ACCEL-PPP.CONF(5)

📦
version 1.14.0 · 2 versions
, in alpine 3.24, epel 10, epel 9, fedora 43, fedora 44

💖 ACCEL-PPP.CONF — the accel-ppp.conf(5) page, but make it make sense ✨

okay bestie, sit down, grab a strawberry 🍓, because this is the file that runs the whole VPN daemon situation, and we're gonna read it together. it's giving "manual page" but it's giving "group chat study session" too. let's go 💅

🌸 NAME 🌸

accel-ppp.conf — the config file for the ACCEL-PPP VPN daemon. yes, that's the whole name section, short and iconic 👑

🦋 DESCRIPTION 🦋

so accel-pppd(8) reads its options from this file, and usually that file lives at /etc/accel-ppp.conf. that's the one, that's the main character ✨

the config file is built out of sections, and they look exactly like this:

[section1]
       name1=val1
       name2=val2
       name3

[section2]
        ....

so you got your section name in brackets, then a lil pile of name=val lines under it, and sometimes just a bare name with no value at all (a flag, a vibe, no explanation needed). lowkey the whole file is just that pattern repeated until it becomes a whole daemon 💀

🌈 SECTIONS 🌈

🎀 [modules] 🎀

this section is just... the list of modules to load. pick your fighters, assemble your team 🫶

  • log_file — a logging target that logs messages to files. it supports per-session/per-user features, so it's fancy like that 💖
  • log_syslog — a logging target that logs messages to syslog.
  • log_tcp — a logging target that logs messages over TCP/IP.
  • log_pgsql — a logging target that logs messages to PostgreSQL.
  • pptp — the PPTP controlling connection handling module.
  • pppoe — the PPPoE discovery stage handling module.
  • sstp — the SSTP controlling connection handling module.
  • auth_pap — the PAP authentication module.
  • auth_chap_md5 — the CHAP (md5) authentication module.
  • auth_mschap_v1 — the Microsoft CHAP (version 1) authentication module.
  • auth_mschap_v2 — the Microsoft CHAP (version 2) authentication module.
  • radius — the RADIUS interaction module.
  • ippool — the IPv4 address assigning module.
  • ipv6pool — the IPv6 address assigning module.
  • ipv6_dhcp — the IPv6 DHCP module.
  • sigchld — a helper module to manage child processes, and it's required by pppd_compat. no sigchld, no compat, that's the rule 🔥
  • pppd_compat — this module starts pppd compatible ip-up/ip-down scripts and ip-change to handle RADIUS CoA request.
  • connlimit — this module limits connection rate from a single source. one-at-a-time energy, respectfully 🙈

💜 [core] 💜

configuration of the core module. the main character of main characters.

  • log-error=path — path to file for core module error logging.
  • thread-count=n — number of working threads. the optimal value is the number of processors/cores, so match your hardware, don't fight it ✨

🧚 [common] 🧚

common params for all connection types. everyone shares these, no exceptions 💅

  • single-session=replace|deny — specifies whether accel-ppp should control the sessions count. if this option is absent, session count control is turned off entirely. if it's replace then accel-ppp will terminate the first session when a second one is authorized. if it's deny then accel-ppp will deny the second session authorization. choose your chaos 😭
  • single-session-ignore-case=0|1 — specifies whether accel-ppp should ignore the case when comparing username within single-session validation (default 0).
  • sid-case=upper|lower — specifies in which case to generate the session identifier (default lower).
  • sid-source=urandom|seq — specifies the method used to assign session id (default urandom).
    • urandom — assign session id by random method
    • seq — assign session id by sequence method
  • seq-file=path — path to file for sessions sequence number. the start sequence number may be set there (default /var/lib/accel-ppp/seq).
  • max-sessions=n — specifies maximum concurrent sessions which server may processed (default 0, disabled).
  • max-starting=n — specifies maximum concurrent session attempts which server may processed (default 0, disabled).
  • check-ip=0|1 — specifies whether accel-ppp should check if IP already assigned to other client interface (default 0). this check is global (not VRF-aware); with check-ip=1 the same IPv4/IPv6 address will be rejected even if sessions are in different VRFs/netns. with check-ip=0 overlapping addresses can be assigned (useful for isolated VRFs, but take care with overlapping pools 🚨). this setting can be overridden by module-specific check-ip options (e.g., in the [ppp] section).
  • nl-snd-buffer=n — specifies netlink maximum send buffer size (the SO_SNDBUF option) (default 32768).
  • nl-rcv-buffer=n — specifies netlink maximum receive buffer size (the SO_RCVBUF option) (default 1048576).
  • session-timeout=n — specifies max sessions time in seconds, and after this time the session will be terminated. this timeout can be redefined with the radius attribute Session-Timeout. a 0 value means infinite timeout, aka "we live here now" 🫶

