_pppoe-server.xml.in +++ /dev/null @@ -1,356 +0,0 @@ - - - - - - - Point to Point over Ethernet (PPPoE) Server - 900 - - - #include - - vyos-ac - - - - Authentication for remote access PPPoE Server - - - #include - #include - #include - #include - #include - - - #include - - - Format of Called-Station-Id attribute - - ifname ifname:mac - - - (ifname|ifname:mac) - - Invalid Called-Station-Id format - - ifname - NAS-Port-Id - should contain root interface name (NAS-Port-Id=eth1) - - - ifname:mac - NAS-Port-Id - should contain root interface name and mac address (NAS-Port-Id=eth1:00:00:00:00:00:00) - - - - - - - - - - Pool of client IP addresses (must be within a /24) - - - #include - #include - - - #include - #include - - - interface(s) to listen on - - - - - - - - VLAN monitor for the automatic creation of single vlan - - u32:1-4094 - VLAN monitor for the automatic creation of single vlan - - - - - VLAN ID needs to be between 1 and 4094 - - - - - - VLAN monitor for the automatic creation of vlans range - - start-end - VLAN monitor range for the automatic creation of vlans (e.g. 1-4094) - - - - - - - - - - #include - #include - - - Limits the connection rate from a single source - - - - - Acceptable rate of connections (e.g. 1/min, 60/sec) - - [0-9]+\/(min|sec) - - illegal value - - - - - Burst count - - - - - Timeout in seconds - - - - - - - Service name - - [a-zA-Z0-9\-]{1,100} - - Service-name can contain aplhanumerical characters and dashes only (max. 100) - - - - #include - - - Advanced protocol options - - - - - Minimum acceptable MTU (68-65535) - - - - - - - - Preferred MRU (68-65535) - - - - - - - - CCP negotiation (default disabled) - - - - #include - #include - #include - #include - - - IPv4 (IPCP) negotiation algorithm - - (deny|allow|prefer|require) - - invalid value - - deny - Do not negotiate IPv4 - - - allow - Negotiate IPv4 only if client requests - - - prefer - Ask client for IPv4 negotiation, do not fail if it rejects - - - require - Require IPv4 negotiation - - - deny allow prefer require - - - - #include - - - Fixed or random interface identifier for IPv6 - - random - - - random - Random interface identifier for IPv6 - - - x:x:x:x - specify interface identifier for IPv6 - - - - - - Peer interface identifier for IPv6 - - random calling-sid ipv4 - - - x:x:x:x - Interface identifier for IPv6 - - - random - Use a random interface identifier for IPv6 - - - ipv4 - Calculate interface identifier from IPv4 address, for example 192:168:0:1 - - - calling-sid - Calculate interface identifier from calling-station-id - - - - - - Accept peer interface identifier - - - - - - - - PADO delays - - u32:1-999999 - Number in ms - - - - - Invalid PADO delay - - - - - Number of sessions - - u32:1-999999 - Number of sessions - - - - - Invalid number of delayed sessions - - - - - - - control sessions count - - (deny|disable|replace) - - Invalid value - - disable - Disables session control - - - deny - Deny second session authorization - - - replace - Terminate first session when second is authorized - - - deny disable replace - - - replace - - - - Enable SNMP - - - - - enable SNMP master agent mode - - - - - - - - Extended script execution - - - - - Script to run before PPPoE session interface comes up - - - - - - - - Script to run when PPPoE session interface is completely configured and started - - - - - - - - Script to run when PPPoE session interface going to terminate - - - - - - - - Script to run when PPPoE session interface changed by RADIUS CoA handling - - - - - - - - - - - - diff --git a/interface-definitions/service_router-advert.xml.in b/interface-definitions/service_router-advert.xml.in deleted file mode 100644 index 40dac23ca..000000000 --- a/interface-definitions/service_router-advert.xml.in +++ /dev/null @@ -1,327 +0,0 @@ - - - - - - - IPv6 Router Advertisements (RAs) service - 900 - - - - - Interface to send RA on - - - - - - - - Set Hop Count field of the IP header for outgoing packets - - u32:0 - Unspecified (by this router) - - - u32:1-255 - Value should represent current diameter of the Internet - - - - - Hop count must be between 0 and 255 - - 64 - - - - Lifetime associated with the default router in units of seconds - - u32:4-9000 - Router Lifetime in seconds - - - 0 - Not a default router - - - - - Default router livetime bust be 0 or between 4 and 9000 - - - - - Preference associated with the default router, - - low medium high - - - low - Default router has low preference - - - medium - Default router has medium preference - - - high - Default router has high preference - - - (low|medium|high) - - Default preference must be low, medium or high - - medium - - - - DNS search list - - - - - - Link MTU value placed in RAs, exluded in RAs if unset - - u32:1280-9000 - Link MTU value in RAs - - - - - Link MTU must be between 1280 and 9000 - - - - - Hosts use the administered (stateful) protocol for address autoconfiguration in addition to any addresses autoconfigured using SLAAC - - - - - - Set interval between unsolicited multicast RAs - - - - - Maximum interval between unsolicited multicast RAs - - u32:4-1800 - Maximum interval in seconds - - - - - Maximum interval must be between 4 and 1800 seconds - - 600 - - - - Minimum interval between unsolicited multicast RAs - - u32:3-1350 - Minimum interval in seconds - - - - - Minimum interval must be between 3 and 1350 seconds - - - - - #include - - - Hosts use the administered (stateful) protocol for autoconfiguration of other (non-address) information - - - - - - IPv6 route to be advertised in Router Advertisements (RAs) - - ipv6net - IPv6 route to be advertized - - - - - - - - - Time in seconds that the route will remain valid - - infinity - - - u32:1-4294967295 - Time in seconds that the route will remain valid - - - infinity - Route will remain preferred forever - - - - (infinity) - - - 1800 - - - - Preference associated with the route, - - low medium high - - - low - Route has low preference - - - medium - Route has medium preference - - - high - Route has high preference - - - (low|medium|high) - - Route preference must be low, medium or high - - medium - - - - Do not announce this route with a zero second lifetime upon shutdown - - - - - - - - IPv6 prefix to be advertised in Router Advertisements (RAs) - - ipv6net - IPv6 prefix to be advertized - - - - - - - - - Prefix can not be used for stateless address auto-configuration - - - - - - Prefix can not be used for on-link determination - - - - - - Time in seconds that the prefix will remain preferred - - infinity - - - u32 - Time in seconds that the prefix will remain preferred - - - infinity - Prefix will remain preferred forever - - - - (infinity) - - - 14400 - - - - Time in seconds that the prefix will remain valid - - infinity - - - u32:1-4294967295 - Time in seconds that the prefix will remain valid - - - infinity - Prefix will remain preferred forever - - - - (infinity) - - - 2592000 - - - - - - Time, in milliseconds, that a node assumes a neighbor is reachable after having received a reachability confirmation - - u32:0 - Reachable Time unspecified by this router - - - u32:1-3600000 - Reachable Time value in RAs (in milliseconds) - - - - - Reachable time must be 0 or between 1 and 3600000 milliseconds - - 0 - - - - Time in milliseconds between retransmitted Neighbor Solicitation messages - - u32:0 - Time, in milliseconds, between retransmitted Neighbor Solicitation messages - - - u32:1-4294967295 - Minimum interval in milliseconds - - - - - Retransmit interval must be 0 or between 1 and 4294967295 milliseconds - - 0 - - - - Do not send router adverts - - - - - - - - - - diff --git a/interface-definitions/service_sla.xml.in b/interface-definitions/service_sla.xml.in deleted file mode 100644 index 0c4f8a591..000000000 --- a/interface-definitions/service_sla.xml.in +++ /dev/null @@ -1,36 +0,0 @@ - - - - - - - Service level agreement (SLA) - - - - - One-way active measurement protocol (OWAMP) server - - - #include - - 861 - - - - - - Two-way active measurement protocol (TWAMP) server - - - #include - - 862 - - - - - - - - diff --git a/interface-definitions/service_upnp.xml.in b/interface-definitions/service_upnp.xml.in deleted file mode 100644 index a129b7260..000000000 --- a/interface-definitions/service_upnp.xml.in +++ /dev/null @@ -1,224 +0,0 @@ - - - - - - - Universal Plug and Play (UPnP) service - 900 - - - - - Name of this service - - txt - Friendly name - - - - - - WAN network interface - - - - - - - - - - - WAN network IP - - ipv4 - IPv4 address - - - ipv6 - IPv6 address - - - - - - - - - - - Enable NAT-PMP support - - - - - - Enable Secure Mode - - - - - - Presentation Url - - txt - Presentation Url - - - - - - PCP-base lifetime Option - - - - - Max lifetime time - - - - - - - - Min lifetime time - - - - - - - - - - Local IP addresses for service to listen on - - - - - - <interface> - Monitor interface address - - - ipv4 - IP address to listen for incoming connections - - - ipv4-prefix - IP prefix to listen for incoming connections - - - ipv6 - IP address to listen for incoming connections - - - ipv6-prefix - IP prefix to listen for incoming connections - - - - - - - - - - - - - - Enable STUN probe support (can be used with NAT 1:1 support for WAN interfaces) - - - - - The STUN server address - - txt - The STUN server host address - - - - - - - #include - - - - - UPnP Rule - - u32:0-65535 - Rule number - - - - - - - #include - - - Port range (REQUIRE) - - <port> - single port - - - <portN>-<portM> - Port range (use '-' as delimiter) - - - - - - - - - Port range (REQUIRE) - - <port> - single port - - - <portN>-<portM> - Port range (use '-' as delimiter) - - - - - - - - - The IP to which this rule applies (REQUIRE) - - ipv4 - The IPv4 to which this rule applies - - - - - - - - - Actions against the rule (REQUIRE) - - allow deny - - - (allow|deny) - - - - - - - - - - diff --git a/interface-definitions/service_webproxy.xml.in b/interface-definitions/service_webproxy.xml.in deleted file mode 100644 index e4609b699..000000000 --- a/interface-definitions/service_webproxy.xml.in +++ /dev/null @@ -1,636 +0,0 @@ - - - - - - - Webproxy service settings - 500 - - - - - Default domain name - - domain - Domain to use for urls that do not contain a '.' - - - [.][A-Za-z0-9][-.A-Za-z0-9]* - - Must start append-domain with a '.' - - - - - Proxy Authentication Settings - - - - - Number of authentication helper processes - - n - Number of authentication helper processes - - - - - - 5 - - - - Authenticated session time to live in minutes - - n - Authenticated session timeout - - - - - - 60 - - - - LDAP authentication settings - - - - - LDAP Base DN to search - - - - - LDAP DN used to bind to server - - - - - Filter expression to perform LDAP search with - - - - - LDAP password to bind with - - - - - Use persistent LDAP connection - - - - #include - - 389 - - - - LDAP server to use - - - - - Use SSL/TLS for LDAP connection - - - - - - LDAP username attribute - - - - - LDAP protocol version - - 2 3 - - - 2 - LDAP protocol version 2 - - - 3 - LDAP protocol version 2 - - - - - - 3 - - - - - - Authentication Method - - ldap - - - ldap - Lightweight Directory Access Protocol - - - (ldap) - - The only supported method currently is LDAP - - - - - Name of authentication realm (e.g. "My Company proxy server") - - - - - - - Specify other caches in a hierarchy - - hostname - Cache peers FQDN - - - - - - Hostname or IP address of peer - - ipv4 - Squid cache-peer IPv4 address - - - hostname - Squid cache-peer hostname - - - - - - Invalid FQDN or IP address - - - - - Default Proxy Port - - u32:1025-65535 - Default port number - - - - - - 3128 - - - - Cache peer ICP port - - u32:0 - Cache peer disabled - - - u32:1-65535 - Cache peer ICP port - - - - - - 0 - - - - Cache peer options - - txt - Cache peer options - - - no-query default - - - - Squid peer type (default parent) - - parent sibling multicast - - - parent - Peer is a parent - - - sibling - Peer is a sibling - - - multicast - Peer is a member of a multicast group - - - (parent|sibling|multicast) - - - parent - - - - - - Disk cache size in MB - - u32 - Disk cache size in MB - - - 0 - Disable disk caching - - - 100 - - - - Default Proxy Port - - u32:1025-65535 - Default port number - - - - - - 3128 - - - - Disable logging of HTTP accesses - - - - - - Domain name to block - - - - - - Domain name to access without caching - - - - - - IPv4 listen-address for WebProxy - - - - - ipv4 - IPv4 address listen on - - - - - - Default Proxy Port - - u32:1025-65535 - Default port number - - - - - - - - - - Disable transparent mode - - - - - - - - Maximum size of object to be stored in cache in kilobytes - - u32 - Object size in KB - - - - - - - - - Memory cache size in MB - - u32 - Memory cache size in MB - - - - - - 20 - - - - Maximum size of object to be stored in cache in kilobytes - - u32 - Object size in KB - - - - - - - - - Outgoing IP address for webproxy - - - - - MIME type to block - - image/gif www/mime application/macbinary application/oda application/octet-stream application/pdf application/postscript application/postscript application/postscript text/rtf application/octet-stream application/octet-stream application/x-tar application/x-csh application/x-dvi application/x-hdf application/x-latex text/plain application/x-netcdf application/x-netcdf application/x-sh application/x-tcl application/x-tex application/x-texinfo application/x-texinfo application/x-troff application/x-troff application/x-troff application/x-troff-man application/x-troff-me application/x-troff-ms application/x-wais-source application/zip application/x-bcpio application/x-cpio application/x-gtar application/x-rpm application/x-shar application/x-sv4cpio application/x-sv4crc application/x-tar application/x-ustar audio/basic audio/basic audio/mpeg audio/mpeg audio/mpeg audio/x-aiff audio/x-aiff audio/x-aiff audio/x-wav image/bmp image/ief image/jpeg image/jpeg image/jpeg image/tiff image/tiff image/x-cmu-raster image/x-portable-anymap image/x-portable-bitmap image/x-portable-graymap image/x-portable-pixmap image/x-rgb image/x-xbitmap image/x-xpixmap image/x-xwindowdump text/html text/html text/css application/x-javascript text/plain text/plain text/plain text/plain text/plain text/plain text/plain text/plain text/plain text/richtext text/tab-separated-values text/x-setext video/mpeg video/mpeg video/mpeg video/quicktime video/quicktime video/x-msvideo video/x-sgi-movie application/mac-compactpro application/mac-binhex40 application/macwriteii application/msword application/msword application/vnd.ms-excel application/vnd.ms-powerpoint application/vnd.lotus-1-2-3 application/vnd.mif application/x-stuffit application/pict application/pict application/x-arj-compressed application/x-lha-compressed application/x-lha-compressed application/x-deflate text/plain application/octet-stream application/octet-stream image/png application/octet-stream application/x-xpinstall application/octet-stream text/plain application/x-director application/x-director application/x-director image/vnd.djvu image/vnd.djvu application/octet-stream application/octet-stream application/andrew-inset x-conference/x-cooltalk model/iges model/iges audio/midi audio/midi audio/midi model/mesh model/mesh video/vnd.mpegurl chemical/x-pdb application/x-chess-pgn audio/x-realaudio audio/x-pn-realaudio audio/x-pn-realaudio text/sgml text/sgml application/x-koan application/x-koan application/x-koan application/x-koan application/smil application/smil application/octet-stream application/x-futuresplash application/x-shockwave-flash application/x-cdlink model/vrml