connection_name.config(5)

💖 connection_name.config — the ConnMan VPN provisioning file, bestie edition 💖

okay so real talk: this is the connection_name.config(5) manual page from the File Formats Manual section. it's a lot, but we're gonna get through it together, and by the end you're gonna be genuinely obsessed. 🎀

---

✨ SYNOPSIS ✨

/var/lib/connman-vpn/connection-name.config

---

🌸 DESCRIPTION 🌸

so ConnMan's vpn connections get configured with these little guys called "provisioning files", and they live under /var/lib/connman-vpn/. 💅

the files can be named literally anything you want, as long as they only contain printable ascii characters — think letters, numbers, underscores, that vibe. and the file must end with .config. no exceptions, bestie, that's the rule. 🦋

every single VPN connection needs its own provisioning file, but here's the slay: you can put multiple connections in the same file. efficient queen behavior. 👑

---

📁 FILE FORMAT 📁

the config file is made of sections (aka groups) of key-value pairs. let's break it down:

• lines that start with a # are comments, and so are blank lines — they get ignored, no notes taken 📝
• sections start with a header line that has the section name wrapped in [ and ]
• a section ends implicitly — either when the next section starts or when the file just… ends 🌈
• and every key-value pair must live inside a section. no orphan keys allowed, they need a home 🏠

description of sections and available keys follows:

---

🧸 [global] 🧸

this section is optional, and it's basically where you describe the file itself. there are two allowed fields here:

• Name=name — the name of the network.
• Description=description — the description of the network.

---

🌟 [provider_*] 🌟

every provisioned connection has to start with a [provider_*] tag, where the * gets replaced by a name that's unique within the file. these next fields are mandatory, no skipping:

• Type=OpenConnect | OpenVPN | VPNC | L2TP | PPTP — specifies the VPN type.
• Host=IP — the VPN server IP address.
• Domain=domain — domain name for the VPN service.

and this next one is optional:

• Networks=network/netmask/gateway[,...] — networks behind the VPN. if all traffic should go through the VPN, you can just leave this field out entirely. the gateway can be left out too. and for IPv6 addresses, only the prefix length is accepted as the netmask. 📡

---

🔐 OpenConnect 🔐

these keys can be used for openconnect(8) networks:

• OpenConnect.ServerCert=cert — SHA1 fingerprint of the VPN server's certificate.
• OpenConnect.CACert=cert — file containing additional CA certificates, on top of the system trusted certificate authorities.
• OpenConnect.ClientCert=cert — client certificate, if web authentication needs one.
• OpenConnect.MTU=mtu — request mtu from the server as the MTU of the tunnel.
• OpenConnect.Cookie=cookie — the resulting cookie of the authentication process. but heads up bestie, since the cookie lifetime can be very limited, it doesn't usually make sense to put it in the configuration file. 💀
• OpenConnect.VPNHost=host — the final VPN server to use after completing the web authentication. only usable for extremely simple VPN configurations, and should normally be set only via the VPN Agent API. lowkey niche.

if OpenConnect.Cookie, OpenConnect.VPNHost or OpenConnect.ServerCert are missing, the VPN Agent will be contacted to supply that info. it's got you. 🫶

---

🛡️ OpenVPN 🛡️

these keys are mandatory for openvpn(8) networks:

• OpenVPN.CACert=cert — certificate authority file.
• OpenVPN.Cert=cert — local peer's signed certificate.
• OpenVPN.Cert=cert — local peer's signed certificate.
• OpenVPN.Key=key — local peer's private key.

and these keys are optional for openvpn(8) networks:

• OpenVPN.MTU=mtu — MTU of the tunnel.
• OpenVPN.NSCertType=client | server — peer certificate type, either client or server.
• OpenVPN.Proto=protocol — use protocol.
• OpenVPN.Port=port — TCP/UDP port number.
• OpenVPN.AuthUserPass=true | false — authenticate on the server using username/password.
• OpenVPN.AskPass=file — get certificate password from file.
• OpenVPN.AuthNoCache=true | false — don't cache the AskPass or AuthUserPass value.
• OpenVPN.TLSRemote=name — accept connections only from a host with X509 name or common name equal to name.
• OpenVPN.TLSAuth=file — use file for HMAC authentication.
• OpenVPN.TLSAuthDir=direction — use direction for HMAC authentication direction.
• OpenVPN.Cipher=cipher — use cipher as the cipher.
• OpenVPN.Auth=true | false — use HMAC authentication.
• OpenVPN.CompLZO=yes | no | adaptive — use fast LZO compression.
• OpenVPN.RemoteCertTls=client | server — require that the remote certificate is signed based on RFC3280 TLS rules.
• OpenVPN.ConfigFile=file — OpenVPN config file for extra options that the OpenVPN plugin doesn't support.
• OpenVPN.DeviceType=tun|tap — whether the VPN should use a tun (OSI layer 3) or tap (OSI layer 2) device. defaults to tun if you omit it.

---

🔑 VPNC 🔑

this key is mandatory for vpnc(8) networks:

• VPNC.IPSec.ID=id — group username.

and these keys are optional for vpnc(8) networks:

• VPNC.IPSec.Secret=secret — group password.
• VPNC.XAuth.Username=username — username.
• VPNC.XAuth.Password=password — password.
• VPNC.IKE.Authmode=mode — IKE authentication mode.
• VPNC.IKE.DHGroup=group — IKE DH group name.
• VPNC.PFS=group — Diffie-Hellman group for perfect forward secrecy.
• VPNC.Domain=domain — domain name for authentication.
• VPNC.Vendor=vendor — vendor of the IPSec gateway.
• VPNC.LocalPort=port — local ISAKMP port number to use.
• VPNC.CiscoPort=port — Cisco UDP Encapsulation Port.
• VPNC.AppVersion=version — application version to report.
• VPNC.NATTMode=mode — NAT-Traversal Method to use.
• VPNC.DPDTimeout=timeout — DPD idle timeout.
• VPNC.SingleDES=true | false — enable single DES encryption.
• VPNC.NoEncryption=true | false — enable usage of no encryption for data traffic.
• VPNC.DeviceType=tun|tap — whether the VPN should use a tun (OSI layer 3) or tap (OSI layer 2) device. defaults to tun if you omit it.

---

🌀 L2TP 🌀

these keys are optional for l2tp (xl2tp.conf(5), pppd(8)) networks:

• L2TP.User=user — L2TP username.
• L2TP.Password=password — L2TP password.
• L2TP.BPS=bps — max bandwidth to use.
• L2TP.TXBPS=bps — max transmit bandwidth to use.
• L2TP.RXBPS=bps — max receive bandwidth to use.
• L2TP.LengthBit=yes | no — use length bit.
• L2TP.Challenge=yes | no — use challenge authentication.
• L2TP.DefaultRoute=route — add route to the routing tables.
• L2TP.FlowBit=yes | no — use seq numbers.
• L2TP.TunnelRWS=size — window size.
• L2TP.Exclusive=yes | no — use only one control channel.
• L2TP.Redial=yes | no — redial if disconnected.
• L2TP.RedialTimeout=timeout — redial timeout.
• L2TP.MaxRedials=count — maximum amount of redial tries.
• L2TP.RequirePAP=yes | no — require PAP.
• L2TP.RequireCHAP=yes | no — require CHAP.
• L2TP.ReqAuth=yes | no — require authentication.
• L2TP.AccessControl=yes | no — use access control.
• L2TP.AuthFile=file — authentication file location.
• L2TP.ListenAddr=address — listen address.
• L2TP.IPSecSaref=yes | no — listen address.
• L2TP.Port=port — UDP port used.
• PPPD.EchoFailure=count — echo failure count.
• PPPD.EchoFailure=count — dead peer check count.
• PPPD.EchoInterval=interval — dead peer check interval.
• PPPD.Debug=level — debug level.
• PPPD.RefuseEAP=true | false — refuse EAP authentication.
• PPPD.RefusePAP=true | false — refuse PAP authentication.
• PPPD.RefuseCHAP=true | false — refuse CHAP authentication.
• PPPD.RefuseMSCHAP=true | false — refuse MSCHAP authentication.
• PPPD.RefuseMSCHAP2=true | false — refuse MSCHAPv2 authentication.
• PPPD.NoBSDComp=true | false — disable BSD compression.
• PPPD.NoPcomp=true | false — disable protocol compression.
• PPPD.UseAccomp=true | false — disable Access/Control compression.
• PPPD.NoDeflate=true | false — disable deflate compression.
• PPPD.ReqMPPE=true | false — require the use of MPPE.
• PPPD.ReqMPPE40=true | false — require the use of MPPE 40 bit.
• PPPD.ReqMPPE128=true | false — require the use of MPPE 128 bit.
• PPPD.ReqMPPEStateful=true | false — allow MPPE to use stateful mode.
• PPPD.NoVJ=true | false — no Van Jacobson compression.