🌸 [ppp] 🌸

PPP module configuration. this is the big one, stay with me bestie 💖

  • verbose=n — if n is not zero, the ppp module will produce verbose logging. chatty king 👑
  • min-mtu=n — minimum acceptable MTU. if the client tries to negotiate less than the specified MTU then it will be NAKed, or disconnected if it rejects the greater MTU.
  • mtu=n — MTU which will be negotiated if the client's MRU will not be acceptable.
  • mru=n — preferred MRU.
  • accomp=allow|deny|n — Address/Control compression negotiation.
    • allow — prefer in send and don't deny in receive directions
    • deny — disable in both directions, this is the default behavior
  • pcomp=allow|deny|n — Protocol field compression negotiation.
    • allow — prefer in send and don't deny in receive directions
    • deny — disable in both directions, this is the default behavior
  • ccp=n — disable CCP negotiation if this parameter is zero.
  • ccp-max-configure=n — specifies the maximum number of CCP Configure-Request packets sent without receiving a valid Configure-Ack, Configure-Nak or Configure-Reject before assuming the peer is unable to respond (default 10).
  • mppe=require|prefer|deny — specifies mppe negotiation preference.
    • require — ask client for mppe, and if it rejects, drop the connection
    • prefer — ask client for mppe, and if it rejects, don't fail.
    • deny — deny mppe.
    • the default behavior is to not ask the client for mppe, but allow it if the client wants it. and heads up 💅: RADIUS may override this option via the MS-MPPE-Encryption-Policy attribute.
  • max-configure=n — specifies the maximum number of LCP/IPCP Configure-Request packets sent without receiving a valid Configure-Ack, Configure-Nak or Configure-Reject before assuming the peer is unable to respond (default 10).
  • max-failure=n — specifies the maximum number of LCP/IPCP Configure-Nak returned before starting to send Configure-Reject (default 10).
  • max-terminate=n — specifies the maximum number of Terminate-Request packets sent without receiving a Terminate-Ack before assuming the peer has disconnected (default 2).
  • max-mtu=n — specifies the absolute maximum MTU value that can be negotiated.
  • check-ip=0|1 — specifies whether to check if the assigned IP address is already in use by another session (this overrides the [common] check-ip for PPP sessions).
  • ipv4=deny|allow|prefer|require — specify the IPv4 (IPCP) negotiation algorithm:
    • deny — don't negotiate IPv4.
    • allow — negotiate IPv4 only if the client requests it.
    • prefer — ask the client for IPv4 negotiation, don't fail if he rejects.
    • require — require IPv4 negotiation.
  • ipv6=deny|allow|prefer|require — parameters are same as above. copy-paste energy, but for v6 🦋
  • ipv6-intf-id=x:x:x:x|random — specify fixed or random interface identifier for IPv6.
  • ipv6-peer-intf-id=x:x:x:x|random|ipv4|calling-sid — specify peer interface identifier for IPv6.
    • ipv4 — calculate interface identifier from IPv4 address, for example 192:168:0:1.
    • calling-sid — calculate interface identifier from Calling-Station-Id.
  • ipv6-accept-peer-intf-id=0|1 — specify whether to accept the peer's interface identifier.
  • lcp-echo-interval=n — if this option is given and greater than 0 then the lcp module will send echo-request every n seconds.
  • lcp-echo-failure=n — specifies the maximum number of echo-requests that may be sent without a valid echo-reply, and if it exceeds, the connection will be terminated 💀
  • lcp-echo-timeout=sec — specifies timeout in seconds to wait for any peer activity. if this option is specified it turns on adaptive lcp echo functionality and lcp-echo-failure is not used.
  • unit-cache=n — specifies number of interfaces to keep in cache. it means don't destroy the interface after the corresponding session is destroyed — instead place it in cache and use it later for new sessions repeatedly. this should reduce kernel-level interface creation/deletion rate lack ✨
  • unit-preallocate=0|1 — if set to 1 then allocate the ppp unit (interface) before authorization, so Nas-Port and Nas-Port-Id would be defined in the Access-Request phase. pre-planning, we love to see it 🫶

💅 [auth] 💅

contains authentication params. get in, get verified, get out.

  • timeout=n — if n is not zero, specifies timeout in seconds to wait for PAP, CHAP, Microsoft CHAP v1/v2 authentication.
  • interval=n — if n is not zero, specifies timeout in seconds to restart CHAP and Microsoft CHAP v1/v2 authentication.
  • max-failure=n — if n is not zero, specifies maximum number of CHAP and Microsoft CHAP v1/v2 authentication failures.
  • any-login=0|1 — if set to 1 it allows passing PAP, CHAP and Microsoft CHAP v1 authentication with any login. yes, any. wild, but that's what it says 😭
  • noauth=0|1 — if set to 1 it skips any PPP and IPOE authentication. straight in, no questions asked 🙈
  • challenge-name=name — specifies challenge name for CHAP authentication.
okay that's part 1 bestie, don't go anywhere, there's more coming 💖

🦋 [ipoe] 🦋

bestie this whole section is the DHCP/IPoE girlies, she does a LOT, ok? let's go option by option, no skips 💅