image/vnd.wap.wbmp application/vnd.wap.wbxml application/vnd.wap.wmlc application/vnd.wap.wmlscriptc application/vnd.wap.wmlscript application/xhtml application/xhtml text/xml text/xml chemical/x-xyz text/plain - - - (image/gif|www/mime|application/macbinary|application/oda|application/octet-stream|application/pdf|application/postscript|application/postscript|application/postscript|text/rtf|application/octet-stream|application/octet-stream|application/x-tar|application/x-csh|application/x-dvi|application/x-hdf|application/x-latex|text/plain|application/x-netcdf|application/x-netcdf|application/x-sh|application/x-tcl|application/x-tex|application/x-texinfo|application/x-texinfo|application/x-troff|application/x-troff|application/x-troff|application/x-troff-man|application/x-troff-me|application/x-troff-ms|application/x-wais-source|application/zip|application/x-bcpio|application/x-cpio|application/x-gtar|application/x-rpm|application/x-shar|application/x-sv4cpio|application/x-sv4crc|application/x-tar|application/x-ustar|audio/basic|audio/basic|audio/mpeg|audio/mpeg|audio/mpeg|audio/x-aiff|audio/x-aiff|audio/x-aiff|audio/x-wav|image/bmp|image/ief|image/jpeg|image/jpeg|image/jpeg|image/tiff|image/tiff|image/x-cmu-raster|image/x-portable-anymap|image/x-portable-bitmap|image/x-portable-graymap|image/x-portable-pixmap|image/x-rgb|image/x-xbitmap|image/x-xpixmap|image/x-xwindowdump|text/html|text/html|text/css|application/x-javascript|text/plain|text/plain|text/plain|text/plain|text/plain|text/plain|text/plain|text/plain|text/plain|text/richtext|text/tab-separated-values|text/x-setext|video/mpeg|video/mpeg|video/mpeg|video/quicktime|video/quicktime|video/x-msvideo|video/x-sgi-movie|application/mac-compactpro|application/mac-binhex40|application/macwriteii|application/msword|application/msword|application/vnd.ms-excel|application/vnd.ms-powerpoint|application/vnd.lotus-1-2-3|application/vnd.mif|application/x-stuffit|application/pict|application/pict|application/x-arj-compressed|application/x-lha-compressed|application/x-lha-compressed|application/x-deflate|text/plain|application/octet-stream|application/octet-stream|image/png|application/octet-stream|application/x-xpinstall|application/octet-stream|text/plain|application/x-director|application/x-director|application/x-director|image/vnd.djvu|image/vnd.djvu|application/octet-stream|application/octet-stream|application/andrew-inset|x-conference/x-cooltalk|model/iges|model/iges|audio/midi|audio/midi|audio/midi|model/mesh|model/mesh|video/vnd.mpegurl|chemical/x-pdb|application/x-chess-pgn|audio/x-realaudio|audio/x-pn-realaudio|audio/x-pn-realaudio|text/sgml|text/sgml|application/x-koan|application/x-koan|application/x-koan|application/x-koan|application/smil|application/smil|application/octet-stream|application/x-futuresplash|application/x-shockwave-flash|application/x-cdlink|model/vrml|image/vnd.wap.wbmp|application/vnd.wap.wbxml|application/vnd.wap.wmlc|application/vnd.wap.wmlscriptc|application/vnd.wap.wmlscript|application/xhtml|application/xhtml|text/xml|text/xml|chemical/x-xyz|text/plain) - - - - - - - Maximum reply body size in KB - - u32 - Reply size in KB - - - - - - - - - URL filtering settings - - - #include - - - URL filtering via squidGuard redirector - - - #include - - - Auto update settings - - - - - Hour of day for database update - - u32:0-23 - Hour for database update - - - - - - 0 - - - - - - Redirect URL for filtered websites - - url - URL for redirect - - - block.vyos.net - - - - URL filter rule for a source-group - - u32:1-1024 - Rule Number - - - - - SquidGuard rule must between 1-1024 - - - #include - - - Redirect URL for filtered websites - - url - URL for redirect - - - - - - Source-group for this rule - - group - Source group identifier for this rule - - - service webproxy url-filtering squidguard source-group - - - - - - Time-period for this rule - - period - Time period for this rule - - - service webproxy url-filtering squidguard time-period - - - - - - - - Source group name - - name - Name of source group - - - [^0-9][a-zA-Z_][a-zA-Z0-9][\w\-\.]* - - URL-filter source-group cannot start with a number! - - - - - Address for source-group - - ipv4 - IPv4 address to match - - - ipv4net - IPv4 prefix to match - - - ipv4range - IPv4 address range to match - - - - - - - - - - - - Description for source-group - - - - - Domain for source-group - - domain - Domain name for the source-group - - - - - - - LDAP search expression for an IP address list - - - - - - LDAP search expression for a user group - - - - - - List of user names - - - - - - - Time period name - - - - - Time-period days - - Sun Mon Tue Wed Thu Fri Sat weekdays weekend all - - - Sun - Sunday - - - Mon - Monday - - - Tue - Tuesday - - - Wed - Wednesday - - - Thu - Thursday - - - Fri - Friday - - - Sat - Saturday - - - weekdays - Monday through Friday - - - weekend - Saturday and Sunday - - - all - All days of the week - - - (Sun|Mon|Tue|Wed|Thu|Fri|Sat|weekdays|weekend|all) - - - - - - Time for time-period - - <hh:mm - hh:mm> - Time range in 24hr time - - - - (\d\d:\d\d)-(\d\d:\d\d) - - Expected time format hh:mm - hh:mm in 24hr time - - - - - - - Time-period description - - - - - - - - - - - - - diff --git a/interface-definitions/system-acceleration-qat.xml.in b/interface-definitions/system-acceleration-qat.xml.in new file mode 100644 index 000000000..812484184 --- /dev/null +++ b/interface-definitions/system-acceleration-qat.xml.in @@ -0,0 +1,21 @@ + + + + + + + Acceleration components + 50 + + + + + Enable Intel QAT (Quick Assist Technology) for cryptographic acceleration + + + + + + + + diff --git a/interface-definitions/vpn-ipsec.xml.in b/interface-definitions/vpn-ipsec.xml.in new file mode 100644 index 000000000..d36fbb024 --- /dev/null +++ b/interface-definitions/vpn-ipsec.xml.in @@ -0,0 +1,1169 @@ + + + + + Virtual Private Network (VPN) + + + + + VPN IP security (IPsec) parameters + 901 + + + + + Disable requirement for unique IDs in the Security Database + + + + + + Encapsulating Security Payload (ESP) group name + + + + + ESP compression + + disable enable + + + disable + Disable ESP compression + + + enable + Enable ESP compression + + + (disable|enable) + + + disable + + + + Security Association time to expire + + u32:30-86400 + SA lifetime in seconds + + + + + + 3600 + + + + Security Association byte count to expire + + u32:1024-26843545600000 + SA life in bytes + + + + + + + + + Security Association packet count to expire + + u32:1000-26843545600000 + SA life in packets + + + + + + + + + ESP mode + + tunnel transport + + + tunnel + Tunnel mode + + + transport + Transport mode + + + (tunnel|transport) + + + tunnel + + + + ESP Perfect Forward Secrecy + + enable dh-group1 dh-group2 dh-group5 dh-group14 dh-group15 dh-group16 dh-group17 dh-group18 dh-group19 dh-group20 dh-group21 dh-group22 dh-group23 dh-group24 dh-group25 dh-group26 dh-group27 dh-group28 dh-group29 dh-group30 dh-group31 dh-group32 disable + + + enable + Inherit Diffie-Hellman group from the IKE group + + + dh-group1 + Use Diffie-Hellman group 1 (modp768) + + + dh-group2 + Use Diffie-Hellman group 2 (modp1024) + + + dh-group5 + Use Diffie-Hellman group 5 (modp1536) + + + dh-group14 + Use Diffie-Hellman group 14 (modp2048) + + + dh-group15 + Use Diffie-Hellman group 15 (modp3072) + + + dh-group16 + Use Diffie-Hellman group 16 (modp4096) + + + dh-group17 + Use Diffie-Hellman group 17 (modp6144) + + + dh-group18 + Use Diffie-Hellman group 18 (modp8192) + + + dh-group19 + Use Diffie-Hellman group 19 (ecp256) + + + dh-group20 + Use Diffie-Hellman group 20 (ecp384) + + + dh-group21 + Use Diffie-Hellman group 21 (ecp521) + + + dh-group22 + Use Diffie-Hellman group 22 (modp1024s160) + + + dh-group23 + Use Diffie-Hellman group 23 (modp2048s224) + + + dh-group24 + Use Diffie-Hellman