UANYTUN(8)

🌸 NAME 🌸

uanytun — micro anycast tunneling daemon 💅 (yes bestie, that's the whole name, she's small but she's mighty)

---

✨ SYNOPSIS ✨

uanytun
  [ -h|--help ]
  [ -D|--nodaemonize ]
  [ -u|--username <username> ]
  [ -g|--groupname <groupname> ]
  [ -C|--chroot <path> ]
  [ -P|--write-pid <filename> ]
  [ -L|--log <target>:<level>[,<param1>[,<param2>[..]]] ]
  [ -U|--debug ]
  [ -i|--interface <ip-address> ]
  [ -p|--port <port> ]
  [ -r|--remote-host <hostname|ip> ]
  [ -o|--remote-port <port> ]
  [ -4|--ipv4-only ]
  [ -6|--ipv6-only ]
  [ -d|--dev <name> ]
  [ -t|--type <tun|tap> ]
  [ -n|--ifconfig <local>/<prefix> ]
  [ -x|--post-up-script <script> ]
  [ -m|--mux <mux-id> ]
  [ -s|--sender-id <sender id> ]
  [ -w|--window-size <window size> ]
  [ -k|--kd-prf <kd-prf type> ]
  [ -e|--role <role> ]
  [ -E|--passphrase <pass phrase> ]
  [ -K|--key <master key> ]
  [ -A|--salt <master salt> ]
  [ -c|--cipher <cipher type> ]
  [ -a|--auth-algo <algo type> ]
  [ -b|--auth-tag-length <length> ]

look at her. thirty-something flags and not one of them is filler. iconic behavior honestly 🎀

---

💜 DESCRIPTION 💜

okay so uAnytun is a tiny implementation of the Secure Anycast Tunneling Protocol — aka SATP, iykyk. She gives you a whole complete VPN solution, same energy as OpenVPN or IPsec in tunnel mode. 🫶

the main character difference? anycast ✨ it lets you set up tunnels between an arbitrary combination of anycast, unicast and multicast hosts. like, any combo. mix and match. slay.

now, unlike Anytun which is the full-featured implementation, uAnytun has no support for multiple connections or synchronisation. nope. not her thing. she's a small single threaded implementation whose whole purpose in life is to act as a client on small platforms. 💖 tiny queen energy.

---

🎀 OPTIONS 🎀

uAnytun was designed as a peer to peer application, so bestie — there is no difference between client and server. everybody's equal here. 🙌 the following options can be passed to the daemon:

• -D, --nodaemonize — tells uAnytun to run in the foreground instead of becoming a daemon. becoming a daemon is the default, so this is your "no bestie, stay here with me" flag 💅
• -u, --username <username> — run as this user. if no group is specified (-g) then the default group of the user gets used. default is to not drop privileges at all.
• -g, --groupname <groupname> — run as this group. ⚠️ if no username is specified (-u) this one just gets ignored. default is to not drop privileges.
• -C, --chroot <path> — instructs uAnytun to run in a chroot jail. default is to not run in chroot.
• -P, --write-pid <filename> — instructs uAnytun to write her pid to this file. 📝 default is to not create a pid file.
• -L, --log <target>:<level>[,<param1>[,<param2>[..]]] — adds a log target to the logging system. you can invoke this several times to log to different targets at the same time. every target has its own log level, which is a number between 0 and 5. where 0 means disabling log and 5 means debug messages are enabled.

the file target can be used more than once with different levels. if no target is provided at the command line, a single target with the config syslog:3,uanytun,daemon is added.

the following targets are supported:

• syslog — log to syslog daemon, parameters <level>[,<logname>[,<facility>]]
• file — log to file, parameters <level>[,<path>]
• stdout — log to standard output, parameters <level>
• stderr — log to standard error, parameters <level>