  • verbose=n — if n isn't zero, the ipoe module will be out here producing verbose logging. chatty queen ✨
  • username=ifname|lua:function — tells accel-ppp how to figure out the username of a user. If username= ifname, then the interface name the packet arrived from gets used as the username. If username= lua:username, then a lua function named username gets called to build the username out of the dhcp packet fields. 🎀
  • password=username|csid|empty|<string> — how to generate the password, pick your fighter:
    • password= username → password is literally the same as the username
    • password= empty → password is an empty string (yes, really)
    • password= csid → password is the same as Calling-Station-Id
    • or you just hardcode a fixed password in <string> 💖
  • session-timeout=n — max session time in seconds. After this time the session gets terminated, periodt. Can be redefined with the radius attribute Session-Timeout.
  • idle-timeout=n — timeout in seconds to wait for ANY packet from the client. After this time the session is terminated if the client don't send anything. Often used with mode=L3. 💀
  • lease-time=n — lease time in seconds to be sent to the dhcp client.
  • renew-time=n — lease renew time (option 58) in seconds to send to the dhcp client.
  • rebind-time=n — lease rebind time (option 59) in seconds to send to the dhcp client.
  • max-lease-time=n — max lease time in seconds. After this time the session gets terminated if the client won't renew it. no renewals, no vibes 😭
  • unit-cache=n — number of interfaces to keep in cache. Meaning: don't destroy the interface after its session is destroyed, instead pop it into cache and reuse it later for new sessions over and over. This should reduce the kernel-level interface creation/deletion rate lack. 🧚
  • l4-redirect-table=n — specifies a table number. If the L4-Redirect radius attribute is received and its value isn't 0 or '0', accel-ppp adds this rule: ip rule add from client_ip table n
  • l4-redirect-ipset=name — name of the ipset list. If the L4-Redirect radius attribute is received and its value isn't 0 or '0', accel-ppp adds the client's ip to that ipset name.
  • l4-redirect-on-reject=n — if specified, then when radius rejects access, an ip rule add from ip_addr table l4-redirect-table rule gets created for n seconds. 🙈
  • l4-redirect-ip-pool=name — if specified, then when radius rejects access and the session is DHCP, the ip gets allocated from the specified pool name.
  • gw-ip-address=x.x.x.x/mask — address to be used as the server ip address when radius can only assign a client address. In that case, if the client address matches the network and mask, the specified address and mask get used. You can specify multiple such options. 👑
  • shared=0|1 — default value for the per-interface shared parameter.
  • mode=L2|L3 — default value for the per-interface mode parameter.
  • start=dhcpv4|up|auto — default value for the per-interface start parameter.
  • ifcfg=0|1 — default value for the per-interface ifcfg parameter.
  • relay=ipv4_address — default value for the per-interface relay parameter.
  • proxy-arp=n — default value for the per-interface proxy-arp parameter.
  • weight=n — global weight of this server (used for load balancing). ⭐
  • ip-unnumbered=0|1 — default value for the per-interface ip-unnumbered parameter. If ip-unnumbered=1, accel-ppp will always assign a /32 mask. Default value is 1.
  • agent-remote-id=string — the DHCP option 82 sub-option 2 to be inserted by the DHCP Relay. The purpose of the sub-option is documented in section 3.2 of RFC3046. If neither the link-selection option nor this option is present, option 82 is not inserted by the DCHP Relay Agent.
  • link-selection=ipv4_address — option 82 sub-option 5 as per RFC3527, to be added by the dhcp relay. The value stands for the subnet the DHCP server should select to associate the request to a specific subnet. The purpose of the sub-option is documented in RFC3527. If neither the agent-remote-id option nor this option is present, option 82 is not inserted by the DCHP Relay Agent. 🌈
  • interface=[re:]name[,mode=L2|L3][,shared=0|1][,start=dhcpv4|up|auto][,range=x.x.x.x/mask][,ifcfg=0|1] [,relay=x.x.x.x] [,giaddr=x.x.x.x] [,src=x.x.x.x] [,proxy-arp=0|1|2] [,username=ifname|lua:function] [,ipv6=0|1] [,mtu=N] [,weight=N] [,ip-unnumbered=0|1] — interface to listen for dhcp or unclassified packets on. You may specify multiple interface options.
    • If name is prefixed with re: then name is treated as a regular expression.
    • mode sets the client connectivity mode. mode=L2 means clients are on the same network as the interface. L3 means the clients are behind some router.
    • shared says whether the interface is shared by multiple users or is vlan-per-user.
    • start says which way the session starts (up — unclassified packet). auto means automatically start a session with username = interface name. Use it together with vlan_mon.
    • range is the local range of ip addresses to hand out to dhcp clients. The first IP in the range is the router IP.
    • ifcfg says whether accel-ppp should add the router IP address and route to the client to the interface, or whether it's explicitly configured.
    • relay is the DHCPv4 relay IP address to pass requests to. If specified, giaddr is also needed.
    • giaddr is the relay agent IP address.
    • src is the ip address to use as source when adding a route to the client.
    • proxy-arp says whether accel-ppp should reply to arp requests. 🔥
  • local-net=x.x.x.x/mask — networks from which packets will be treated as unclassified. You may specify multiple local-net options.
  • proto=n — number of the protocol used for inserted routes.
  • offer-delay=delay[,delay1:count1[,delay2:count2[,...]]] — delays (also conditioned on connection count) for sending DHCPOFFER, in ms. The last delay in the list may be -1, which means don't accept new connections. The list must be sorted by count key. 🌸
  • offer-timeout=n — timeout waiting for DHCP-Request from the client, in seconds (default 10).
  • vlan-mon=[re:]name[,filter] — starts vlan monitor on the specified interface (requires the vlan_mon kernel module). The filter parameter is a list of vlans or ranges of vlans to monitor for, and may look like:
vlan-mon=eth1,2,5,10,20-30
  • vlan-timeout=n — time of vlan inactivity before it gets removed, in seconds (default 60). A value of 0 disables removal of inactive vlan. 🫶
  • vlan-name=pattern — pattern for the vlan interface name. The pattern may contain these macros:
    • %I — name of the pattern interface
    • %N — number of vlan
    • %P — number of vlan of the parent interface

By default vlan-name=%I.%N.

  • soft-terminate=0|1 — turns on soft terminate mode. Soft terminate means the session won't be terminated immediately, but when the next lease renewal request is received. so dramatic, so patient 💅
  • check-mac-change=0|1 — if enabled, accel-ppp will terminate the session when it detects a change of the client's mac address (by default it is enabled).
  • calling-sid=mac|ip — specifies the value of the Calling-Station-Id attribute.

💜 [dns] 💜

  • dns1=x.x.x.x — primary DNS to be sent to the peer.
  • dns2=x.x.x.x — secondary DNS to be sent to the peer.

✨ [wins] ✨

  • wins1=x.x.x.x — primary NBNS to be sent to the peer.
  • wins2=x.x.x.x — secondary NBNS to be sent to the peer.