group 24 (modp2048s256) + + + dh-group25 + Use Diffie-Hellman group 25 (ecp192) + + + dh-group26 + Use Diffie-Hellman group 26 (ecp224) + + + dh-group27 + Use Diffie-Hellman group 27 (ecp224bp) + + + dh-group28 + Use Diffie-Hellman group 28 (ecp256bp) + + + dh-group29 + Use Diffie-Hellman group 29 (ecp384bp) + + + dh-group30 + Use Diffie-Hellman group 30 (ecp512bp) + + + dh-group31 + Use Diffie-Hellman group 31 (curve25519) + + + dh-group32 + Use Diffie-Hellman group 32 (curve448) + + + disable + Disable PFS + + + (enable|dh-group1|dh-group2|dh-group5|dh-group14|dh-group15|dh-group16|dh-group17|dh-group18|dh-group19|dh-group20|dh-group21|dh-group22|dh-group23|dh-group24|dh-group25|dh-group26|dh-group27|dh-group28|dh-group29|dh-group30|dh-group31|dh-group32|disable) + + + enable + + + + ESP group proposal + + u32:1-65535 + ESP group proposal number + + + + #include + #include + + + + + + + Internet Key Exchange (IKE) group name + + + + + Action to take if a child SA is unexpectedly closed + + none hold restart + + + none + Do nothing + + + hold + Attempt to re-negotiate when matching traffic is seen + + + restart + Attempt to re-negotiate the connection immediately + + + (none|hold|restart) + + + + + + Dead Peer Detection (DPD) + + + + + Keep-alive failure action + + hold clear restart + + + hold + Attempt to re-negotiate the connection when matching traffic is seen + + + clear + Remove the connection immediately + + + restart + Attempt to re-negotiate the connection immediately + + + (hold|clear|restart) + + + + + + Keep-alive interval + + u32:2-86400 + Keep-alive interval in seconds + + + + + + 30 + + + + Dead Peer Detection keep-alive timeout (IKEv1 only) + + u32:2-86400 + Keep-alive timeout in seconds + + + + + + 120 + + + + + + Re-authentication of the remote peer during an IKE re-key (IKEv2 only) + + yes no + + + yes + Enable remote host re-authentication during an IKE rekey (currently broken due to a strongswan bug) + + + no + Disable remote host re-authenticaton during an IKE rekey + + + (yes|no) + + + + + + IKE version + + ikev1 ikev2 + + + ikev1 + Use IKEv1 for key exchange + + + ikev2 + Use IKEv2 for key exchange + + + (ikev1|ikev2) + + + + + + IKE lifetime + + u32:30-86400 + IKE lifetime in seconds + + + + + + 28800 + + + + Enable MOBIKE Support (IKEv2 only) + + enable disable + + + enable + Enable MOBIKE + + + disable + Disable MOBIKE + + + (enable|disable) + + + enable + + + + IKEv1 phase 1 mode + + main aggressive + + + main + Use the main mode (recommended) + + + aggressive + Use the aggressive mode (insecure, not recommended) + + + (main|aggressive) + + + main + + + + IKE proposal + + u32:1-65535 + IKE group proposal + + + + + + dh-grouphelp + + 1 2 5 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 + + + 1 + Diffie-Hellman group 1 (modp768) + + + 2 + Diffie-Hellman group 2 (modp1024) + + + 5 + Diffie-Hellman group 5 (modp1536) + + + 14 + Diffie-Hellman group 14 (modp2048) + + + 15 + Diffie-Hellman group 15 (modp3072) + + + 16 + Diffie-Hellman group 16 (modp4096) + + + 17 + Diffie-Hellman group 17 (modp6144) + + + 18 + Diffie-Hellman group 18 (modp8192) + + + 19 + Diffie-Hellman group 19 (ecp256) + + + 20 + Diffie-Hellman group 20 (ecp384) + + + 21 + Diffie-Hellman group 21 (ecp521) + + + 22 + Diffie-Hellman group 22 (modp1024s160) + + + 23 + Diffie-Hellman group 23 (modp2048s224) + + + 24 + Diffie-Hellman group 24 (modp2048s256) + + + 25 + Diffie-Hellman group 25 (ecp192) + + + 26 + Diffie-Hellman group 26 (ecp224) + + + 27 + Diffie-Hellman group 27 (ecp224bp) + + + 28 + Diffie-Hellman group 28 (ecp256bp) + + + 29 + Diffie-Hellman group 29 (ecp384bp) + + + 30 + Diffie-Hellman group 30 (ecp512bp) + + + 31 + Diffie-Hellman group 31 (curve25519) + + + 32 + Diffie-Hellman group 32 (curve448) + + + (1|2|5|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32) + + + 2 + + #include + #include + + + + + + + Absolute path to specify a strongSwan config include file + + + + + Absolute path to a strongSwan secrets include file + + + #include + + + IPsec logging + + + + + Global IPsec logging Level + + 0 + Very basic auditing logs (e.g., SA up/SA down) + + + 1 + Generic control flow with errors, a good default to see whats going on + + + 2 + More detailed debugging control flow + + + + + + 0 + + + + Subsystem logging levels + + dmn mgr ike chd job cfg knl net asn enc lib esp tls tnc imc imv pts any + + + dmn + Main daemon setup/cleanup/signal handling + + + mgr + IKE_SA manager, handling synchronization for IKE_SA access + + + ike + IKE_SA/ISAKMP SA + + + chd + CHILD_SA/IPsec SA + + + job + Jobs queuing/processing and thread pool management + + + cfg + Configuration management and plugins + + + knl + IPsec/Networking kernel interface + + + net + IKE network communication + + + asn + Low-level encoding/decoding (ASN.1, X.509 etc.) + + + enc + Packet encoding/decoding encryption/decryption operations + + + lib + libstrongswan library messages + + + esp + libipsec library messages + + + tls + libtls library messages + + + tnc + Trusted Network Connect + + + imc + Integrity Measurement Collector + + + imv + Integrity Measurement Verifier + + + pts + Platform Trust Service + + + any + Any subsystem + + + (dmn|mgr|ike|chd|job|cfg|knl|net|asn|enc|lib|esp|tls|tnc|imc|imv|pts|any) + + + + + + + + + Global IPsec settings + + + + + Do not automatically install routes to remote networks + + + + + + Allow FlexVPN vendor ID payload (IKEv2 only) + + + + #include + + + Allow install virtual-ip addresses + + + + + + + + VPN IPsec profile + + + #include + + + Authentication + + + + + Authentication mode + + pre-shared-secret + + + pre-shared-secret + Use a pre-shared secret key + + + + #include + + + + + DMVPN tunnel configuration + + + + + Tunnel interface associated with this profile + + interfaces tunnel + + + txt + Associated interface to this profile + + + + + + + #include + #include + + + + + IKEv2 remote access VPN + + + + + IKEv2 VPN connection name + + + + + Authentication for remote access + + + #include + #include + + + Client authentication mode + + eap-tls eap-mschapv2 eap-radius + + + eap-tls + Use EAP-TLS authentication + + + eap-mschapv2 + Use EAP-MSCHAPv2 authentication + + + eap-radius + Use EAP-RADIUS authentication + + + (eap-tls|eap-mschapv2|eap-radius) + + + eap-mschapv2 + + #include + + + Server authentication mode + + pre-shared-secret x509 + + + pre-shared-secret + Use a pre-shared secret key + + + x509 + Use x.509 certificate + + + (pre-shared-secret|x509) + + + x509 + + #include + + + #include + #include + #include + #include + #include + #include + + + Timeout to close connection if no data is transmitted + + u32:0 + Disable inactivity checks + + + u32:1-86400 + Timeout in seconds + + + + + + 28800 + + + + IP address pool + + vpn ipsec remote-access pool + dhcp radius + + + txt + Predefined IP pool name + + + dhcp + Forward requests for virtual IP addresses to a DHCP server + + + radius + Forward requests for virtual IP addresses to a RADIUS server + + + + + + + Connection uniqueness enforcement policy + + never keep replace + + + never + Never enforce connection uniqueness + + + keep + Reject new connection attempts if the same user already has an active connection + + + replace + Delete any existing connection if a new one for the same user gets established + + + (never|keep|replace) + + + + + + + + DHCP pool options for remote access + + + #include + + + DHCP server address + + ipv4 + DHCP server IPv4 address + + + + + + + + + + + IP address pool for remote access users + + + + + Local IPv4 or IPv6 pool prefix exclusions + + ipv4net + Local IPv4 pool prefix exclusion + + + ipv6net + Local IPv6 pool prefix exclusion + + + + + + + + + + + Local IPv4 or IPv6 pool prefix + + ipv4net + Local IPv4 pool prefix + + + ipv6net + Local IPv6 pool prefix + + + + + + + + #include + + + #include + + + #include + + + #include + + + + + + + + + Site-to-site VPN + + + + + VPN peer + + ipv4 + IPv4 address of the peer + + + ipv6 + IPv6 address of the peer + + + txt + Hostname of the peer + + + <@text> + ID of the peer + + + + #include + + + Peer authentication + + + #include + #include + #include + + + Authentication mode + + pre-shared-secret rsa x509 + + + pre-shared-secret + Use pre-shared secret key + + + rsa + Use RSA key + + + x509 + Use x.509 certificate + + + (pre-shared-secret|rsa|x509) + + + + #include + + + ID for remote authentication + + txt + ID used for peer authentication + + + + + + Use certificate common name as ID + + + + + + + + Connection type + + initiate respond none + + + initiate + Bring the connection up immediately + + + respond + Wait for the peer to initiate the connection + + + none + Load the connection only + + + (initiate|respond|none) + + + + + + Defult ESP group name + + vpn ipsec esp-group + + + + #include + #include + + + Force UDP Encapsulation for ESP payloads + + enable disable + + + enable + Force UDP encapsulation + + + disable + Do not force UDP encapsulation + + + (enable|disable) + + + + #include + + + Re-authentication of the remote peer during an IKE re-key (IKEv2 only) + + yes no inherit + + + yes + Enable remote host re-autentication during an IKE re-key. Currently broken due to a strong swan bug + + + no + Disable remote host re-authenticaton during an IKE re-key. + + + inherit + Inherit the reauth configuration form your IKE-group + + + (yes|no|inherit) + + + + #include + + + Peer tunnel + + u32 + Peer tunnel + + + + #include + #include + #include + #include + + + Priority for IPsec policy (lowest value more preferable) + + u32:1-100 + Priority for IPsec policy (lowest value more preferable) + + + + + + + + + Match remote addresses + + + #include + + + Remote IPv4 or IPv6 prefix + + ipv4net + Remote IPv4 prefix + + + ipv6net + Remote IPv6 prefix + + + + + + + + + + + + + + + Initiator request virtual-address from peer + + ipv4 + Request IPv4 address from peer + + + ipv6 + Request IPv6 address from peer + + + + + + + Virtual tunnel interface + + + + + VTI tunnel interface associated with this configuration + + interfaces vti + + + + #include + + + + + + + + + + + diff --git a/interface-definitions/vpn-l2tp.xml.in b/interface-definitions/vpn-l2tp.xml.in new file mode 100644 index 000000000..f734283e7 --- /dev/null +++ b/interface-definitions/vpn-l2tp.xml.in @@ -0,0 +1,282 @@ + + + + + + + L2TP Virtual Private Network (VPN) + 902 + + + + + Remote access L2TP VPN + + + #include + + + External IP address to which VPN clients will connect + + + + + + #include + #include + + + L2TP Network Server (LNS) + + + + + Tunnel password used to authenticate the client (LAC) + + + + + Sent to the client (LAC) in the Host-Name attribute + + [A-Za-z0-9][-.A-Za-z0-9]*[A-Za-z0-9] + + + + + + + + Disable Compression Control Protocol (CCP) + + + + + + Internet Protocol Security (IPsec) for remote access L2TP VPN + + + + + IPsec authentication settings + + + + + Authentication mode for IPsec + + pre-shared-secret + Use pre-shared secret for IPsec authentication + + + x509 + Use X.509 certificate for IPsec authentication + + + (pre-shared-secret|x509) + + + pre-shared-secret x509 + + + + #include + #include + + + + + IKE lifetime + + u32:30-86400 + IKE lifetime in seconds + + + + + + 3600 + + + + ESP lifetime + + u32:30-86400 + IKE lifetime in seconds + + + + + + 3600 + + #include + #include + + + #include + + + Pool of client IP addresses (must be within a /24) + + + #include + #include + + + #include + + + Description for L2TP remote-access settings + + + #include + + + PPP idle timeout + + u32:30-86400 + PPP idle timeout in seconds + + + + + + + + + Authentication for remote access L2TP VPN + + + + + Authentication protocol for remote access peer L2TP VPN + + pap + Require the peer to authenticate itself using PAP [Password Authentication Protocol]. + + + chap + Require the peer to authenticate itself using CHAP [Challenge Handshake Authentication Protocol]. + + + mschap + Require the peer to authenticate itself using CHAP [Challenge Handshake Authentication Protocol]. + + + mschap-v2 + Require the peer to authenticate itself using MS-CHAPv2 [Microsoft Challenge Handshake Authentication Protocol, Version 2]. + + + (pap|chap|mschap|mschap-v2) + + + pap chap mschap mschap-v2 + + + + + #include + #include + #include + #include + + + + + #include + + + Mark server unavailable for N seconds on failure + + u32:0-600 + Fail time penalty + + + + + Fail time must be between 0 and 600 seconds + + + + + + + Timeout to wait response from server (seconds) + + + + + Timeout to wait reply for Interim-Update packets + + + + + Maximum number of tries to send Access-Request/Accounting-Request queries + + + #include + + + IPv4 address and port to bind Dynamic Authorization Extension server (DM/CoA) + + + + + IP address for Dynamic Authorization Extension server (DM/CoA) + + + + + Port for Dynamic Authorization Extension server (DM/CoA) + + + + + Secret for Dynamic Authorization Extension server (DM/CoA) + + + + + + + Upload/Download speed limits + + + + + Specifies which radius attribute contains rate information + + + + + Specifies the vendor dictionary. (dictionary needs to be in /usr/share/accel-ppp/radius) + + + + + Enables Bandwidth shaping via RADIUS + + + + + + + + + + + + Advanced protocol options + + + #include + #include + + + + + + + + + diff --git a/interface-definitions/vpn-openconnect.xml.in b/interface-definitions/vpn-openconnect.xml.in new file mode 100644 index 000000000..21b47125d --- /dev/null +++ b/interface-definitions/vpn-openconnect.xml.in @@ -0,0 +1,274 @@ + + + + + + + SSL VPN OpenConnect, AnyConnect compatible server + 901 + + + + + Authentication for remote access SSL VPN Server + + + + + Authentication mode used by this server + + + + + Use local username/password configuration (OTP supported) + + password + Password-only local authentication + + + otp + OTP-only local authentication + + + password-otp + Password (first) + OTP local authentication + + + (password|otp|password-otp) + + Invalid authentication mode. Must be one of: password, otp or password-otp + + otp password password-otp + + + + + + Use RADIUS server for user autentication + + + + + + #include + + + + + + + 2FA OTP authentication parameters + + + + + Token Key Secret key for the token algorithm (see RFC 4226) + + txt + OTP key in hex-encoded format + + + [a-fA-F0-9]{20,10000} + + Key name must only include hex characters and be at least 20 characters long + + + + + Number of digits in OTP code + + u32:6-8 + Number of digits in OTP code + + + + + Number of digits in OTP code must be between 6 and 8 + + 6 + + + + Time tokens interval in seconds + + u32:5-86400 + Time tokens interval in seconds. + + + + + Time token interval must be between 5 and 86400 seconds + + 30 + + + + Token type + + hotp-time + Time-based OTP algorithm + + + hotp-event + Event-based OTP algorithm + + + (hotp-time|hotp-event) + + + hotp-time hotp-event + + + hotp-time + + + + + + + + #include + + + + + Session timeout + + u32:1-240 + Session timeout in seconds (default: 2) + + + + + Timeout must be between 1 and 240 seconds + + 2 + + + + + + + + Specify custom ports to use for client connections + + + + + tcp port number to accept connections + + u32:1-65535 + Numeric IP port + + + + + + 443 + + + + udp port number to accept connections + + u32:1-65535 + Numeric IP port + + + + + + 443 + + + + + + SSL Certificate, SSL Key and CA + + + #include + #include + + + + + Network settings + + + + + Route to be pushed to the client + + ipv4net + IPv4 network and prefix length + + + ipv6net + IPv6 network and prefix length + + + + + + + + + + Client IP pools