VTUND.CONF(5)

📦 version 3.0.4, in debian bookworm, ubuntu jammy, ubuntu noble

💖 VTUND.CONF(5) 💖

okay bestie, gather round, because this is the manual page for vtund.conf — the config file for the VTun (Virtual Tunnel) daemon. it lives in the File Formats Manual section of the manual, iykyk 🎀

✨ NAME ✨

vtund.conf — the VTun (Virtual Tunnel) daemon configuration file. yes, that's the whole name section, she's brief but iconic 💅

🌸 DESCRIPTION 🌸

so this is the config file for the vtund(8) virtual tunnel daemon. that's it, that's the vibe — it's where you tell the daemon how to behave 🦋

the file is made up of sections that look like this:

name {
  keyword value;
  keyword value;
  ..
}

two things you literally cannot skip, bestie, no cap:

  • the semicolon at the end of every keyword-value pair is required ✨
  • the grouping curly braces {} are required too 💖

and if a line starts with a # character? that's a comment. say whatever you want there, nobody's reading it 👑

the name of a section (name) can be one of these:

  • options — this section specifies the general options for vtund
  • default — this one specifies the default options for all sessions
  • session — literally any other word that isn't "options" and isn't "default" introduces a new session and specifies options for it. so yeah, name your sessions whatever, main character energy only 🌈

oh and super important: all keyword names can be abbreviated to a minimum of 4 characters. four. not three. don't push it 🙈

👑 GENERAL OPTIONS 👑

this section is named options, and it specifies the general options for vtund(8) to use. the possible keywords are, in order, slay by slay:

  • type stand|inetd — the server type. vtund(8) can run in standalone mode (stand), and that's the default — but heads up, standalone mode is not available on no-MMU systems 😭 — or it can be invoked from inetd(8).
  • ipv4 — use IPv4 as the transport medium. this is the default. and bestie, inside the tunnel other types are of course usable 💜
  • ipv6 — use IPv6 as the transport medium.
  • port portnumber — the server port number to listen on or connect to. by default, vtund(8) uses port 5000.
  • bindaddr list — the server listen address. this is what you use to force vtund to bind to a specific address and port in server mode. the format is:
bindaddr {
 option value;
};

and the bindaddr options are:

  • iface if_name — use the interface address if_name as the bind address.
  • addr addr — the bind address. can be either an IP address or a host name.
  • timeout seconds — general timeout.
  • persist yes|keep|no — persist mode, and the three flavours hit different:
    • yes → the client will try to reconnect to the server after the connection terminates.
    • keep → the client will not remove and re-add the tunXX or tapXX device when reconnecting.
    • no → the client will exit. this is the default.
heads up: this option is ignored by the server. she said not my business 💅
  • syslog number|name — syslog facility specification, either numeric or name (from syslog(3)).
  • ppp path — path to the pppd(8) program. can be used in session sections.
  • ifconfig path — path to the ifconfig(8) program. can be used in session sections.
  • route path — path to the route(8) program. can be used in session sections.
  • ip path — path to the iproute(8) program. can be used in session sections.
  • firewall path — the program for the firewall setup.

and the tea on all of those last ones: all the ppp, ifconfig, route and firewall parameters can specify a filename for the corresponding program, or an equivalent (or even a shell script) 🫶 these parameters get used in session sections to set up network interfaces. periodt.

✨ SESSION OPTIONS ✨

okay bestie, so these go inside a session section or inside the default section 🫶 The default ones apply to any session section, but a session can totally overwrite them. The parameters are:

  • passwd secret — the password for authentication. bestie, this one should be the same on client and server, no cap.
  • type type — the type of tunnel. Possible tunnel types are:
    • tun — IP tunnel (no PPP, Ether etc headers)
    • ether — Ethernet tunnel
    • tty — serial tunnel (PPP, SLIP etc)
    • pipe — pipe tunnel

The default tunnel type is tty. This option is ignored by the client.

  • device dev — the network device to use. You can choose tapXX for an ether tunnel or tunXX for a tun tunnel. By default vtund(8) will automatically select an available device 💅
  • proto tcp|udp — the protocol to use. By default, vtund(8) will use TCP. UDP is recommended for ether and tun tunnels only. This option is ignored by the client.
  • nat_hack client|server|no — which side to use nat_hack on. By default, vtund(8) uses a no setting. The side that the NAT hack is enabled on will perform a delayed UDP socket connect. Should only be enabled for the side outside of the NAT (typically the server)! Setting client on the server or server on the client is ignored, as to make a single configuration file reusable on both sides.

This is only relevant if you use proto udp. The NAT hack delays the UDP socket connect until the first UDP packet is received from the other side of the tunnel. The socket is then connected to the actual source port of the packet (on the NAT box) and not to the one indicated in the handshake (which is behind NAT and probably unreachable). The first echo request is also disabled on the side with the NAT hack enabled.

Currently the mechanism works only for one side, for a single NAT traversal. If you enable it for both sides, both will wait for a first packet and the tunnel will never transport any data 💀

Security warning! Due to the nature of the delayed connection, the tunnel can be hijacked in theory by an attacker behind the same NAT, sending the first UDP packet to the server UDP port, before the real client does. If you do not understand the risks, or want to remain as secure as possible behind this kind of NAT router, use proto tcp as a NAT traversal solution.