• -U, --debug — instructs uAnytun to run in debug mode. it implicits -D (don't daemonize, bestie) and adds a log target with the configuration stdout:5 (logging with maximum level 🔥). in future releases there might be additional output when this option is supplied. 👀
• -i, --interface <ip address> — this IP address is used as the sender address for outgoing packets. default is to not use a special interface and just bind on all interfaces.
• -p, --port <port> — the local UDP port used to send and receive the payload data. the two tunnel endpoints can use different ports. default: 4444
• -r, --remote-host <hostname|ip> — use this to specify the remote tunnel endpoint. in the case of anycast tunnel endpoints, you have to use the anycast IP address. if you don't specify an address, it is automatically determined after receiving the first data packet. 🦋
• -o, --remote-port <port> — the UDP port used for payload data by the remote host (specified with -p on the remote host, okurrr). if you don't specify a port, it is automatically determined after receiving the first data packet.
• -4, --ipv4-only — resolve to IPv4 addresses only. default is to resolve both IPv4 and IPv6 addresses.
• -6, --ipv6-only — resolve to IPv6 addresses only. default is to resolve both IPv4 and IPv6 addresses.
• -d, --dev <name> — device name.

by default, tapN is used for Ethernet tunnel interfaces, and tunN for IP tunnels, respectively. this option can be used to manually override these defaults. 💅

• -t, --type <tun|tap> — device type.

type of the tunnels to create. use tap for Ethernet tunnels, tun for IP tunnels.

• -n, --ifconfig <local>/<prefix> — the local IP address and prefix length. the remote tunnel endpoint has to use a different IP address in the same subnet.
  • <local> — the local IP address for the tun/tap device
  • <prefix> — the prefix length of the network
• -x, --post-up-script <script> — instructs uAnytun to run this script after the interface is created. by default no script will be executed.
• -m, --mux <mux-id> — the multiplex id to use. default: 0
• -s, --sender-id <sender id> — every anycast tunnel endpoint needs a unique sender id (1, 2, 3, ...). it's needed to distinguish the senders in case of replay attacks. but — and this is the tea 🍵 — since uAnytun doesn't support synchronisation, she can't be used as an anycast endpoint, so this option is quite useless, but it's implemented for compatibility reasons. default: 0
• -w, --window-size <window size> — sequence window size.

sometimes packets arrive out of order on the receiver side. this option defines the size of a list of received packets' sequence numbers. if, according to this list, a received packet has been previously received or has been transmitted in the past, and is therefore not in the list anymore, this is interpreted as a replay attack and the packet is dropped. a value of 0 deactivates this list and, as a consequence, the replay protection employed by filtering packets according to their sequence number. by default the sequence window is disabled and therefore a window size of 0 is used.

• -k, --kd-prf <kd-prf type> — key derivation pseudo random function.

the pseudo random function which is used for calculating the session keys and session salt.

possible values:

• null — no random function, keys and salt are set to 0..00
• aes-ctr — AES in counter mode with 128 Bits, default value
• aes-ctr-128 — AES in counter mode with 128 Bits
• aes-ctr-192 — AES in counter mode with 192 Bits
• aes-ctr-256 — AES in counter mode with 256 Bits

• -e, --role <role> — SATP uses different session keys for inbound and outbound traffic. the role parameter is used to determine which keys to use for outbound or inbound packets. on both sides of a vpn connection different roles have to be used. possible values are left and right. you may also use alice or server as a replacement for left, and bob or client as a replacement for right. by default left is used. 💖
• -E, --passphrase <pass phrase> — this passphrase is used to generate the master key and master salt. for the master key, the last n bits of the SHA256 digest of the passphrase are used (where n is the length of the master key in bits). the master salt gets generated with the SHA1 digest. you may force a specific key and/or salt by using --key and --salt. 🔐
• -K, --key <master key> — master key to use for key derivation.

master key in hexadecimal notation, e.g. 01a2b3c4d5e6f708a9b0cadbecfd0fa1, with a mandatory length of 32, 48 or 64 characters (128, 192 or 256 bits).