settings + + + + + Client IP subnet (CIDR notation) + + ipv4net + IPv4 address and prefix length + + + + + Not a valid CIDR formatted prefix + + + + + + + Pool of client IPv6 addresses + + + + + Pool of addresses used to assign to clients + + ipv6net + IPv6 address and prefix length + + + + + + + + + Prefix length used for individual client + + u32:48-128 + Client prefix length + + + + + + 64 + + + + #include + + + + + + + diff --git a/interface-definitions/vpn-pptp.xml.in b/interface-definitions/vpn-pptp.xml.in new file mode 100644 index 000000000..28a53acb9 --- /dev/null +++ b/interface-definitions/vpn-pptp.xml.in @@ -0,0 +1,121 @@ + + + + + + + Point to Point Tunneling Protocol (PPTP) Virtual Private Network (VPN) + 901 + + + + + Remote access PPTP VPN + + + #include + + + External IP address to which VPN clients will connect + + + + + + #include + #include + + + Pool of client IP addresses (must be within a /24) + + + #include + + + #include + + + Authentication for remote access PPTP VPN + + + + + Authentication protocol for remote access peer PPTP VPN + + pap + Require the peer to authenticate itself using PAP [Password Authentication Protocol]. + + + chap + Require the peer to authenticate itself using CHAP [Challenge Handshake Authentication Protocol]. + + + mschap + Require the peer to authenticate itself using CHAP [Challenge Handshake Authentication Protocol]. + + + mschap-v2 + Require the peer to authenticate itself using MS-CHAPv2 [Microsoft Challenge Handshake Authentication Protocol, Version 2]. + + + + + + Specifies mppe negotioation preference. (default require mppe 128-bit stateless + + deny + deny mppe + + + prefer + ask client for mppe, if it rejects do not fail + + + require + ask client for mppe, if it rejects drop connection + + + (deny|prefer|require) + + + deny prefer require + + + + #include + + + Local user authentication for remote access PPTP VPN + + + + + User name for authentication + + + #include + + + Password for authentication + + + + + Static client IP address + + + + + + + #include + #include + + + + + + + + + diff --git a/interface-definitions/vpn-sstp.xml.in b/interface-definitions/vpn-sstp.xml.in new file mode 100644 index 000000000..195d581df --- /dev/null +++ b/interface-definitions/vpn-sstp.xml.in @@ -0,0 +1,69 @@ + + + + + + + Secure Socket Tunneling Protocol (SSTP) server + 901 + + + + + Authentication for remote access SSTP Server + + + #include + #include + #include + #include + #include + + + #include + + + + + #include + #include + #include + + + Client IP pools and gateway setting + + + #include + + + #include + #include + + 443 + + + + PPP (Point-to-Point Protocol) settings + + + #include + #include + #include + #include + #include + + + + + SSL Certificate, SSL Key and CA + + + #include + #include + + + + + + + diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in deleted file mode 100644 index d36fbb024..000000000 --- a/interface-definitions/vpn_ipsec.xml.in +++ /dev/null @@ -1,1169 +0,0 @@ - - - - - Virtual Private Network (VPN) - - - - - VPN IP security (IPsec) parameters - 901 - - - - - Disable requirement for unique IDs in the Security Database - - - - - - Encapsulating Security Payload (ESP) group name - - - - - ESP compression - - disable enable - - - disable - Disable ESP compression - - - enable - Enable ESP compression - - - (disable|enable) - - - disable - - - - Security Association time to expire - - u32:30-86400 - SA lifetime in seconds - - - - - - 3600 - - - - Security Association byte count to expire - - u32:1024-26843545600000 - SA life in bytes - - - - - - - - - Security Association packet count to expire - - u32:1000-26843545600000 - SA life in packets - - - - - - - - - ESP mode - - tunnel transport - - - tunnel - Tunnel mode - - - transport - Transport mode - - - (tunnel|transport) - - - tunnel - - - - ESP Perfect Forward Secrecy - - enable dh-group1 dh-group2 dh-group5 dh-group14 dh-group15 dh-group16 dh-group17 dh-group18 dh-group19 dh-group20 dh-group21 dh-group22 dh-group23 dh-group24 dh-group25 dh-group26 dh-group27 dh-group28 dh-group29 dh-group30 dh-group31 dh-group32 disable - - - enable - Inherit Diffie-Hellman group from the IKE group - - - dh-group1 - Use Diffie-Hellman group 1 (modp768) - - - dh-group2 - Use Diffie-Hellman group 2 (modp1024) - - - dh-group5 - Use Diffie-Hellman group 5 (modp1536) - - - dh-group14 - Use Diffie-Hellman group 14 (modp2048) - - - dh-group15 - Use Diffie-Hellman group 15 (modp3072) - - - dh-group16 - Use Diffie-Hellman group 16 (modp4096) - - - dh-group17 - Use Diffie-Hellman group 17 (modp6144) - - - dh-group18 - Use Diffie-Hellman group 18 (modp8192) - - - dh-group19 - Use Diffie-Hellman group 19 (ecp256) - - - dh-group20 - Use Diffie-Hellman group 20 (ecp384) - - - dh-group21 - Use Diffie-Hellman group 21 (ecp521) - - - dh-group22 - Use Diffie-Hellman group 22 (modp1024s160) - - - dh-group23 - Use Diffie-Hellman group 23 (modp2048s224) - - - dh-group24 - Use Diffie-Hellman group 24 (modp2048s256) - - - dh-group25 - Use Diffie-Hellman group 25 (ecp192) - - - dh-group26 - Use Diffie-Hellman group 26 (ecp224) - - - dh-group27 - Use Diffie-Hellman group 27 (ecp224bp) - - - dh-group28 - Use Diffie-Hellman group 28 (ecp256bp) - - - dh-group29 - Use Diffie-Hellman group 29 (ecp384bp) - - - dh-group30 - Use Diffie-Hellman group 30 (ecp512bp) - - - dh-group31 - Use Diffie-Hellman group 31 (curve25519) - - - dh-group32 - Use Diffie-Hellman group 32 (curve448) - - - disable - Disable PFS - - - (enable|dh-group1|dh-group2|dh-group5|dh-group14|dh-group15|dh-group16|dh-group17|dh-group18|dh-group19|dh-group20|dh-group21|dh-group22|dh-group23|dh-group24|dh-group25|dh-group26|dh-group27|dh-group28|dh-group29|dh-group30|dh-group31|dh-group32|disable) - - - enable - - - - ESP group proposal - - u32:1-65535 - ESP group proposal number - - - - #include - #include - - - - - - - Internet Key Exchange (IKE) group name - - - - - Action to take if a child SA is unexpectedly closed - - none hold restart - - - none - Do nothing - - - hold - Attempt to re-negotiate when matching traffic is seen - - - restart - Attempt to re-negotiate the connection immediately - - - (none|hold|restart) - - - - - - Dead Peer Detection (DPD) - - - - - Keep-alive failure action - - hold clear restart - - - hold - Attempt to re-negotiate the connection when matching traffic is seen - - - clear - Remove the connection immediately - - - restart - Attempt to re-negotiate the connection immediately - - - (hold|clear|restart) - - - - - - Keep-alive interval - - u32:2-86400 - Keep-alive interval in seconds - - - - - - 30 - - - - Dead Peer Detection keep-alive timeout (IKEv1 only) - - u32:2-86400 - Keep-alive timeout in seconds - - - - - - 120 - - - - - - Re-authentication of the remote peer during an IKE re-key (IKEv2 only) - - yes no - - - yes - Enable remote host re-authentication during an IKE rekey (currently broken due to a strongswan bug) - - - no - Disable remote host re-authenticaton during an IKE rekey - - - (yes|no) - - - - - - IKE version - - ikev1 ikev2 - - - ikev1 - Use IKEv1 for key exchange - - - ikev2 - Use IKEv2 for key exchange - - - (ikev1|ikev2) - - - - - - IKE lifetime - - u32:30-86400 - IKE lifetime in seconds - - - - - - 28800 - - - - Enable MOBIKE Support (IKEv2 only) - - enable disable - - - enable - Enable MOBIKE - - - disable - Disable MOBIKE - - - (enable|disable) - - - enable - - - - IKEv1 phase 1 mode - - main aggressive - - - main - Use the main mode (recommended) - - - aggressive - Use the aggressive mode (insecure, not recommended) - - - (main|aggressive) - - - main - - - - IKE proposal - - u32:1-65535 - IKE group proposal - - - - - - dh-grouphelp - - 1 2 5 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 - - - 1 - Diffie-Hellman group 1 (modp768) - - - 2 - Diffie-Hellman