connection_name.config(5)

NAME
connection_name.config - ConnMan vpn connection provisioning file

SYNOPSIS
/var/lib/connman-vpn/connection-name.config

DESCRIPTION

ConnMan's vpn connections are configured with so called "provisioning files" which reside under /var/lib/connman-vpn/. The files can be named anything, as long as they contain only printable ascii characers, for example letters, numbers and underscores. The file must end with .config. Each VPN connection requires a provisioning file, but multiple connections can be specified in the same file.

FILE FORMAT

The configuration file format is key file format. It consists of sections (groups) of key-value pairs. Lines beginning with a '#' and blank lines are considered comments. Sections are started by a header line containing the section enclosed in '[' and ']', and ended implicitly by the start of the next section or the end of the file. Each key-value pair must be contained in a section.

Description of sections and available keys follows:

  [global]
This section is optional, and can be used to describe the actual file. The two allowed fields for this section are:

Name=name
    Name of the network.

Description=description
    Description of the network.

  [provider_*]
Each provisioned connection must start with a [provider_*] tag, with * replaced by an unique name within the file. The following fields are mandatory:

Type=OpenConnect | OpenVPN | VPNC | L2TP | PPTP
    Specifies the VPN type.

Host=IP
    VPN server IP address.

Domain=domain
    Domain name for the VPN service.

The following field is optional:

Networks=network/netmask/gateway[,...]
    Networks behind the VPN. If all traffic should go through the VPN, this field can be left out. The gateway can be left out. For IPv6 addresses, only the prefix length is accepted as the netmask.

  OpenConnect
The following keys can be used for openconnect(8) networks:

OpenConnect.ServerCert=cert
    SHA1 fingerprint of the VPN server's certificate.

OpenConnect.CACert=cert
    File containing additional CA certificates in addition to the system trusted certificate authorities.

OpenConnect.ClientCert=cert
    Client certificate, if needed by web authentication.

OpenConnect.MTU=mtu
    Request mtu from the server as the MTU of the tunnel.

OpenConnect.Cookie=cookie
    The resulting cookie of the authentication process. As the cookie lifetime can be very limited, it does not usually make sense to add it into the configuration file.

OpenConnect.VPNHost=host
    The final VPN server to use after completing the web authentication. Only usable for extremely simple VPN configurations and should normally be set only via the VPN Agent API.

If OpenConnect.Cookie, OpenConnect.VPNHost or OpenConnect.ServerCert are missing, the VPN Agent will be contacted to supply the information.

  OpenVPN
The following keys are mandatory for openvpn(8) networks:

OpenVPN.CACert=cert
    Certificate authority file.

OpenVPN.Cert=cert
    Local peer's signed certificate.

OpenVPN.Cert=cert
    Local peer's signed certificate.

OpenVPN.Key=key
    Local peer's private key.

The following keys are optional for openvpn(8) networks:

OpenVPN.MTU=mtu
    MTU of the tunnel.

OpenVPN.NSCertType=client | server
    Peer certificate type, either client or server.

OpenVPN.Protocol=protocol
    Use protocol.

OpenVPN.Port=port
    TCP/UDP port number.

OpenVPN.AuthUserPass=true | false
    Authenticate on the server using username/password.

OpenVPN.AskPass=file
    Get certificate password from file.

OpenVPN.AuthNoCache=true | false
    Don't cache AskPass or AuthUserPass value.

OpenVPN.TLSRemote=name
    Accept connections only from a host with X509 name or common name equal to name.

OpenVPN.TLSAuth=file
    Use file for HMAC authentication.

OpenVPN.TLSAuthDir=direction
    Use direction for HMAC authentication direction.

OpenVPN.Cipher=cipher
    Use cipher as the cipher.

OpenVPN.Auth=true | false
    Use HMAC authentication.

OpenVPN.CompLZO=yes | no | adaptive
    Use fast LZO compression.

OpenVPN.RemoteCertTls=client | server
    Require that remote certificate is signed based on RFC3280 TLS rules.

OpenVPN.ConfigFile=file
    OpenVPN config file for extra options not supported by the OpenVPN plugin.

OpenVPN.DeviceType=tun|tap
    Whether the VPN should use a tun (OSI layer 3) or tap (OSI layer 2) device. Defaults to tun if omitted.

  VPNC
The following key is mandatory for vpnc(8) networks:

VPNC.IPSec.ID=id
    Group username.

The following keys are optional for vpnc(8) networks:

VPNC.IPSec.Secret=secret
    Group password.

VPNC.XAuth.Username=username
    Username.

VPNC.XAuth.Password=password
    Password.

VPNC.IKE.Authmode=mode
    IKE authentication mode.

VPNC.IKE.DHGroup=group
    IKE DH group name.

VPNC.PFS=group
    Diffie-Hellman group for perfect forward secrecy.

VPNC.Domain=domain
    Domain name for authentication.

VPNC.Vendor=vendor
    Vendor of the IPSec gateway.

VPNC.LocalPort=port
    Local ISAKMP port number to use.

VPNC.CiscoPort=port
    Cisco UDP Encapsulation Port.

VPNC.AppVersion=version
    Application version to report.

VPNC.NATTMode=mode
    NAT-Traversal Method to use.

VPNC.DPDTimeout=timeout
    DPD idle timeout.

VPNC.SingleDES=true | false
    Enable single DES encryption.

VPNC.NoEncryption=true | false
    Enable usage of no encryption for data traffic.

VPNC.DeviceType=tun|tap
    Whether the VPN should use a tun (OSI layer 3) or tap (OSI layer 2) device. Defaults to tun if omitted.

