FASTD(1)

📦
version 23 · 2 versions
, in arch rolling, debian trixie, epel 9, fedora 43, fedora 44, ubuntu questing, ubuntu resolute, ubuntu stonking

🦋 FASTD(1) — the manual page, bestie edition 💅

okay so this is the manual for fastd, a User Command, and I'm gonna walk you through it like we're texting at 2am. it's literally the whole page, nothing skipped, no cap. 🎀

✨ NAME ✨

fastd — Fast and Secure Tunnelling Daemon 🌈

🌸 SYNOPSIS 🌸

fastd OPTION...

that's it. that's the whole vibe. you give it options, it does the thing. 💖

🫶 DESCRIPTION 🫶

so fastd is a very small VPN daemon — and when I say small I mean it's giving tiny-but-untouchable energy 👑 — and what it does is tunnel IP packets and Ethernet frames over UDP. yes, UDP. she's fast like that.

she supports various modern encryption and authentication schemes, and she can be used in many different network topologies: 1:1, 1:n, and meshed. so like, whatever your little network situationship is, she's flexible. 🧚

⭐ OPTIONS ⭐

one bullet per option, all of them, in order, periodt. 💅

  • --help, -h — shows a help text. your first stop when you're lost, bestie. 🥺
  • --version, -v — shows the fastd version. flex the build.
  • --daemon, -d — runs fastd in the background. she's not gonna block your terminal, she's got her own life now. ✨
  • --pid-file <filename> — writes fastd's PID to the specified file. so you can find her later. 💖
  • --status-socket <socket> — configure a socket to get fastd's status. peek behind the curtain, iykyk. 👀
  • --config, -c <filename> — loads a config file. - can be specified to read a config file from stdin. more than one config file can be loaded. stack 'em, bestie. 🎀
  • --config-peer <filename> — loads a config file for a single peer. the filename will be used as the peer name. iconic behaviour honestly.
  • --config-peer-dir <dir> — loads all files from a directory as peer configs. on SIGHUP fastd will reload peer directories. so she does check her notifications. 🔔
  • --user <user> — sets the user to run fastd as. main character, but make it a user account.
  • --group <group> — sets the group to run fastd as. the friend group. 🫶
  • --log-level error|warn|info|verbose|debug|debug2 — sets the stderr log level; default is info if no alternative log destination is configured. how much tea do you want her to spill?
  • --syslog-level error|warn|info|verbose|debug|debug2 — sets the log level for syslog output; default is not to use syslog. she's quiet by default, respectfully. 🙈
  • --syslog-ident <ident> — sets the syslog identification; default is fastd. she knows her name. 💅
  • --hide-ip-addresses — hides IP addresses in log output. privacy queen. 👑
  • --hide-mac-addresses — hides MAC addresses in log output. same energy, different address. ✨
  • --mode, -m tap|multitap|tun — sets the mode of the interface; default is TAP mode. pick your fighter. 🔥
  • --interface, -i <name> — sets the name of the TUN/TAP interface to use. if not specified, default names specified by the system will be used. let the system name her, she's mysterious like that. 🦋
  • --mtu, -M <mtu> — sets the MTU; must be at least 576. do NOT go below 576, that's the floor, no negotiating. 🚫
  • --bind, -b <address>[:<port>] — sets the bind address. address can be an IPv4 address or an IPv6 address, or the keyword any. IPv6 addresses must be put in square brackets. by default fastd will to bind to a random port for both IPv4 and IPv6. it is currently not possible to specify an IPv6 link-local address on the command line. (yes, that last sentence is a real limitation, lowkey annoying, but fr fr that's what it says. 😭)
  • --protocol, -p <protocol> — sets the handshake protocol. currently the only protocol available is ec25519-fhmqvc, which provides a secure authentication of peers based on public/secret keys. only one option but she ate. 🔐
  • --method <method> — sets the encryption method. 🔒
  • --forward — enables forwarding of packets between peers; read the full documentation before use! this is the loud part, bestie, go read the docs first. 📢
  • --on-pre-up <command> — sets a shell command to execute before interface creation. ✨
  • --on-up <command> — sets a shell command to execute after interface creation. 🎀
  • --on-down <command> — sets a shell command to execute before interface destruction. 💜
  • --on-post-down <command> — sets a shell command to execute after interface destruction. 🦋
  • --on-connect <command> — sets a shell command to execute when a handshake is sent to establish a new connection. 🤝
  • --on-establish <command> — sets a shell command to execute when a new connection is established. 🎉
  • --on-disestablish <command> — sets a shell command to execute when a connection is lost. 💔
  • --on-verify <command> — sets a shell command to execute to check a connection attempt by an unknown peer. stranger danger check. 🕵️
  • --verify-config — checks the configuration and exits. vibe check, then leave. ✅
  • --generate-key — generates a new keypair. new keys, new me. 🔑
  • --show-key — shows the public key corresponding to the configured secret. show off, but responsibly. 👀
  • --machine-readable — suppresses output of explaining text in the --show-key and --generate-key commands. for when you want just the data, no commentary. 🤖

💖 SEE ALSO 💖

the full documentation for fastd is available online at https://gluon.readthedocs.io/. 📚

additional resources can be found in the Wiki at https://github.com/NeoRaider/fastd/wiki. 🌐

and that's the whole page, bestie. every flag, every default, every warning — nothing left out, because we don't gatekeep around here. 💅✨

okay love u, bye — this was fastd v23, from January 2025, and you just read the FASTD(1) page. slay, go tunnel something. 🎀💜

📦 where this page comes from