diff options
Diffstat (limited to 'conf')
| -rw-r--r-- | conf/plugins/dhcp.conf | 3 | ||||
| -rw-r--r-- | conf/plugins/dhcp.opt | 3 | ||||
| -rw-r--r-- | conf/plugins/kernel-pfkey.conf | 3 | ||||
| -rw-r--r-- | conf/plugins/kernel-pfkey.opt | 10 | ||||
| -rw-r--r-- | conf/strongswan.conf.5.main | 12 | ||||
| -rw-r--r-- | conf/strongswan.conf.5.tail.in | 2 |
6 files changed, 29 insertions, 4 deletions
diff --git a/conf/plugins/dhcp.conf b/conf/plugins/dhcp.conf index b0e8c84c8..88bbe36e3 100644 --- a/conf/plugins/dhcp.conf +++ b/conf/plugins/dhcp.conf @@ -3,7 +3,8 @@ dhcp { # Always use the configured server address. # force_server_address = no - # Derive user-defined MAC address from hash of IKE identity. + # Derive user-defined MAC address from hash of IKE identity and send client + # identity DHCP option. # identity_lease = no # Interface name the plugin uses for address allocation. diff --git a/conf/plugins/dhcp.opt b/conf/plugins/dhcp.opt index 9c7b86091..6b337bc34 100644 --- a/conf/plugins/dhcp.opt +++ b/conf/plugins/dhcp.opt @@ -9,7 +9,8 @@ charon.plugins.dhcp.force_server_address = no 192.168.0.255) as server address might work. charon.plugins.dhcp.identity_lease = no - Derive user-defined MAC address from hash of IKE identity. + Derive user-defined MAC address from hash of IKE identity and send client + identity DHCP option. charon.plugins.dhcp.server = 255.255.255.255 DHCP server unicast or broadcast IP address. diff --git a/conf/plugins/kernel-pfkey.conf b/conf/plugins/kernel-pfkey.conf index 2d4733e74..f4340e7fe 100644 --- a/conf/plugins/kernel-pfkey.conf +++ b/conf/plugins/kernel-pfkey.conf @@ -7,5 +7,8 @@ kernel-pfkey { # priority of this plugin. load = yes + # Whether to use the internal or external interface in installed routes. + # route_via_internal = no + } diff --git a/conf/plugins/kernel-pfkey.opt b/conf/plugins/kernel-pfkey.opt index ec05215d3..0e347bebb 100644 --- a/conf/plugins/kernel-pfkey.opt +++ b/conf/plugins/kernel-pfkey.opt @@ -5,3 +5,13 @@ charon.plugins.kernel-pfkey.events_buffer_size = 0 Because events are received asynchronously installing e.g. lots of policies may require a larger buffer than the default on certain platforms in order to receive all messages. + +charon.plugins.kernel-pfkey.route_via_internal = no + Whether to use the internal or external interface in installed routes. + + Whether to use the internal or external interface in installed routes. + The internal interface is the one where the IP address contained in the + local traffic selector is located, the external interface is the one over + which the destination address of the IPsec tunnel can be reached. + This is not relevant if virtual IPs are used, for which a TUN device is + created that's used in the routes. diff --git a/conf/strongswan.conf.5.main b/conf/strongswan.conf.5.main index 977403e91..f83211805 100644 --- a/conf/strongswan.conf.5.main +++ b/conf/strongswan.conf.5.main @@ -542,7 +542,8 @@ this option to yes and configuring the local broadcast address (e.g. .TP .BR charon.plugins.dhcp.identity_lease " [no]" -Derive user\-defined MAC address from hash of IKE identity. +Derive user\-defined MAC address from hash of IKE identity and send client +identity DHCP option. .TP .BR charon.plugins.dhcp.interface " []" @@ -1107,6 +1108,15 @@ a larger buffer than the default on certain platforms in order to receive all messages. .TP +.BR charon.plugins.kernel-pfkey.route_via_internal " [no]" +Whether to use the internal or external interface in installed routes. The +internal interface is the one where the IP address contained in the local +traffic selector is located, the external interface is the one over which the +destination address of the IPsec tunnel can be reached. This is not relevant if +virtual IPs are used, for which a TUN device is created that's used in the +routes. + +.TP .BR charon.plugins.kernel-pfroute.vip_wait " [1000]" Time in ms to wait until virtual IP addresses appear/disappear before failing. diff --git a/conf/strongswan.conf.5.tail.in b/conf/strongswan.conf.5.tail.in index f428fc323..a93fe020a 100644 --- a/conf/strongswan.conf.5.tail.in +++ b/conf/strongswan.conf.5.tail.in @@ -93,7 +93,7 @@ Absolutely silent Very basic auditing logs, (e.g. SA up/SA down) .TP .B 1 -Generic control flow with errors, a good default to see whats going on +Generic control flow with errors, a good default to see what's going on .TP .B 2 More detailed debugging control flow |