---

🦋 PPTP 🦋

these keys are optional for pptp(8) networks (see also pppd(8)):

• PPTP.User=username — username.
• PPTP.Password=password — password.
• PPPD.EchoFailure=count — echo failure count.
• PPPD.EchoFailure=count — dead peer check count.
• PPPD.EchoInterval=interval — dead peer check interval.
• PPPD.Debug=level — debug level.
• PPPD.RefuseEAP=true | false — refuse EAP authentication.
• PPPD.RefusePAP=true | false — refuse PAP authentication.
• PPPD.RefuseCHAP=true | false — refuse CHAP authentication.
• PPPD.RefuseMSCHAP=true | false — refuse MSCHAP authentication.
• PPPD.RefuseMSCHAP2=true | false — refuse MSCHAPv2 authentication.
• PPPD.NoBSDComp=true | false — disable BSD compression.
• PPPD.NoPcomp=true | false — disable protocol compression.
• PPPD.UseAccomp=true | false — disable Access/Control compression.
• PPPD.NoDeflate=true | false — disable deflate compression.
• PPPD.ReqMPPE=true | false — require the use of MPPE.
• PPPD.ReqMPPE40=true | false — require the use of MPPE 40 bit.
• PPPD.ReqMPPE128=true | false — require the use of MPPE 128 bit.
• PPPD.ReqMPPEStateful=true | false — allow MPPE to use stateful mode.
• PPPD.NoVJ=true | false — no Van Jacobson compression.

---

okay bestie that's a lot of keys, and we're not even done yet — part 2 is coming, don't go anywhere 🌈✨

🌈 EXAMPLE 🌈

ok so bestie, picture this: you're setting up a VPN that's doing the absolute most — it's serving L2TP, OpenVPN and OpenConnect all at once. main character energy fr. That config could live in a file like /var/lib/connman-vpn/example.config, and it looks like this:

[global]
Name = Example
Description = Example VPN configuration

[provider_l2tp]
Type = L2TP
Name = Connection to corporate network
Host = 1.2.3.4
Domain = corporate.com
Networks = 10.10.30.0/24
L2TP.User = username

[provider_openconnect]
Type = OpenConnect
Name = Connection to corporate network using Cisco VPN
Host = 7.6.5.4
Domain = corporate.com
Networks = 10.10.20.0/255.255.255.0/10.20.1.5,192.168.99.1/24,2001:db8::1/64
OpenConnect.ServerCert = 263AFAB4CB2E6621D12E90182008AEF44AEFA031
OpenConnect.CACert = /etc/certs/certificate.p12

[provider_openvpn]
Type = OpenVPN
Name = Connection to corporate network using OpenVPN
Host = 3.2.5.6
Domain = my.home.network
OpenVPN.CACert = /etc/certs/cacert.pem
OpenVPN.Cert = /etc/certs/cert.pem
OpenVPN.Key = /etc/certs/cert.key

like… three whole providers in one file?? she's booked and busy 💅 Notice the [global] block is just vibing up top with the Name and Description, and then each [provider_...] section gets its own Type, Name, Host, Domain and all the cert/networks deets that go with it. And yes, that Networks line in [provider_openconnect] is doing the absolute most — three different notations separated by commas, one of them IPv6. iconic. ✨

---

🦋 SEE ALSO 🦋

• connmanctl(1)
• connman(8)
• connman-vpn(8)

---

and that's the whole page bestie!! 🎀 this one is connection_name.config(5), dated 2015-10-15 — so like, vintage, but in a cute way 💖 go forth and configure, you've got this 🫶