• -A, --salt <master salt> — master salt to use for key derivation.

master salt in hexadecimal notation, e.g. 01a2b3c4d5e6f708a9b0cadbecfd, with a mandatory length of 28 characters (14 bytes).

• -c, --cipher <cipher type> — payload encryption algorithm.

encryption algorithm used for encrypting the payload.

possible values:

• null — no encryption
• aes-ctr — AES in counter mode with 128 Bits, default value
• aes-ctr-128 — AES in counter mode with 128 Bits
• aes-ctr-192 — AES in counter mode with 192 Bits
• aes-ctr-256 — AES in counter mode with 256 Bits

• -a, --auth-algo <algo type> — message authentication algorithm.

this option sets the message authentication algorithm.

if HMAC-SHA1 is used, the packet length is increased. the additional bytes contain the authentication data. see --auth-tag-length for more info.

possible values:

• null — no message authentication
• sha1 — HMAC-SHA1, default value

• -b, --auth-tag-length <length> — the number of bytes to use for the auth tag. this value defaults to 10 bytes, unless the null auth algo is used, in which case it defaults to 0. 💅

---

🌈 EXAMPLES 🌈

🌸 P2P Setup between two unicast endpoints:

Host A:

uanytun -r hostb.example.com -t tun -n 192.168.123.1/30 -c
aes-ctr-256 -k aes-ctr-256 -E have_a_very_safe_and_productive_day -e
left

Host B:

uanytun -r hosta.example.com -t tun -n 192.168.123.2/30 -c
aes-ctr-256 -k aes-ctr-256 -E have_a_very_safe_and_productive_day -e
right

look at them. matching passphrases, opposite roles, living their best tunnel life. 🫶✨

🦋 One unicast and one anycast tunnel endpoint:

Unicast tunnel endpoint:

uanytun -r anycast.anytun.org -d anytun0 -t tun -n 192.0.2.2/30 -a
null -c null -w 0 -e client

Anycast tunnel endpoints:

as uAnytun can't work as an anycast endpoint she can't be used for this purpose. you have to use Anytun for that job. sorry bestie, that's just the rules. 😭

---

💀 BUGS 💀

most likely there are some bugs in uAnytun. 😭 if you find a bug, please let the developers know at uanytun@anytun.org. of course, patches are preferred. 👑

---

👑 AUTHORS 👑

Christian Pointner <equinox@anytun.org>

---

🌐 RESOURCES 🌐

main web site: http://www.anytun.org/ 🦋

🎀 COPYING 🎀

okay bestie, the legal tea ☕ — this is the part where the lawyers get their moment, and honestly? It's giving generous. 💖

Copyright (C) 2008-2014 Christian Pointner.

That's the human who made this whole thing. Respect the icon. 👑

And here's the actual licensing vibe, quoted so we don't mess with the words:

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or any later version.

Let's break that down because it slaps fr fr:

• free software — not "free" as in free samples at the mall, free as in you get the freedoms. 🦋
• you can redistribute it — share it with your friends, your group chat, your Discord server, whoever. 🫶
• and/or modify it — remix it, change it, make it yours. It's giving open source main character energy. ✨
• under the terms of the GNU General Public License — published by the Free Software Foundation. That's the rulebook, and it's written by the FSF. 💅
• either version 3 of the License, or any later version — so you get to pick: GPLv3, or literally anything newer that the FSF puts out. Your choice, bestie. 🌈

⚠️ Lowkey important: that's it for the license terms on this page. Don't skip the "as published by the Free Software Foundation" part and don't drop the version clause — the whole "or any later version" thing is the permission that makes remixing easy, and it only counts if you keep it attached. 🙈

No cap, that's the entire COPYING section. Short, sweet, and legally iconic. 💀🎀

---

and that's a wrap on UANYTUN(8)! 🌸 this page comes from the 06/08/2018 release, and yeah, the footer says UANYTUN(8) because that's the section it lives in. tysm for reading, go forth and tunnel responsibly 💖✨🎀