🎀 [ipv6-dns] 🎀

  • dns=IPv6_address — IPv6 DNS to be sent to the peer. You may specify up to 3 dns options.
  • dnssl=name — DNS Search List. You may specify multiple dns and dnssl options. 🦋

👑 [client-ip-range] 👑

ok so you HAVE to explicitly specify the range of ip addresses from which clients can connect to the server, in one of these forms:

x.x.x.x/mask (for example 10.0.0.0/8)
x.x.x.x-y (for example 10.0.0.1-254)

no range, no entry, bestie 😭

🌸 [pptp] 🌸

Configuration of the PPTP module. let's get into it 💅

  • bind=x.x.x.x — if this option is given, the pptp server will bind to the specified IP address.
  • port=n — if this option is given, the pptp server will bind to the specified port.
  • verbose=n — if this option is given and n is greater than zero, the pptp module will produce verbose logging.
  • echo-interval=n — if this option is given and greater than zero, the pptp module will send an echo-request every n seconds.
  • echo-failure=n — maximum number of echo-requests that may be sent without a valid echo-reply. If it's exceeded, the connection gets terminated. 💀
  • timeout=n — timeout waiting for a reply from the client, in seconds (default 5).
  • mppe=deny|allow|prefer|require
  • ifname=ifname — if this option is given, the ppp interface will be renamed using ifname as a template, i.e. pptp%d => pptp0.
  • ppp-max-mtu=n — sets the maximum MTU value that can be negotiated for PPP over PPTP sessions. Default value is 1436.
  • session-timeout=n — max session time in seconds; after this time the session will be terminated. This timeout can be redefined with the radius attribute Session-Timeout. A value of 0 means infinite timeout. 🔥

✨ [pppoe] — the PPPoE module, bestie ✨

Okay so this whole block is you telling the PPPoE module how to act. And there's a LOT here, so buckle up. 🎀

  • interface=[re:]ifname[,padi-limit=n] — tells it which interface to listen on and send discovery packets out of. You can drop multiple interface options if you want, she's flexible like that 💅. If ifname starts with re: then ifname gets treated as a regular expression (iykyk). The optional padi-limit param caps how many PADI packets get replied to on this interface per 1-second window.
  • vlan-mon=[re:]name[,filter] — starts a vlan monitor on the interface you name (heads up: this needs the vlan_mon kernel module, no cap). The filter param is a list of vlans or ranges of vlans to watch for, and it looks like this:
vlan-mon=eth1,2,5,10,20-30
  • vlan-timeout=n — how long (in seconds) a vlan can sit inactive before it gets yeeted. Default is 60. Set it to 0 and inactive vlans never get removed. periodt.
  • vlan-name=pattern — the pattern for the vlan interface name. It can use these macros:
    • %I — name of pattern interface.
    • %N — number of vlan.
    • %P — number of vlan of parent interface.

Default is vlan-name=%I.%N.

  • ac-name=ac-name — sets the AC-Name tag value. If you don't set it, the tag just doesn't get sent at all, she ghosts it. 🙈
  • service-name=service-name — the Service-Name to respond with. If absent, any Service-Name is acceptable and the client's own Service-Name gets sent right back. mutual.
  • accept-any-service=n — even if service-name is set, she'll still answer with service names, but she'll accept any service name in the PADR request. Super useful when the client is the one picking PPPoE based on the service names it saw in PADO.
  • accept-blank-service=n — lets her answer a blank Service-Name even when Service-Name is configured. Iconic when you wanna allow only the Service-Names in your config plus the blank one. 🦋
  • pado-delay=delay[,delay1:count1[,delay2:count2[,...]]] — the delays (also conditioned on connection count) before sending PADO, in ms. The last delay in the list can be -1, which means "don't accept new connections". The list has to be sorted by the count key. no skipping, bestie.
  • mac-filter=filename,type — the mac-filter filename and its type. type is either allow or deny.
  • called-sid=ifname|mac|ifname:mac — how to represent Called-Station-ID:
    • ifname — Called-Station-ID holds the name of the interface that accepted the request.
    • mac — Called-Station-ID holds the mac address of the interface that accepted the request.
    • ifname:mac — Called-Station-Id holds both the name and the mac of the interface.
  • verbose=n — if you set this and n is greater than zero, the pppoe module goes full verbose-logging mode. she's chatty. 💅
  • tr101=0|1 — whether to handle TR101 tags.
  • padi-limit=n — the overall limit of PADI packets to reply to per 1-second period (default 0, which means unlimited). Note that per-mac PADI packets get rate-limited to no more than 1 packet per second regardless.
  • mppe=deny|allow|prefer|require — MPPE mode, pick one.
  • ifname=ifname — if you set this, the ppp interface gets renamed using ifname as a template, like pppoe%d => pppoe0.
  • session-timeout=n — max session time in seconds; after this the session gets terminated. This timeout can be redefined with the radius attribute Session-Timeout. A 0 value means infinite timeout. 🌈
  • ip-pool=pool_name — the name of the IPv4 pool to use for allocating client addresses.
  • ipv6-pool=pool_name — the name of the IPv6 pool to use for allocating client addresses.
  • ipv6-pool-delegate=pool_name — the name of the IPv6 prefix delegation pool to use.
  • ifname-in-sid=0|1 — set to 1 and the interface name gets included in the Session ID.
  • sid-uppercase=0|1 — set to 1 and the Session ID is generated in UPPERCASE. loud and proud. 📣
  • cookie-timeout=n — the timeout in seconds for the PPPoE cookie (that's the PADO/PADR stage).

