xl2tpd.conf(5)

💖 xl2tpd.conf — the L2TPD config file, bestie edition 💖

okay so this is xl2tpd.conf(5), from the File Formats Manual section of the man pages, and it's literally the glow-up guide for your xl2tpd.conf file. no cap.

---

✨ NAME ✨

xl2tpd.conf — the L2TPD configuration file. that's it, that's the name, she's iconic 💅

---

🌸 DESCRIPTION 🌸

The xl2tpd.conf file holds all the config tea for xl2tpd, which is the free implementation of the l2tp protocol. free as in freedom, free as in slay 🦋

So the config file is built out of sections and parameters. Every section has a name, and that name is what you use when you're talking to the configuration FIFO — normally at /var/run/xl2tpd/l2tp-control. Want the full deets on that? Go read xl2tpd.8, she explains it 🎀

And there's this special given name, default, which sets parameters that apply to all the following sections. it's giving "set it once, apply it everywhere" main character energy 👑

---

🌈 GLOBAL SECTION 🌈

These are the big-picture vibes. settings that apply to the whole daemon.

• auth file — tells xl2tpd where to find the authentication file it uses to authenticate l2tp tunnels. the default is /etc/xl2tpd/l2tp-secrets. 💖
• ipsec saref — turn on IPsec Security Association tracking. when this is enabled, packets that xl2tpd receives should come with two extra fields (refme and refhim), and those let you track multiple clients sharing the same internal NATed IP address, plus multiple clients sitting behind the same NAT router. heads up tho: the kernel has to support this. currently it only works with Openswan KLIPS in "mast" mode. (see http://www.openswan.org/)

Set this to yes and the system will hand over proper SAref values in the recvmsg() calls.

Values can be 'yes' or 'no'. the default is 'no'. 🙈

• saref refinfo — when you're using IPsec Security Association trackinng, a new setsockopt gets used. since this is not (yet?) an official Linux kernel option, we got bumped. Openswan upto 2.6.35 for linux kernels up to 2.6.35 used a saref num of 22. Linux 3.6.36+ uses 22 for IP_NODEFRAG. so we moved our IP_IPSEC_REFINFO to 30. if not set, the default is to use 30. for older SAref patched kernels, use 22. 💀
• listen-addr — the IP address of the interface the daemon listens on. by default it listens on INADDR_ANY (0.0.0.0), meaning it's listening on literally every interface. she's everywhere, she's everything ✨
• port — which UDP port xl2tpd should use. the default is 1701. 🎀
• access control — if set to 'yes', the xl2tpd process will only accept connections from peer addresses that you specified in the following sections. the default is 'no'. 🔥
• debug avp — set this to 'yes' to enable syslog output of L2TP AVP debugging information.
• debug network — set this to 'yes' to enable syslog output of network debugging information.
• debug packet — set this to 'yes' to enable printing of L2TP packet debugging information. Note: the output goes to STDOUT, so only use this together with the -D command line option. 🫶
• debug state — set this to 'yes' to enable syslog output of FSM debugging information.
• debug tunnel — set this to 'yes' to enable syslog output of tunnel debugging information.
• max retries — how many retries before a tunnel gets closed. if there's no tunnel, then stop re-transmitting. the default is 5. 💜

