sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-03 00:00:24 -04:00
Code Issues Projects Releases Wiki Activity

conf: Document some global options for charon-nm

Browse Source 
These have specific values for charon-nm's use case but might have to be
changed for special setups or because of conflicts.

References strongswan/strongswan#2683
This commit is contained in:
Tobias Brunner 2025-02-26 15:06:29 +01:00
parent 7205d02360
commit af0535894c
1 changed files with 38 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
conf/options/charon-nm.opt
View File

@ -1,6 +1,44 @@
charon-nm {}
Section with settings specific to the NetworkManager backend `charon-nm`.
Settings from the `charon` section are not inherited, but many can be used
here as well. Defaults for some settings are chosen very deliberately and
should only be changed in case of conflicts.
charon-nm.ca_dir = <default>
Directory from which to load CA certificates if no certificate is
configured.
charon-nm.install_virtual_ip_on = lo
Interface on which virtual IP addresses are installed. Note that NM
also installs the virtual IPs on the XFRM interface.
charon-nm.mtu = 1400
MTU for XFRM interfaces created by the NM plugin.
charon-nm.port = 0
Source port when sending packets to port 500. Defaults to an ephemeral
port. May be set to 500 if firewall rules require a static port.
charon-nm.port_nat_t = 0
Source port when sending packets to port 4500 or a custom server port.
Defaults to an ephemeral port. May be set to e.g. 4500 if firewall rules
require a static port.
charon-nm.routing_table = 210
Table where routes via XFRM interface are installed. Should be different
than the table used for the regular IKE daemon due to the mark.
charon-nm.routing_table_prio = 210
Priority of the routing table. Higher than the default priority used for the
regular IKE daemon.
charon-nm.plugins.kernel-netlink.fwmark = !210
Make packets with this mark ignore the routing table. Must be the same mark
set in charon-nm.plugins.socket-default.fwmark.
charon-nm.plugins.socket-default.fwmark = 210
Mark applied to IKE and ESP packets to ignore the routing table and avoid
routing loops when using XFRM interfaces.
charon-nm.syslog.daemon.default = 1
Default to logging via syslog's daemon facility on level 1.