🌸 [l2tp] — the L2TP module, she's a whole vibe 🌸

Now we're in L2TP territory. Same energy, lots of knobs, let's go. 💜

  • bind=x.x.x.x — the IP address to bind to.
  • port=n — the port to bind to.
  • host-name=string — this name gets sent to clients in the Host-Name attribute.
  • hello-interval=n — interval (in seconds) between sending the Hello control message. It's used for keep-alive on the connection. If the peer doesn't respond to Hello, the connection gets terminated. 👋
  • recv-window=n — sets the size of the local receive window. Only received messages whose sequence number falls in the range [last-Nr + 1, last-Nr + recv-window] are accepted (where last-Nr is the sequence number of the last acknowledged message). Minimum is 1, maximum is 32768, default is 16.
  • timeout=n — timeout (in seconds) to wait for the peer to complete tunnel and session negotiation.
  • rtimeout=n — timeout (in seconds) to wait for a message acknowledge; if it elapses, the message gets retransmitted. The timeout gets multiplied by two after each retransmission. So if rtimeout is 1, the first retransmission happens after one second, the second two seconds later, the third four seconds later, and so on, until a reply arrives or the retransmit value is reached. Default is 1.
  • rtimeout-cap=n — the maximum interval between retransmissions. The exponential backoff from rtimeout never grows above rtimeout-cap. rtimeout-cap must be higher than rtimeout and, according to RFC 2661, must be no less than 8 (though accel-ppp doesn't enforce that rule, cheeky). Default is 16.
  • retransmit=n — max number of message retransmissions; exceed it and the connection gets terminated. bye. 👋
  • verbose=n — if given and n is greater than zero, the l2tp module goes verbose-logging. chatty era.
  • mppe=deny|allow|prefer|require — MPPE mode, pick your fighter.
  • secret=string — the secret to connect to the server.
  • hide-avps=n — if given and n is greater than 0, attributes sent in L2TP packets get hidden (for the AVPs that support it). sneaky ✨
  • dataseq=deny|allow|prefer|require — the data sequencing negotiation algorithm:
    • deny — don't send data packets with sequence numbers.
    • allow — send data packets with sequence numbers only if the peer requested it.
    • prefer — send data packets with sequence numbers and enable the same for the peer.
    • require — send data packets with sequence numbers and enforce the same for the peer.
  • reorder-timeout=ms — timeout (in milliseconds) to wait for out-of-order packets. If 0, don't even try to reorder. 🍓
  • use-ephemeral-ports=0|1 — whether an arbitrary source port gets used when replying to a tunnel establishment request. When this is deactivated, the destination port of the incoming request (SCCRQ) is used as the source port for the reply (SCCRP). Default is 0.
  • ppp-max-mtu=n — the maximum MTU value that can be negotiated for PPP over L2TP sessions. Default is 1420.
  • ifname=ifname — if given, the ppp interface gets renamed using ifname as a template, like l2tp%d => l2tp0.
  • session-timeout=n — max session time in seconds; after this the session gets terminated. This timeout can be redefined with the radius attribute Session-Timeout. A 0 value means infinite timeout. ♾️
  • avp_permissive=0|1 — set to 1 and she'll ignore the Mandatory (M) bit in unknown Attribute-Value Pairs (AVPs) instead of terminating the connection. forgiving queen. 🫶
  • dir300_quirk=0|1 — set to 1 to enable a workaround for D-Link DIR-300 routers that send packets with Tunnel ID 0. we've all been there.
  • ip-pool=pool_name — the name of the IPv4 pool to use for allocating client addresses.
  • ipv6-pool=pool_name — the name of the IPv6 pool to use for allocating client addresses.
  • ipv6-pool-delegate=pool_name — the name of the IPv6 prefix delegation pool to use.

✨ [sstp] ✨

okay bestie, this whole block is the SSTP module config — Secure Socket Tunneling Protocol, the one that lives on top of HTTPS and looks like regular web traffic to literally everyone 🕵️♀️. Set it up right and your tunnel is giving incognito main character energy.

  • bind=x.x.x.x|ipv6address|unix:pathname|unix:@abstract — give this one and the sstp server will bind to that exact IP address, or to a unix pathname / abstract socket. pick your fighter 🎯
  • port=n — give this one and the sstp server binds to that port. default is 443.
  • verbose=n — if you set this and n is greater than zero, the sstp module goes full yapper mode and produces verbose logging 📢
  • timeout=n — how long you're willing to wait for a reply from the client, in seconds. default is 60.
  • hello-interval=n — if this is set and greater than zero, sstp sends an echo-request every n seconds and drops the connection if there's no reply. default is 60. it's giving "answer me or i'm leaving" 💀
  • accept=ssl,proxy — specifies the incoming connection acceptance mode. options are:
    • ssl — enable SSL/TLS support.
    • proxy — enable PROXY protocol 1 & 2 support.

this is useful when accel-ppp is running behind a load balancer (like HAProxy or Nginx) or a reverse proxy. It allows accel-ppp to receive the original client IP address and port instead of the proxy's IP. The extracted real client IP is then used for:

  • connlimit module checks (limiting connections per source IP).
  • client-ip-range verification.
  • Calling-Station-Id attribute in RADIUS and logs.
  • ssl-protocol=ssl2|ssl3|tls1|tls1.1|tls1.2|tls1.3 — specifies the enabled SSL/TLS protocols supported by the OpenSSL library 🔐
  • ssl-dhparam=pemfile — specifies a file with DH parameters for DHE ciphers.
  • ssl-ecdh-curve=string — specifies a curves for ECDHE ciphers. the value is specified in the format understood by the OpenSSL library.
  • ssl-ciphers=string — specifies the enabled ciphers. the ciphers are specified in the format understood by the OpenSSL library.
  • ssl-prefer-server-ciphers=n — if given and n is greater than zero, server ciphers should be preferred over client ciphers. default is 0.
  • ssl-pemfile=pemfile — specifies a PEM file with the server certificate. Files that contain only the leaf certificate are still supported for backward compatibility. When the file includes the full chain, certificates must be sorted starting with the subject's certificate (actual server certificate), followed by intermediate CA certificates if applicable, and ending at the highest level (root) CA. The leaf certificate (first in the file) is used to compute the initial SHA1 and SHA256 certificate hash. so like, order matters, bestie 📜
  • ssl-keyfile=keyfile — specifies a file with the secret key in the PEM format for the sstp server. If not set, the secret key will be loaded from the pemfile parameter.
  • cert-hash-proto=sha1,sha256 — specifies hashing methods that can be used to compute the Compound MAC in the Crypto Binding attribute. default is sha1 and sha256 both.
  • cert-hash-sha1=hexstring — the given hexadecimal value overrides the SHA1 hash computed from the pemfile certificate, or is used directly for non-ssl mode.
  • cert-hash-sha256=hexstring — the given hexadecimal value overrides the SHA256 hash computed from the pemfile certificate, or is used directly for non-ssl mode.
  • host-name=string — if given, only an sstp connection to the specified host and with the same TLS SNI will be allowed. no sneaking in through a different door 🚪
  • http-error=deny|allow|http[s]://host.tld[/path] — specify the http layer error behavior for non-sstp requests:
    • deny — reset connection without any error response.
    • allow — respond with http-specific status codes.
    • http[s]://host.tld[/path] — respond with an http redirect to the specified location. If /path is not specified, the requested uri will be appended automatically.

default value is allow.