group 2 (modp1024) - - - 5 - Diffie-Hellman group 5 (modp1536) - - - 14 - Diffie-Hellman group 14 (modp2048) - - - 15 - Diffie-Hellman group 15 (modp3072) - - - 16 - Diffie-Hellman group 16 (modp4096) - - - 17 - Diffie-Hellman group 17 (modp6144) - - - 18 - Diffie-Hellman group 18 (modp8192) - - - 19 - Diffie-Hellman group 19 (ecp256) - - - 20 - Diffie-Hellman group 20 (ecp384) - - - 21 - Diffie-Hellman group 21 (ecp521) - - - 22 - Diffie-Hellman group 22 (modp1024s160) - - - 23 - Diffie-Hellman group 23 (modp2048s224) - - - 24 - Diffie-Hellman group 24 (modp2048s256) - - - 25 - Diffie-Hellman group 25 (ecp192) - - - 26 - Diffie-Hellman group 26 (ecp224) - - - 27 - Diffie-Hellman group 27 (ecp224bp) - - - 28 - Diffie-Hellman group 28 (ecp256bp) - - - 29 - Diffie-Hellman group 29 (ecp384bp) - - - 30 - Diffie-Hellman group 30 (ecp512bp) - - - 31 - Diffie-Hellman group 31 (curve25519) - - - 32 - Diffie-Hellman group 32 (curve448) - - - (1|2|5|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32) - - - 2 - - #include - #include - - - - - - - Absolute path to specify a strongSwan config include file - - - - - Absolute path to a strongSwan secrets include file - - - #include - - - IPsec logging - - - - - Global IPsec logging Level - - 0 - Very basic auditing logs (e.g., SA up/SA down) - - - 1 - Generic control flow with errors, a good default to see whats going on - - - 2 - More detailed debugging control flow - - - - - - 0 - - - - Subsystem logging levels - - dmn mgr ike chd job cfg knl net asn enc lib esp tls tnc imc imv pts any - - - dmn - Main daemon setup/cleanup/signal handling - - - mgr - IKE_SA manager, handling synchronization for IKE_SA access - - - ike - IKE_SA/ISAKMP SA - - - chd - CHILD_SA/IPsec SA - - - job - Jobs queuing/processing and thread pool management - - - cfg - Configuration management and plugins - - - knl - IPsec/Networking kernel interface - - - net - IKE network communication - - - asn - Low-level encoding/decoding (ASN.1, X.509 etc.) - - - enc - Packet encoding/decoding encryption/decryption operations - - - lib - libstrongswan library messages - - - esp - libipsec library messages - - - tls - libtls library messages - - - tnc - Trusted Network Connect - - - imc - Integrity Measurement Collector - - - imv - Integrity Measurement Verifier - - - pts - Platform Trust Service - - - any - Any subsystem - - - (dmn|mgr|ike|chd|job|cfg|knl|net|asn|enc|lib|esp|tls|tnc|imc|imv|pts|any) - - - - - - - - - Global IPsec settings - - - - - Do not automatically install routes to remote networks - - - - - - Allow FlexVPN vendor ID payload (IKEv2 only) - - - - #include - - - Allow install virtual-ip addresses - - - - - - - - VPN IPsec profile - - - #include - - - Authentication - - - - - Authentication mode - - pre-shared-secret - - - pre-shared-secret - Use a pre-shared secret key - - - - #include - - - - - DMVPN tunnel configuration - - - - - Tunnel interface associated with this profile - - interfaces tunnel - - - txt - Associated interface to this profile - - - - - - - #include - #include - - - - - IKEv2 remote access VPN - - - - - IKEv2 VPN connection name - - - - - Authentication for remote access - - - #include - #include - - - Client authentication mode - - eap-tls eap-mschapv2 eap-radius - - - eap-tls - Use EAP-TLS authentication - - - eap-mschapv2 - Use EAP-MSCHAPv2 authentication - - - eap-radius - Use EAP-RADIUS authentication - - - (eap-tls|eap-mschapv2|eap-radius) - - - eap-mschapv2 - - #include - - - Server authentication mode - - pre-shared-secret x509 - - - pre-shared-secret - Use a pre-shared secret key - - - x509 - Use x.509 certificate - - - (pre-shared-secret|x509) - - - x509 - - #include - - - #include - #include - #include - #include - #include - #include - - - Timeout to close connection if no data is transmitted - - u32:0 - Disable inactivity checks - - - u32:1-86400 - Timeout in seconds - - - - - - 28800 - - - - IP address pool - - vpn ipsec remote-access pool - dhcp radius - - - txt - Predefined IP pool name - - - dhcp - Forward requests for virtual IP addresses to a DHCP server - - - radius - Forward requests for virtual IP addresses to a RADIUS server - - - - - - - Connection uniqueness enforcement policy - - never keep replace - - - never - Never enforce connection uniqueness - - - keep - Reject new connection attempts if the same user already has an active connection - - - replace - Delete any existing connection if a new one for the same user gets established - - - (never|keep|replace) - - - - - - - - DHCP pool options for remote access - - - #include - - - DHCP server address - - ipv4 - DHCP server IPv4 address - - - - - - - - - - - IP address pool for remote access users - - - - - Local IPv4 or IPv6 pool prefix exclusions - - ipv4net - Local IPv4 pool prefix exclusion - - - ipv6net - Local IPv6 pool prefix exclusion - - - - - - - - - - - Local IPv4 or IPv6 pool prefix - - ipv4net - Local IPv4 pool prefix - - - ipv6net - Local IPv6 pool prefix - - - - - - - - #include - - - #include - - - #include - - - #include - - - - - - - - - Site-to-site VPN - - - - - VPN peer - - ipv4 - IPv4 address of the peer - - - ipv6 - IPv6 address of the peer - - - txt - Hostname of the peer - - - <@text> - ID of the peer - - - - #include - - - Peer authentication - - - #include - #include - #include - - - Authentication mode - - pre-shared-secret rsa x509 - - - pre-shared-secret - Use pre-shared secret key - - - rsa - Use RSA key - - - x509 - Use x.509 certificate - - - (pre-shared-secret|rsa|x509) - - - - #include - - - ID for remote authentication - - txt - ID used for peer authentication - - - - - - Use certificate common name as ID - - - - - - - - Connection type - - initiate respond none - - - initiate - Bring the connection up immediately - - - respond - Wait for the peer to initiate the connection - - - none - Load the connection only - - - (initiate|respond|none) - - - - - - Defult ESP group name - - vpn ipsec esp-group - - - - #include - #include - - - Force UDP Encapsulation for ESP payloads - - enable disable - - - enable - Force UDP encapsulation - - - disable - Do not force UDP encapsulation - - - (enable|disable) - - - - #include - - - Re-authentication of the remote peer during an IKE re-key (IKEv2 only) - - yes no inherit - - - yes - Enable remote host re-autentication during an IKE re-key. Currently broken due to a strong swan bug - - - no - Disable remote host re-authenticaton during an IKE re-key. - - - inherit - Inherit the reauth configuration form your IKE-group - - - (yes|no|inherit) - - - - #include - - - Peer tunnel - - u32 - Peer tunnel - - - - #include - #include - #include - #include - - - Priority for IPsec policy (lowest value more preferable) - - u32:1-100 - Priority for IPsec policy (lowest value more preferable) - - - - - - - - - Match remote addresses - - - #include - - - Remote IPv4 or IPv6 prefix - - ipv4net - Remote IPv4 prefix - - - ipv6net - Remote IPv6 prefix - - - - - - - - - - - - - - - Initiator request virtual-address from peer - - ipv4 - Request IPv4 address from peer - - - ipv6 - Request IPv6 address from peer - - - - - - - Virtual tunnel interface - - - - - VTI tunnel interface associated with this configuration - - interfaces vti - - - - #include - - - - - - - - - - - diff --git a/interface-definitions/vpn_l2tp.xml.in b/interface-definitions/vpn_l2tp.xml.in deleted file mode 100644 index f734283e7..000000000 --- a/interface-definitions/vpn_l2tp.xml.in +++ /dev/null @@ -1,282 +0,0 @@ - - - - - - - L2TP Virtual Private Network (VPN) - 902 - - - - - Remote access L2TP VPN - - - #include - - - External IP address to which VPN clients will connect - - - - - - #include - #include - - - L2TP Network Server (LNS) - - - - - Tunnel password used to authenticate the client (LAC) - - - - - Sent to the client (LAC) in