1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
|
---
lastproofread: '2026-03-16'
---
(sstp-client-interface)=
# SSTP client
{abbr}`SSTP (Secure Socket Tunneling Protocol)` transports PPP traffic over an
SSL/TLS channel, providing transport-level security through key negotiation,
encryption, and traffic integrity checking. The use of SSL/TLS over TCP port
443 (by default, the port can be changed) allows SSTP to pass through virtually
all firewalls and proxy servers, except for authenticated web proxies.
:::{note}
VyOS includes a built-in SSTP server. For more information, see
{ref}`sstp`.
:::
## Configuration
### Common interface configuration
```{cmdincludemd} /_include/interface-description.txt
:var0: sstpc
:var1: sstpc0
```
```{cmdincludemd} /_include/interface-disable.txt
:var0: sstpc
:var1: sstpc0
```
```{cmdincludemd} /_include/interface-mtu.txt
:var0: sstpc
:var1: sstpc0
```
```{cmdincludemd} /_include/interface-vrf.txt
:var0: sstpc
:var1: sstpc0
```
### SSTP client options
```{cfgcmd} set interfaces sstpc \<interface\> no-default-route
Request an IP address from the SSTP server without installing a default route.
Example:
:::{code-block} none
set interfaces sstpc sstpc0 no-default-route
:::
:::{note} Introduced in VyOS 1.4, this command inverts the logic of the former
``default-route`` CLI option.
:::
```
```{cfgcmd} set interfaces sstpc \<interface\> default-route-distance \<distance\>
Configure the distance for the default gateway provided by the SSTP server.
Example:
:::{code-block} none
set interfaces sstpc sstpc0 default-route-distance 220
:::
```
```{cfgcmd} set interfaces sstpc \<interface\> no-peer-dns
Disable the installation of advertised DNS nameservers on the local system.
```
```{cfgcmd} set interfaces sstpc \<interface\> server \<address\>
**Configure the remote SSTP server address for the client connection.**
The address can be either an IP address or a {abbr}`FQDN (Fully Qualified
Domain Name)`.
```
```{cfgcmd} set interfaces sstpc \<interface\> ip adjust-mss \<mss | clamp-mss-to-pmtu\>
**Configure the** {abbr}`MSS (Maximum Segment Size)` **advertised in outgoing
TCP SYN packets on the specified interface.**
By clamping the MSS value in TCP SYN packets, you instruct the remote side not
to send packets larger than the specified size. This helps prevent connection
issues if {abbr}`PMTUD (Path MTU Discovery)` fails.
The following options are available:
* ``mss``: Sets the MSS to a specific value in bytes.
* ``clamp-mss-to-pmtu``: Sets the MSS to the interface’s MTU minus 40 bytes for
IPv4 traffic (20 bytes for the IPv4 header and 20 bytes for the TCP header).
This option is recommended to automatically set the proper value.
:::{note} Introduced in VyOS 1.4, this command replaces the older ``set firewall
options interface <name> adjust-mss <value>`` syntax.
:::
```
```{cfgcmd} set interfaces sstpc \<interface\> ip disable-forwarding
**Configure the interface for host or router behavior.**
If configured, the interface switches to host mode, and IPv4 forwarding is
disabled on it.
```
```{cfgcmd} set interfaces sstpc \<interface\> ip source-validation \<strict | loose | disable\>
**Configure source IP address validation using**
{abbr}`RPF (Reverse Path Forwarding)` **on this interface, as specified in**
{rfc}`3704`.
The following options are available:
* ``strict``: Each incoming packet’s source IP address is checked against the
{abbr}`FIB (Forwarding Information Base)`. If the interface is not the best
route back to that source, validation fails, and the packet is dropped.
* ``loose``: Each incoming packet’s source IP address is checked against the
{abbr}`FIB (Forwarding Information Base)`. If the source IP address is
unreachable through any interface, validation fails.
* ``disable``: No source IP address validation is performed. All incoming
packets are accepted.
{rfc}`3704` recommends enabling ``strict`` mode to prevent IP spoofing, such as
DDoS attacks. For asymmetric or other complex routing scenarios, use ``loose``
mode.
```
## Operation
```{opcmd} show interfaces sstpc \<interface\>
Show detailed information about the specified interface.
:::{code-block} none
vyos@vyos:~$ show interfaces sstpc sstpc10
sstpc10: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 3
link/ppp
inet 192.0.2.5 peer 192.0.2.254/32 scope global sstpc10
valid_lft forever preferred_lft forever
inet6 fe80::fd53:c7ff:fe8b:144f/64 scope link
valid_lft forever preferred_lft forever
RX: bytes packets errors dropped overrun mcast
215 9 0 0 0 0
TX: bytes packets errors dropped carrier collisions
539 14 0 0 0 0
:::
```
### Connect/disconnect
```{opcmd} disconnect interface \<interface\>
Disconnect the specified interface.
```
```{opcmd} connect interface \<interface\>
Initiate a session on the specified interface.
```
|