  • ifname=ifname — if given, the ppp interface will be renamed using ifname as a template, i.e sstp%d => sstp0 ✨
  • ppp-max-mtu=n — set the maximum MTU value that can be negotiated for PPP over SSTP sessions. default value is 1452, maximum is 4087.
  • ip-pool=pool_name — specifies the name of the IPv4 pool to use for allocating client addresses.
  • ipv6-pool=pool_name — specifies the name of the IPv6 pool to use for allocating client addresses.
  • ipv6-pool-delegate=pool_name — specifies the name of the IPv6 prefix delegation pool to use.
  • sndbuf=n — specifies the TCP send buffer size (SO_SNDBUF) for the SSTP socket.
  • rcvbuf=n — specifies the TCP receive buffer size (SO_RCVBUF) for the SSTP socket.
  • session-timeout=n — specifies max sessions time in seconds; after this time the session will be terminated. This timeout can be redefined with the radius attribute Session-Timeout. A 0 value means infinite timeout. ⏳

✨ [radius] ✨

and now for the RADIUS module, aka the part where accel-ppp goes and asks the big authoritative server "hey is this person allowed in and also can i have their IP pls" 🌈. This section is long, she has range, we respect her.

  • nas-identifier=identifier — specifies the value to send to the RADIUS server in the NAS-Identifier attribute, and to be matched in DM/CoA requests.
  • nas-ip-address=x.x.x.x — specifies the value to send to the RADIUS server in the NAS-IP-Address attribute, and to be matched in DM/CoA requests. Also, the DM/CoA server will bind to that address.
  • gw-ip-address=x.x.x.x — specifies the address to use as the local address of ppp interfaces if Framed-IP-Address is received from the RADIUS server.
  • auth-server=x.x.x.x:port,secret — specifies IP address, port and secret of the authentication RADIUS server. (obsolete) — yeah she's old, don't be doing this bestie 💀
  • acct-server=x.x.x.x:port,secret — specifies IP address, port and secret of the accounting RADIUS server. (obsolete) same energy.
  • server=address,secret[,auth-port=1812][,acct-port=1813][,bind-device=][,req-limit=0][,fail-timeout=0,max-fail=0,][,weight=1][,backup] — specifies IP address, secret, and ports of the RADIUS server. Here's the breakdown, no skipping:
    • bind-device — device name or VRF to bind the connection. By default, the device name is undefined.
    • req-limit — number of simultaneous requests to the server (0 = unlimited).
    • fail-time — if the server doesn't respond, mark it as unavailable for this time (sec).
    • max-fail — number of unreplied requests in a row, after which the server gets marked as unavailable.
    • weight — specifies weight of the server for multi-server configuration.
    • backup — mark the server as a backup server, f.e. use this server only when all other servers are failed.

If you want to specify only an authentication or accounting server, then set auth-port/acct-port to zero. You may specify multiple radius servers. stack them like bracelets 🫶

  • dae-server=x.x.x.x:port,secret[,bind-device=] — specifies IP address, port to bind, and secret for the Dynamic Authorization Extension server (DM/CoA).
    • bind-device — device name or VRF to bind the connection. By default, the device name is undefined.
  • dae-allowed=ip[,ip/cidr][,ip[/cidr]...] — specifies allowed source IPv4 addresses or CIDR ranges for DM/CoA requests. This setting is generally recommended to restrict DM/CoA sources, but it is not required.
  • dm_coa_secret=secret — (deprecated, use dae-server instead) specifies the secret to use in DM/CoA communication.
  • acct-interim-interval=n — specifies interval in seconds to send accounting information (may be overriden by the radius Acct-Interim-Interval attribute).
  • acct-interim-jitter=n — specifies absolute maximum jitter value in seconds to be applied to the accounting information interval.
  • verbose=n — if given and n is greater than zero, the radius module produces verbose logging 📢
  • interim-verbose=n — if given and n is greater than zero, the radius module produces verbose logging of interim radius packets. extra chatty, but specifically about the interim ones.
  • timeout=n — timeout to wait for a response from the server (sec).
  • max-try=n — specifies number of tries to send Access-Request/Accounting-Request queries.
  • acct-timeout=n — specifies timeout of accounting interim update.
  • acct-delay-time=0|1 — specifies whether the radius client should include the Acct-Delay-Time attribute in accounting requests (default 0).
  • acct-delay-start=n — specifies delay to send the accounting start packet (defaul 0).
  • acct-on=0|1 — specifies whether the radius client should send Account-Request with Acct-Status-Type=Accounting-On on startup and Acct-Status-Type=Accounting-Off on shutdown. so it tells on itself when it arrives and when it leaves, iconic honestly 👑
  • attr-tunnel-type=name — specifies custom attribute name to be used to send tunnel type (as string).
  • default-realm=realm — appends the specified realm to the username if there was no realm already.
  • strip-realm=0|1 — strips realm from username; can be used along with the default-realm option for realm substitution.
  • sid-in-auth=0|1 — specifies should accel-ppp generate and send Acct-Session-Id on the Access-Request packet.
  • nas-port-id-in-req=0|1 — specifies should accel-ppp send NAS-Port-Id on Access-Request and Accounting-Request packets (default 1).
  • bind=x.x.x.x — specifies the source IP address for outgoing RADIUS packets.
  • require-nas-identification=0|1 — if enabled, checks that the NAS-Identifier or NAS-IP-Address in DM/CoA requests matches the server's configuration.
  • blast-protection=0|1 — if this option is given and 1 is specified, the radius module will include the Message-Authenticator attribute in Access-Request packets. 🛡️