the Host-Name attribute - - [A-Za-z0-9][-.A-Za-z0-9]*[A-Za-z0-9] - - - - - - - - Disable Compression Control Protocol (CCP) - - - - - - Internet Protocol Security (IPsec) for remote access L2TP VPN - - - - - IPsec authentication settings - - - - - Authentication mode for IPsec - - pre-shared-secret - Use pre-shared secret for IPsec authentication - - - x509 - Use X.509 certificate for IPsec authentication - - - (pre-shared-secret|x509) - - - pre-shared-secret x509 - - - - #include - #include - - - - - IKE lifetime - - u32:30-86400 - IKE lifetime in seconds - - - - - - 3600 - - - - ESP lifetime - - u32:30-86400 - IKE lifetime in seconds - - - - - - 3600 - - #include - #include - - - #include - - - Pool of client IP addresses (must be within a /24) - - - #include - #include - - - #include - - - Description for L2TP remote-access settings - - - #include - - - PPP idle timeout - - u32:30-86400 - PPP idle timeout in seconds - - - - - - - - - Authentication for remote access L2TP VPN - - - - - Authentication protocol for remote access peer L2TP VPN - - pap - Require the peer to authenticate itself using PAP [Password Authentication Protocol]. - - - chap - Require the peer to authenticate itself using CHAP [Challenge Handshake Authentication Protocol]. - - - mschap - Require the peer to authenticate itself using CHAP [Challenge Handshake Authentication Protocol]. - - - mschap-v2 - Require the peer to authenticate itself using MS-CHAPv2 [Microsoft Challenge Handshake Authentication Protocol, Version 2]. - - - (pap|chap|mschap|mschap-v2) - - - pap chap mschap mschap-v2 - - - - - #include - #include - #include - #include - - - - - #include - - - Mark server unavailable for N seconds on failure - - u32:0-600 - Fail time penalty - - - - - Fail time must be between 0 and 600 seconds - - - - - - - Timeout to wait response from server (seconds) - - - - - Timeout to wait reply for Interim-Update packets - - - - - Maximum number of tries to send Access-Request/Accounting-Request queries - - - #include - - - IPv4 address and port to bind Dynamic Authorization Extension server (DM/CoA) - - - - - IP address for Dynamic Authorization Extension server (DM/CoA) - - - - - Port for Dynamic Authorization Extension server (DM/CoA) - - - - - Secret for Dynamic Authorization Extension server (DM/CoA) - - - - - - - Upload/Download speed limits - - - - - Specifies which radius attribute contains rate information - - - - - Specifies the vendor dictionary. (dictionary needs to be in /usr/share/accel-ppp/radius) - - - - - Enables Bandwidth shaping via RADIUS - - - - - - - - - - - - Advanced protocol options - - - #include - #include - - - - - - - - - diff --git a/interface-definitions/vpn_openconnect.xml.in b/interface-definitions/vpn_openconnect.xml.in deleted file mode 100644 index 21b47125d..000000000 --- a/interface-definitions/vpn_openconnect.xml.in +++ /dev/null @@ -1,274 +0,0 @@ - - - - - - - SSL VPN OpenConnect, AnyConnect compatible server - 901 - - - - - Authentication for remote access SSL VPN Server - - - - - Authentication mode used by this server - - - - - Use local username/password configuration (OTP supported) - - password - Password-only local authentication - - - otp - OTP-only local authentication - - - password-otp - Password (first) + OTP local authentication - - - (password|otp|password-otp) - - Invalid authentication mode. Must be one of: password, otp or password-otp - - otp password password-otp - - - - - - Use RADIUS server for user autentication - - - - - - #include - - - - - - - 2FA OTP authentication parameters - - - - - Token Key Secret key for the token algorithm (see RFC 4226) - - txt - OTP key in hex-encoded format - - - [a-fA-F0-9]{20,10000} - - Key name must only include hex characters and be at least 20 characters long - - - - - Number of digits in OTP code - - u32:6-8 - Number of digits in OTP code - - - - - Number of digits in OTP code must be between 6 and 8 - - 6 - - - - Time tokens interval in seconds - - u32:5-86400 - Time tokens interval in seconds. - - - - - Time token interval must be between 5 and 86400 seconds - - 30 - - - - Token type - - hotp-time - Time-based OTP algorithm - - - hotp-event - Event-based OTP algorithm - - - (hotp-time|hotp-event) - - - hotp-time hotp-event - - - hotp-time - - - - - - - - #include - - - - - Session timeout - - u32:1-240 - Session timeout in seconds (default: 2) - - - - - Timeout must be between 1 and 240 seconds - - 2 - - - - - - - - Specify custom ports to use for client connections - - - - - tcp port number to accept connections - - u32:1-65535 - Numeric IP port - - - - - - 443 - - - - udp port number to accept connections - - u32:1-65535 - Numeric IP port - - - - - - 443 - - - - - - SSL Certificate, SSL Key and CA - - - #include - #include - - - - - Network settings - - - - - Route to be pushed to the client - - ipv4net - IPv4 network and prefix length - - - ipv6net - IPv6 network and prefix length - - - - - - - - - - Client IP pools settings - - - - - Client IP subnet (CIDR notation) - - ipv4net - IPv4 address and prefix length - - - - - Not a valid CIDR formatted prefix - - - - - - - Pool of client IPv6 addresses - - - - - Pool of addresses used to assign to clients - - ipv6net - IPv6 address and prefix length - - - - - - - - - Prefix length used for individual client - - u32:48-128 - Client prefix length - - - - - - 64 - - - - #include - - - - - - - diff --git a/interface-definitions/vpn_pptp.xml.in b/interface-definitions/vpn_pptp.xml.in deleted file mode 100644 index 28a53acb9..000000000 --- a/interface-definitions/vpn_pptp.xml.in +++ /dev/null @@ -1,121 +0,0 @@ - - - - - - - Point to Point Tunneling Protocol (PPTP) Virtual Private Network (VPN) - 901 - - - - - Remote access PPTP VPN - - - #include - - - External IP address to which VPN clients will connect - - - - - - #include - #include - - - Pool of client IP addresses (must be within a /24) - - - #include - - - #include - - - Authentication for remote access PPTP VPN - - - - - Authentication protocol for remote access peer PPTP VPN - - pap - Require the peer to authenticate itself using PAP [Password Authentication Protocol]. - - - chap - Require the peer to authenticate itself using CHAP [Challenge Handshake Authentication Protocol]. - - - mschap - Require the peer to authenticate itself using CHAP [Challenge Handshake Authentication Protocol]. - - - mschap-v2 - Require the peer to authenticate itself using MS-CHAPv2 [Microsoft Challenge Handshake Authentication Protocol, Version 2]. - - - - - - Specifies mppe negotioation preference. (default require mppe 128-bit stateless - - deny - deny mppe - - - prefer - ask client for mppe, if it rejects do not fail - - - require - ask client for mppe, if it rejects drop connection - - - (deny|prefer|require) - - - deny prefer require - - - - #include - - - Local user authentication for remote access PPTP VPN - - - - - User name for authentication - - - #include - - - Password for authentication - - - - - Static client IP address - - - - - - - #include - #include - - - - - - - - - diff --git a/interface-definitions/vpn_sstp.xml.in b/interface-definitions/vpn_sstp.xml.in deleted file mode 100644 index 195d581df..000000000 --- a/interface-definitions/vpn_sstp.xml.in +++ /dev/null @@ -1,69 +0,0 @@ - - - - - - - Secure Socket Tunneling Protocol (SSTP) server - 901 - - - - - Authentication for remote access SSTP Server - - - #include - #include - #include - #include - #include - - - #include - - - - - #include - #include - #include - - - Client IP pools and gateway setting - - - #include - - - #include - #include - - 443 - - - - PPP (Point-to-Point Protocol) settings - - - #include - #include - #include - #include - #include - - - - - SSL Certificate, SSL Key and CA - - - #include - #include - - - - - - - -- cgit v1.2.3