  L2TP
The following keys are optional for l2tp (xl2tp.conf(5), pppd(8)) networks:

L2TP.User=user
    L2TP username.

L2TP.Password=password
    L2TP password.

L2TP.BPS=bps
    Max bandwidth to use.

L2TP.TXBPS=bps
    Max transmit bandwidth to use.

L2TP.RXBPS=bps
    Max receive bandwidth to use.

L2TP.LengthBit=yes | no
    Use length bit.

L2TP.Challenge=yes | no
    Use challenge authentication.

L2TP.DefaultRoute=route
    Add route to the routing tables.

L2TP.FlowBit=yes | no
    Use seq numbers.

L2TP.TunnelRWS=size
    Window size.

L2TP.Exclusive=yes | no
    Use only one control channel.

L2TP.Redial=yes | no
    Redial if disconnected.

L2TP.RedialTimeout=timeout
    Redial timeout.

L2TP.MaxRedials=count
    Maximum amount of redial tries.

L2TP.RequirePAP=yes | no
    Require PAP.

L2TP.RequireCHAP=yes | no
    Require CHAP.

L2TP.ReqAuth=yes | no
    Require authentication.

L2TP.AccessControl=yes | no
    Use access control.

L2TP.AuthFile=file
    Authentication file location.

L2TP.ListenAddr=address
    Listen address.

L2TP.IPSecSaref=yes | no
    Listen address.

L2TP.Port=port
    UDP port used.

PPPD.EchoFailure=count
    Echo failure count.

PPPD.EchoFailure=count
    Dead peer check count.

PPPD.EchoInterval=interval
    Dead peer check interval.

PPPD.Debug=level
    Debug level.

PPPD.RefuseEAP=true | false
    Refuse EAP authentication.

PPPD.RefusePAP=true | false
    Refuse PAP authentication.

PPPD.RefuseCHAP=true | false
    Refuse CHAP authentication.

PPPD.RefuseMSCHAP=true | false
    Refuse MSCHAP authentication.

PPPD.RefuseMSCHAP2=true | false
    Refuse MSCHAPv2 authentication.

PPPD.NoBSDComp=true | false
    Disable BSD compression.

PPPD.NoPcomp=true | false
    Disable protocol compression.

PPPD.UseAccomp=true | false
    Disable Access/Control compression.

PPPD.NoDeflate=true | false
    Disable deflate compression.

PPPD.ReqMPPE=true | false
    Require the use of MPPE.

PPPD.ReqMPPE40=true | false
    Require the use of MPPE 40 bit.

PPPD.ReqMPPE128=true | false
    Require the use of MPPE 128 bit.

PPPD.ReqMPPEStateful=true | false
    Allow MPPE to use stateful mode.

PPPD.NoVJ=true | false
    No Van Jacobson compression.

  PPTP
The following keys are optional for pptp(8) (see also pppd(8)) networks:

PPTP.User=username
    Username.

PPTP.Password=password
    Password.

PPPD.EchoFailure=count
    Echo failure count.

PPPD.EchoFailure=count
    Dead peer check count.

PPPD.EchoInterval=interval
    Dead peer check interval.

PPPD.Debug=level
    Debug level.

PPPD.RefuseEAP=true | false
    Refuse EAP authentication.

PPPD.RefusePAP=true | false
    Refuse PAP authentication.

PPPD.RefuseCHAP=true | false
    Refuse CHAP authentication.

PPPD.RefuseMSCHAP=true | false
    Refuse MSCHAP authentication.

PPPD.RefuseMSCHAP2=true | false
    Refuse MSCHAPv2 authentication.

PPPD.NoBSDComp=true | false
    Disable BSD compression.

PPPD.NoPcomp=true | false
    Disable protocol compression.

PPPD.UseAccomp=true | false
    Disable Access/Control compression.

PPPD.NoDeflate=true | false
    Disable deflate compression.

PPPD.ReqMPPE=true | false
    Require the use of MPPE.

PPPD.ReqMPPE40=true | false
    Require the use of MPPE 40 bit.

PPPD.ReqMPPE128=true | false
    Require the use of MPPE 128 bit.

PPPD.ReqMPPEStateful=true | false
    Allow MPPE to use stateful mode.

PPPD.NoVJ=true | false
    No Van Jacobson compression.

EXAMPLE
This is a configuration file for a VPN providing L2TP, OpenVPN and OpenConnect services. It could, for example, be in the file /var/lib/connman-vpn/example.config.

[global]
Name = Example
Description = Example VPN configuration

[provider_l2tp]
Type = L2TP
Name = Connection to corporate network
Host = 1.2.3.4
Domain = corporate.com
Networks = 10.10.30.0/24
L2TP.User = username

[provider_openconnect]
Type = OpenConnect
Name = Connection to corporate network using Cisco VPN
Host = 7.6.5.4
Domain = corporate.com
Networks = 10.10.20.0/255.255.255.0/10.20.1.5,192.168.99.1/24,2001:db8::1/64
OpenConnect.ServerCert = 263AFAB4CB2E6621D12E90182008AEF44AEFA031
OpenConnect.CACert = /etc/certs/certificate.p12

[provider_openvpn]
Type = OpenVPN
Name = Connection to corporate network using OpenVPN
Host = 3.2.5.6
Domain = my.home.network
OpenVPN.CACert = /etc/certs/cacert.pem
OpenVPN.Cert = /etc/certs/cert.pem
OpenVPN.Key = /etc/certs/cert.key

SEE ALSO
connmanctl(1), connman(8), connman-vpn(8)