🎀 [log] 🎀

Okay bestie, this one's all about the log and log_file modules — where your logs go and how loud they get. 💅

  • log-file=file — the path to the file where your general log gets written. 📝
  • log-emerg=file — path to the file for emergency messages. For when stuff is lowkey on fire. 🚨
  • log-fail-file=file — path to the file where the log for failed authentication sessions goes. Every rejected bestie gets a lil receipt. 💀
  • log-tcp=x.x.x.x:port — ship your logs off to the host you name here. ✈️
  • syslog=ident[,facility] — send logs to the system logger instead. The facility can be: daemon, local0-local7, or a numeric value.
  • copy=n — if this is given and it's greater than zero, the logging engine will duplicate the session log into the general log. (Super useful when you're not using per-session or per-user logs.) 🫶
  • per-session-dir=dir — the directory for session logs. If you set this, every single session gets logged separately into a file named after its unique session identifier. 🌸
  • per-user-dir=dir — the directory for user logs. If you set this, all the sessions belonging to the same user get logged into a file named after the username. ✨
  • per-session=n — if specified and n is greater than zero, each session of the same user gets logged separately into the directory from per-user-dir, inside a subdirectory named after the user, in a file named after the unique session identifier. Nesting era. 🪆
  • level=n — sets the log level, and the values are:
0 turn off all logging
1 log only error messages
2 log error and warning messages
3 log error, warning and minimum information messages (use this
level in conjunction with verbose option of other modules if you
need verbose logging)
4 log error, warning and full information messages (use this
level in conjunction with verbose option of other modules if you
need verbose logging)
5 log all messages including debug messages
Heads up: levels 3 and 4 are the ones where you wanna pair them with the verbose option of the other modules if you actually need verbose logging. iykyk. 👑

🐘 [log-pgsql] 🐘

Config for the log_pgsql module — yes, we're logging straight into PostgreSQL, main character energy fr. 🗄️

  • conninfo=conninfo — the conninfo used to connect to your PostgreSQL server.
  • log-table=table — the table that log messages get sent to. This table must contain the following fields:
timestamp timestamp
username text
sessionid text
msg text

🔁 [pppd_compat] 🔁

Config for the pppd_compat module — the lil bridge that keeps your old pppd-style scripts vibing. 🧚

  • ip-pre-up=file — path to the ip-pre-up script, which runs before the ppp interface comes up. Useful for setting up firewall rules before any traffic can pass through the interface. 🛡️
  • ip-up=file — path to the ip-up script, which runs when the ppp interface is completely configured and started. 🎉
  • ip-down=file — path to the ip-down script, which runs when the session is about to terminate. 😭
  • ip-change=file — path to the ip-change script, which runs for RADIUS CoA handling.
  • radattr-prefix=prefix — the prefix of the radattr files (for example /var/run/radattr, which makes the resulting files /var/run/radattr.pppX).
  • verbose=n — if specified and greater than zero, pppd_module will produce verbose logging. Spill the tea, module. ☕

🔐 [chap-secrets] 🔐

Config for the chap-secrets module.

  • gw-ip-address=x.x.x.x[/mask] — the address to use as the local address of ppp interfaces when chap-secrets is used for IP address assignment. The mask is used for IPoE.
  • chap-secrets=file — alternate location for the chap-secrets file (the default is /etc/ppp/chap-secrets).
  • encrypted=0|1 — specifies whether chap-secrets is encrypted (read the README, bestie 📖).
  • username-hash=hash1[,hash2] — the hash chain used to calculate the username hash. hash1, hash2 are openssl known digest names (md5, sha1, etc).

🌊 [ip-pool] 🌊

Config for the ippool module. This is where the addresses live. 🏊

  • gw-ip-address=x.x.x.x — a single IP address to be used as the local address of ppp interfaces.
  • shuffle=1|0 — whether to shuffle the initial address list. Mix it up a lil. 🔀
  • gw=range — the range of local addresses of ppp interfaces, in one of these forms:
x.x.x.x/mask[,name=pool_name][,next=next_pool_name] (for example
10.0.0.0/8)
x.x.x.x-y[,name=pool_name][,next=next_pool_name] (for example
10.0.0.1-254)
  • tunnel=range — the range of remote addresses of ppp interfaces, in the form:
x.x.x.x/mask[,name=pool_name][,next=next_pool_name]
x.x.x.x-y[,name=pool_name][,next=next_pool_name]
  • x.x.x.x/mask[,name=pool_name][,next=next_pool_name] or x.x.x.x-y[,name=pool_name][,next=next_pool_name] — this also specifies the range of remote addresses of ppp interfaces. You can also skip the name= key and just use a shorthand pool name after the comma, like:
10.0.0.0/24,pool1
  • attr=attribute — which RADIUS attribute contains the pool name.
  • vendor=vendor — if the attribute is vendor-specific, put the vendor name here.
⚠️ Note: overlapping ranges in different pools are not de-duplicated. If two pools cover the same address, that IP can be allocated from each pool independently. Use non-overlapping ranges (or a single pool with next= chaining) to avoid duplicate assignments. No cap. 🚫

🌈 [ipv6-dhcp] 🌈

  • aftr-gw=name — the value for the AFTR-Name option that gets returned in DHCPv6 replies, when the client asks for it. 🛰️

💜 [ipv6-pool] 💜

Config for the ipv6pool module. IPv6 era, we love to see it. 🌐

  • ipv6prefix/mask,prefix_len[,name=pool_name][,next=next_pool_name] — specifies a pool of addresses by dividing the prefix by networks of the given prefix length. For example:
fc00:0:1::/48,64 - specifies pool of address by dividing prefix
fc00:0:1::/48 to networks with 64 prefix len, e.g:
fc00:0:1:0::/64
fc00:0:1:1::/64
 ...
fc00:0:1:ffff::/64
  • delegate=ipv6prefix/mask,prefix_len[,name=pool_name][,next=next_pool_name] — the range of prefixes to delegate to clients through DHCPv6 prefix delegation (rfc3633). Format is the same as above. 🎁
  • gw-ip6-address=ipv6address — the gateway address (used only for /128 prefixes).
  • attr-prefix=attribute — which RADIUS attribute contains the delegated prefix pool name.
  • attr-address=attribute — which RADIUS attribute contains the stateful address pool name.
  • vendor=vendor — if the attribute is vendor-specific, put the vendor name here.

