当前位置:首页 > 技术文章 > 正文内容

xl2tpd.conf

lcy2018-09-06技术文章2167

The configuration file is composed of sections and parameters. Each section has a given name which will be used when using the configuration FIFO (normally /var/run/xl2tpd/l2tp-control). See xl2tpd.8 for more details.

The specific given name default will specify parameters applicable for all the following sections.  

GLOBAL SECTION

  • auth file

  • Specify where to find the authentication file used to authenticate l2tp tunnels. The default is /etc/xl2tpd/l2tp-secrets.


  • ipsec saref

  • Use IPsec Security Association tracking. When this is enabled, packets received by xl2tpd should have to extra fields (refme and refhim) which allows tracking of multiple clients using the same internal NATed IP address, and allows tracking of multiple clients behind the same NAT router. This needs to be supported by the kernel. Currently, this only works with Openswan KLIPS in "mast" mode. (see http://www.openswan.org/)

    Set this to yes and the system will provide proper SAref values in the recvmsg() calls.

    Values can be yes or no. The default is no.


  • saref refinfo

  • When using IPsec Security Association trackinng, a new setsockopt is used. Since this is not (yet?) an official Linux kernel option, we got bumped. Openswan upto 2.6.35 for linux kernels up to 2.6.35 used a saref num of 22. Linux 3.6.36+ uses 22 for IP_NODEFRAG. We moved our IP_IPSEC_REFINFO to 30. If not set, the default is to use 30. For older SAref patched kernels, use 22.


  • listen-addr

  • The IP address of the interface on which the daemon listens. By default, it listens on INADDR_ANY (0.0.0.0), meaning it listens on all interfaces.


  • port

  • Specify which UDP port xl2tpd should use. The default is 1701.


  • access control

  • If set to yes, the xl2tpd process will only accept connections from peers addresses specified in the following sections. The default is no.


  • debug avp

  • Set this to yes to enable syslog output of L2TP AVP debugging information.


  • debug network

  • Set this to yes to enable syslog output of network debugging information.


  • debug packet

  • Set this to yes to enable printing of L2TP packet debugging information. Note: Output goes to STDOUT, so use this only in conjunction with the -Dcommand line option.


  • debug state

  • Set this to yes to enable syslog output of FSM debugging information.


  • debug tunnel

  • Set this to yes to enable syslog output of tunnel debugging information.


 

LNS SECTION

  • exclusive

  • If set to yes, only one control tunnel will be allowed to be built between 2 peers. CHECK


  • (no) ip range

  • Specify the range of ip addresses the LNS will assign to the connecting LAC PPP tunnels. Multiple ranges can be defined. Using the 'no' statement disallows the use of that particular range. Ranges are defined using the format IP - IP (example: 1.1.1.1 - 1.1.1.10). Note that either at least oneip range option must be given, or you must set assign ip to no.


  • assign ip

  • Set this to no if xl2tpd should not assign IP addresses out of the pool defined with the ip range option. This can be useful if you have some other means to assign IP addresses, e. g. a pppd that supports RADIUS AAA.



  • (no) lac

  • Specify the ip addresses of LAC's which are allowed to connect to xl2tpd acting as a LNS. The format is the same as the ip range option.


  • hidden bit

  • If set to yes, xl2tpd will use the AVP hiding feature of L2TP. To get more information about hidden AVP's and AVP in general, refer to rfc2661 (add URL?)


  • local ip

  • Use the following IP as xl2tpd's own ip address.


  • local ip range

  • Specify the range of addresses the LNS will assign as the local address to connecting LAC PPP tunnels. This option is mutually exclusive with thelocal ip option and is useful in cases where it is desirable to have a unique IP address for each tunnel. Specify the range value exactly like theip range option. Note that the assign ip option has no effect on this option.


  • length bit

  • If set to yes, the length bit present in the l2tp packet payload will be used.


  • (refuse | require) chap

  • Will require or refuse the remote peer to get authenticated via CHAP for the ppp authentication.


  • (refuse | require) pap

  • Will require or refuse the remote peer to get authenticated via PAP for the ppp authentication.


  • (refuse | require) authentication

  • Will require or refuse the remote peer to authenticate itself.


  • unix authentication

  • If set to yes, /etc/passwd will be used for remote peer ppp authentication.


  • hostname

  • Will report this as the xl2tpd hostname in negotiation.


  • ppp debug

  • This will enable the debug for pppd.


  • pass peer

  • Pass the peer's IP address to pppd as ipparam. Enabled by default.