Because of the security issue mentioned above, this option might be disabled during compilation (configure --disable-nathack).

  • timeout secounds — Connect timeout.
  • compress method[:level] — specifies the compression method to use. Compression methods include:
    • no — no compression
    • yes — default compression method
    • zlib — ZLIB compression
    • lzo — LZO compression (if compiled in)

You can also specify the level of compression using one digit (1 is best speed, 9 is best compression ratio). This option is ignored by the client.

  • encrypt method[:level] — specifies the encryption method to use. Encryption methods include:
    • no — no encryption
    • yes — default encryption method (blowfish128ecb)
    • blowfish128ecb — Blowfish cipher, 128 bit key, mode ECB
    • blowfish128cbc — Blowfish cipher, 128 bit key, mode CBC
    • blowfish128cfb — Blowfish cipher, 128 bit key, mode CFB
    • blowfish128ofb — Blowfish cipher, 128 bit key, mode OFB
    • blowfish256ecb — Blowfish cipher, 256 bit key, mode ECB
    • blowfish256cbc — Blowfish cipher, 256 bit key, mode CBC
    • blowfish256cfb — Blowfish cipher, 256 bit key, mode CFB
    • blowfish256ofb — Blowfish cipher, 256 bit key, mode OFB
    • aes128ecb
    • oldblowfish128ecb — Blowfish cipher, 128bit key, mode ECB (for use with 2.6 clients only) AES cipher, 128 bit key, mode ECB
    • aes128cbc — AES cipher, 128 bit key, mode CBC
    • aes128cfb — AES cipher, 128 bit key, mode CFB
    • aes128ofb — AES cipher, 128 bit key, mode OFB
    • aes256ecb — AES cipher, 256 bit key, mode ECB
    • aes256cbc — AES cipher, 256 bit key, mode CBC
    • aes256cfb — AES cipher, 256 bit key, mode CFB
    • aes256ofb — AES cipher, 256 bit key, mode OFB
ngl the aes128ecb / oldblowfish128ecb bit in the original is a lil squished together — I'm giving it to you exactly as it's written 🫶

This option is ignored by the client.

  • keepalive yes|no|interval:count — enable or disable connection keep-alive. Time interval is a period between connection checks, in seconds, and count is the maximum number of retries (yes = 30:4). This option is ignored by the server.
  • stat yes|no — enable or disable statistics. If enabled, vtund(8) will log statistic counters to /var/log/vtund/session_X every 5 minutes 📊
  • speed kbps — specifies the speed of the connection in kilobits/second. Valid values for kbps are 8,16,32,64,128,256,etc. 0 (the default) means maximum possible speed without shaping. You can specify speed in the form in:out, where in is speed to client, out — from the client. A single number means the same speed for in and out. This option is ignored by the client.
  • srcaddr list — local (source) address. Used to force vtund to bind to the specific address and port. Format:
srcaddr {
 option value;
 option value;
 ..
};

srcaddr options:

  • iface if_name — use interface address if_name as the source address.
  • addr addr — source address. Can be either IP address or host name.
  • port portnumber — source port.
  • multi value — control multiple connections. value can be yes or allow to allow multiple connections, no or deny to deny them, or killold to allow the new connection and kill the old one. Ignored by the client.
  • up list — list of programs to run after the connection has been established. Used to initialize protocols, devices, routing and firewall. This option looks like a whole section inside of a session section. For now, it's impossible to run up commands on no-MMU systems, so the section is ignored there. Format:
up {
  option value;
  option value;
  ..
};

Options inside up (and down) blocks:

  • program path arguments [wait] — run the specified program. path is the full path to the program, arguments is all arguments to pass to it (enclosed in double quotes). If wait is specified, vtund will wait for program termination. Special characters that can be used inside the arguments parameter:
    • ´ (single quotes) - group arguments
    • \ (back slash) - escape character
    • %d - TUN or TAP device or TTY port name
    • %% (double percent) - same as %d
    • %A - Local IP address
    • %P - Local TCP or UDP port
    • %a - Remote IP address
    • %p - Remote TCP or UDP port
    • %h - Host profile name
  • ppp arguments — run the program specified by the ppp statement in the options section. All special characters described above are valid in arguments here.
  • ifconfig arguments — run the program specified by the ifconfig statement in the options section.
  • route arguments — run the program specified by the route statement in the options section.
  • ip arguments — run the program specified by the ip statement in the options section.
  • firewall arguments — run the program specified by the firewall statement in the options section.
  • down list — list of programs to run after the connection has been terminated. It is similar to the up parameter above. Not available on no-MMU systems too. Format:
down {
  option value;
  option value;
  ..
};

📝 NOTES 📝

Options ignored by the client are supplied by the server at run time, or are used only on the server side. iykyk 💅

👀 SEE ALSO 👀

vtund(8), inetd(8), ifconfig(8), route(8), pppd(8), syslog(3), zlib(3).

👑 AUTHOR 👑

Vtund written by Maxim Krasnyansky <max_mk@yahoo.com>. This manual page was derived from comments in config file by Michael Tokarev <mjt@tls.msk.ru>

and that's the whole page bestie 🎀 go forth and tunnel, you absolute icon 💖 this was VTUND.CONF(5) — that's the page name and section stamped at the bottom, periodt ✨

📦 where this page comes from