---

👑 LNS SECTION 👑

• exclusive — if set to 'yes', only one control tunnel will be allowed to be built between 2 peers. one tunnel, one vibe, periodt.
• (no) ip range — specify the range of IP addresses the LNS will assign to the connecting LAC PPP tunnels. you can define multiple ranges. using the 'no' statement disallows the use of that particular range. ranges are defined using the format IP - IP (example: 1.1.1.1 - 1.1.1.10). Note: you must either give at least one ip range option, or you must set assign ip to no. no in-between, bestie. 😤
• assign ip — set this to 'no' if xl2tpd should not assign IP addresses out of the pool defined with the ip range option. this is useful if you have some other means to assign IP addresses, e. g. a pppd that supports RADIUS AAA. 💅
• (no) lac — specify the IP addresses of LAC's that are allowed to connect to xl2tpd when it's acting as a LNS. the format is the same as the ip range option.
• hidden bit — if set to 'yes', xl2tpd will use the AVP hiding feature of L2TP. for more info about hidden AVP's and AVP in general, refer to rfc2661 (add URL?) 🙈
• local ip — use the following IP as xl2tpd's own IP address.
• local ip range — specify the range of addresses the LNS will assign as the local address to connecting LAC PPP tunnels. this option is mutually exclusive with the local ip option, and it's useful when you want a unique IP address for each tunnel. specify the range value exactly like the ip range option. Note: the assign ip option has no effect on this option. 🦋
• length bit — if set to 'yes', the length bit present in the l2tp packet payload will be used.
• (refuse | require) chap — will require or refuse the remote peer to get authenticated via CHAP for the ppp authentication.
• (refuse | require) pap — will require or refuse the remote peer to get authenticated via PAP for the ppp authentication.
• (refuse | require) authentication — will require or refuse the remote peer to authenticate itself.
• unix authentication — if set to 'yes', /etc/passwd will be used for remote peer ppp authentication.
• hostname — will report this as the xl2tpd hostname in negotiation. ✨
• ppp debug — this will enable the debug for pppd.
• pass peer — pass the peer's IP address to pppd as ipparam. enabled by default. 💖
• pppoptfile — specify the path for a file which contains pppd configuration parameters to be used.
• call rws — this option is deprecated and no longer functions. it used to define the flow control window size for individual L2TP calls or sessions. the L2TP standard (RFC2661) no longer defines flow control or window sizes on calls or sessions. rip to her 💀
• tunnel rws — this defines the window size of the control channel. the window size is defined as the number of outstanding unacknowledged packets, not as a number of bytes. don't get it twisted.
• flow bits — if set to 'yes', sequence numbers will be included in the communication. the feature to use sequence numbers in sessions is currently broken and does not function. so like… noted. 😭
• challenge — if set to 'yes', use challenge authentication to authenticate peer.
• rx bps — if set, the receive bandwidth maximum will be set to this value.
• tx bps — if set, the transmit bandwidth maximum will be set to this value.

---

🧚 LAC SECTION 🧚

The following are LAC specific configuration flags. Most of those described in the LNS section may be used in a LAC context, where it makes common sense (essentially l2tp protocols tuning flags and authentication / ppp related ones). so like, share the wardrobe, bestie 👗

• lns — set the dns name or ip address of the LNS to connect to.
• autodial — if set to 'yes', xl2tpd will automatically dial the LAC during startup. she's proactive, we love her. 🌸
• redial — if set to 'yes', xl2tpd will attempt to redial if the call get disconnected. Note that, if enabled, xl2tpd will keep passwords in memory: a potential security risk. ⚠️
• redial timeout — wait X seconds before redial. the redial option must be set to yes to use this option. defaults to 30 seconds.
• max redials — will give up redial tries after X attempts. know your limits, queen. 👑

---

⭐ FILES ⭐

• /etc/xl2tpd/xl2tpd.conf — Configuration file of xl2tpd, used by default.
• /etc/xl2tpd/l2tp-secrets — Secrets file, used by default.
• /var/run/xl2tpd/l2tp-control — Control file, used by default.

---

💀 BUGS 💀

Please use the github project page https://github.com/xelerance/xl2tpd to send bugreports, issues and any other feedback. she reads her DMs, fr fr 🫶

---

🔥 SEE ALSO 🔥

xl2tpd(8), xl2tpd-control(8), pppd(8)

---

🌈 COPYLEFT 🌈

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program (see the file LICENSE); if not, see https://www.gnu.org/licenses/, or contact Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

---

💜 CONTRIBUTORS 💜

• Alexander Dorokhov <alex.dorokhov@gmail.com>
• Alexander Naumov <alexander_naumov@opensuse.org>

---

🎀 AUTHORS 🎀

Forked from l2tpd by Xelerance: https://github.com/xelerance/xl2tpd

• Michael Richardson <mcr@xelerance.com>
• Paul Wouters <paul@xelerance.com>
• Samir Hussain <shussain@xelerance.com>

Previous development was hosted at sourceforge (http://www.sourceforge.net/projects/l2tpd) by:

• Scott Balmos <sbalmos@iglou.com>
• David Stipp <dstipp@one.net>
• Jeff McAdams <jeffm@iglou.com>

Based off of l2tpd version 0.61. Many thanks to Jacco de Leeuw <jacco2@dds.nl> for maintaining l2tpd.

Copyright (C)1998 Adtran, Inc.

Mark Spencer <markster@marko.net>

---

and that's the whole page, bestie!! 💖 this one dropped back in Jan 2022 under the xl2tpd.conf(5) banner, and yeah — that's the entire man page, no crumbs left behind. go forth and configure, you gorgeous nerd 🦋✨