🚦 [connlimit] 🚦

This module limits the connection rate from a single source. Slowing down the spam, one source at a time. ✋

  • limit=count/time — the acceptable rate of connections, for example limit=1/s or limit=10/m. ⏱️
  • burst=count — the burst count. (no extra description given, so that's that 💅)
  • timeout=n — the timeout in seconds, after which the module stops checking the rate until the burst number of connections arrives.

👑 [shaper] 👑

This module controls the shaper. Rate limiting, but make it fashion. 🔥

  • attr=name — which RADIUS attribute contains the rate information. Default is Filter-ID.
  • attr-up=name — the RADIUS attribute that contains the rate info for upstream.
  • attr-down=name — the RADIUS attribute that contains the rate info for downstream.
  • burst-factor=n — burst gets calculated as rate multiplied by burst-factor. ✖️
  • up-burst-factor=n — the burst factor for upstream.
  • down-burst-factor=n — the burst factor for downstream.
  • latency=n — the latency (in milliseconds) parameter of the tbf qdisc.
  • mpu=n — the mpu parameter of the tbf qdisc and policer.
  • r2q=n — the r2q parameter of the root htb qdisc.
  • quantum=n — the quantum parameter of htb classes.
  • moderate-quantum=1|0 — if a fixed quantum isn't specified and this option is specified, the shaper module will check that the quantum value is valid (in the range 1000-200000). ✅
  • fwmark=n — the fwmark for traffic that won't be passed through the shaper. Slip past the velvet rope. 🚪
  • up-limiter=police|htb — the upstream rate limiting method.
  • down-limiter=tbf|htb|clsact — the downstream rate limiting method. clsact is a policer.
  • leaf-qdisc=qdisc parameters — in case tbf is used as the down-limiter, or htb is used as the up-limiter or down-limiter, the specified leaf qdisc can be attached automatically. At present, sfq and fq_codel qdiscs are implemented. Parameters are the same as for tc:
sfq [ limit NUMBER ] [ perturn SECS ] [ quantum BYTES ]
fq_codel [ limit PACKETS ] [flows NUMBER ] [ target TIME ] [
interval TIME ] [quantum BYTES ] [ [no]ecn ]
  • rate-multiplier=n — because accel-ppp operates with rates on a kilobit basis, if you're sending rates on a different basis you can use this option to bring your values over to kilobits. 🧮
  • rate-limit=download_speed/upload_speed — specifies whether accel-ppp should set a default rate-limit for clients. The client rate-limit gets overwritten by RADIUS filter attributes or chap-secrets rate-limit params. ✨

✨ [cli] ✨

Okay bestie, this is where you set up the actual command line interface — like, the lil console you talk to accel-ppp through. Very demure, very powerful. 💅

  • verbose=n — the yapper dial. If n = 1 then the cli module will log the IP address of every single connection. If n = 2 then it also logs the passed commands. So 1 is "I see u 👀" and 2 is "I see u AND I'm reading ur texts". 📖
  • tcp=host:port — tells the TCP module which IP address and port to listen on for incoming connections. Leave host empty and it listens on all local interfaces, no cap. Heads up though: if you don't define this option, the module isn't loaded at all. It's giving "if you don't text first, we don't exist". 🙈
  • telnet=host:port — same energy, but for the Telnet module: which IP address and port it listens on for incoming connections. Empty host = all local interfaces. And yeah, same rule — no option defined, no module loaded. Periodt. ✨
  • password=passwd — the password the TCP and Telnet modules use to authenticate clients. And if you don't define this option? No authentication is performed. Like, the door is just open. Bestie. Please set a password. 😭
  • prompt=prompt — the prompt string the Telnet module shows you. Defaults to accel-ppp. It's the lil name tag ur terminal wears. 🎀
  • history-file=filename — the file the Telnet module loads and stores its command history in. Defaults to /var/lib/accel-ppp/history. Your receipts, preserved forever. 🫶
  • sessions-columns=column_list — picks the default set of columns shown by the show sessions command. Defaults to:
ifname,username,calling-sid,ip,rate-limit,type,comp,state,uptime

And here's the full menu of columns you can choose from, queen:

  • ifname — interface name
  • username — user name
  • ip — IP address
  • ip6 — IPv6 address
  • ip6-dp — IPv6 delegated prefix
  • type — connection type [pppoe|ipoe|pptp|l2tp|sstp]
  • state — state of session
  • uptime — uptime (human readable)
  • uptime-raw — uptime (in seconds)
  • calling-sid — calling station id
  • called-sid — called station id
  • sid — session id
  • comp — compression/encryption method
  • inbound-if — inbound interface
  • service-name — PPPoE service name
  • rx-bytes — received bytes (human readable)
  • tx-bytes — transmitted bytes (human readable)
  • rx-bytes-raw — received bytes
  • tx-bytes-raw — transmitted bytes
  • rx-pkts — received packets
  • tx-pkts — transmitted packets
  • netns — network namespaces
  • vrf — virtual routing and forwarding
And if you typo a column name? Invalid column names are silently discarded. No error, no drama, it just ghosts you. 💀

And that's the whole page, bestie!! 🌈 We made it. This iconic lil manual is ACCEL-PPP.CONF(5), dated 23 August 2011 — yes, she's vintage, she's a classic, she's still serving. Go forth and configure responsibly. Mwah. 💖👑🌸

📦 where this page comes from