  • pppoptfile

  • Specify the path for a file which contains pppd configuration parameters to be used.


  • call rws

  • This option is deprecated and no longer functions. It used to be used to define the flow control window size for individual L2TP calls or sessions. The L2TP standard (RFC2661) no longer defines flow control or window sizes on calls or sessions.


  • tunnel rws

  • This defines the window size of the control channel. The window size is defined as the number of outstanding unacknowledged packets, not as a number of bytes.


  • flow bits

  • If set to yes, sequence numbers will be included in the communication. The feature to use sequence numbers in sessions is currently broken and does not function.


  • challenge

  • If set to yes, use challenge authentication to authenticate peer.


  • rx bps

  • If set, the receive bandwidth maximum will be set to this value


  • tx bps

  • If set, the transmit bandwidth maximum will be set to this value


 

LAC SECTION

The following are LAC specific configuration flags. Most of those described in the LNS section may be used in a LAC context, where it makes common sense (essentially l2tp protocols tuning flags and authentication / ppp related ones).


  • lns

  • Set the dns name or ip address of the LNS to connect to.


  • autodial

  • If set to yes, xl2tpd will automatically dial the LAC during startup.


  • redial

  • If set to yes, xl2tpd will attempt to redial if the call get disconnected. Note that, if enabled, xl2tpd will keep passwords in memory: a potential security risk.


  • redial timeout

  • Wait X seconds before redial. The redial option must be set to yes to use this option. Defaults to 30 seconds.


  • max redials

  • Will give up redial tries after X attempts.


 

FILES

/etc/xl2tpd/xl2tpd.conf /etc/xl2tpd/l2tp-secrets /var/run/xl2tpd/l2tp-control 

BUGS

Please address bugs and comment to xl2tpdv [at] lists.xelerance.com  

SEE ALSO

xl2tpd(8)  

AUTHORS

Forked from xl2tpd by Xelerance (https://www.xelerance.com/software/xl2tpd/)

Michael Richardson <mcr [at] xelerance.com> Paul Wouters <paul [at] xelerance.com>

Many thanks to Jacco de Leeuw <jacco2 [at] dds.nl> for maintaining l2tpd.


Previous development was hosted at sourceforge (http://www.sourceforge.net/projects/l2tpd) by:

Scott Balmos <sbalmos [at] iglou.com> 
David Stipp <dstipp [at] one.net> 
Jeff McAdams <jeffm [at] iglou.com>


Based off of l2tpd version 0.60 
Copyright (C)1998 Adtran, Inc. 
Mark Spencer <markster [at] marko.net>


 

版权声明:本文由cy's Blog发布,如需转载请注明出处。

本文链接:https://www.c3389.com/post/425.html

相关文章

Lcx进行内网端口转发教材

Lcx进行内网端口转发教材

通过本案例可以学习到:   (1)了解端口转发方面的相关知识  (2)使用工具软件lcx来进行端口转发  Lcx.exe是一个端口转发工具,相当于把肉鸡A上的3389端口转发到具有外网IP地址的B机上...

【华众】hzhost华众,51197 错误提示:系统用户创建失败

新开站点,转移站点,恢复站点时出现这样的错误TYPE=RSTresult=51197 错误提示:系统用户创建失败[servercomment=c3389][site_addsiteall]!(5120...

2021HVV之蓝队日志分析技巧

1、识别攻击源IP在攻防演练前期,最重要的是识别出攻击方的IP并进行及时处理。攻击方源IP打出的日志通常具有以下类别及特点:扫描探测类演练期间,很多局点扫描探测类日志占所有攻击日志(IPS)的90%以...

用PHPnow+IIS 配置IIS+php+mysql环境

用PHPnow+IIS 配置IIS+php+mysql环境

安装好IIS,下载 PHPnow 1.4.5 ,解压至D盘根目录 D:\PHPnow ,加上 Users 全部权限.执行 D:\PHPnow\Init.cmd ,80 端口被 IIS 占用,输入 1...

npm 自用的一些命令搜集

npm config set registry https://registry.npm.taobao.org   更换淘宝源(mac下需要sudo模式)npm conf...

对Fckeditor的一些漏洞总结

Fckeditor版本多..支持很多语言..所以本文不针对任何版本或者什么语言.只讲利用方法fckeditor/editor/filemanager/browser/default/browser.h...

发表评论

访客

◎欢迎参与讨论,请在这里发表您的看法和观点。