slawek
7cb2f1b8dd
Add platform = none as the shipped default so installing the package changes nothing on the machine until a platform is chosen. Add a mode setting (manual/interfaces/auto) controlling how much of the network configuration is supplied versus detected from the system. Manage /etc/vpn-router/vpn-router.conf with ucf instead of writing it once, so dpkg-reconfigure can safely reapply debconf answers without clobbering local edits. Extend NAT/forward rules to all local subnets, not just the first.
85 lines
3.0 KiB
Plaintext
85 lines
3.0 KiB
Plaintext
# Example vpn-router configuration.
|
|
#
|
|
# This file is documentation. The live configuration is
|
|
# /etc/vpn-router/vpn-router.conf, which is generated on first install and
|
|
# owned by the operator afterwards. Copy settings from here as needed.
|
|
#
|
|
# Format: INI. Lists are comma-separated, booleans are true/false, an empty
|
|
# value means unset, and a _b64 suffix means the value is base64-encoded.
|
|
#
|
|
# Comments start with # or ; and may follow a value on the same line. That
|
|
# means # and ; cannot appear inside a value - which is why the pre-shared
|
|
# key, the one setting that can hold arbitrary text, is base64-encoded.
|
|
#
|
|
# Apply any change with: systemctl restart vpn-router-setup
|
|
#
|
|
# Every feature is optional. A file with nothing filled in configures nothing
|
|
# and leaves the host reachable and unchanged.
|
|
|
|
[general]
|
|
# Platform: none, generic, azure or gcp.
|
|
# none - configuration is deferred. Files are installed and nothing on
|
|
# this machine is changed. Set a real platform when ready.
|
|
# generic - configure, with no platform-specific additions.
|
|
platform = none
|
|
|
|
# How much of the network configuration you supply, and therefore how much is
|
|
# read from the system:
|
|
# manual - interface names, int_addr and int_gateway_ip are all given
|
|
# below. Nothing is detected.
|
|
# interfaces - the two interface names are given; int_addr and
|
|
# int_gateway_ip are read from them.
|
|
# auto - nothing is given. The interfaces are identified from the
|
|
# routing table. Convenient, and able to get it wrong.
|
|
mode = manual
|
|
|
|
[interfaces]
|
|
# External faces the untrusted network; internal faces the protected one.
|
|
# Required in manual and interfaces mode; worked out for you in auto mode.
|
|
external =
|
|
internal =
|
|
|
|
[wan]
|
|
# This router's fully-qualified domain name.
|
|
local_fqdn =
|
|
# Source of the local IKE identity: fqdn | public_ip | internal_ip
|
|
# fqdn - use local_fqdn (must match what the peer expects)
|
|
# public_ip - resolve local_fqdn at boot and use the address
|
|
# internal_ip - use the address on the internal interface
|
|
local_id_mode = fqdn
|
|
|
|
[local]
|
|
# Local subnets advertised into the tunnel, comma-separated.
|
|
cidrs =
|
|
# This host's own address on the internal network, and the next hop on that
|
|
# side for the subnets above. Both are required in manual mode and read from
|
|
# the internal interface in the other two.
|
|
int_addr =
|
|
int_gateway_ip =
|
|
|
|
[remote]
|
|
# Remote gateway address(es) or FQDN, comma-separated.
|
|
addrs =
|
|
# Remote IKE identity, without a leading '@'.
|
|
id =
|
|
# Remote subnets reachable through the tunnel, comma-separated.
|
|
cidrs =
|
|
# Pre-shared key, base64-encoded: printf %s "$PSK" | base64 -w0
|
|
psk_b64 =
|
|
# Path to a file containing the raw PSK. Takes precedence over psk_b64.
|
|
psk_file =
|
|
|
|
[p2s]
|
|
# Road-warrior access.
|
|
enabled = false
|
|
# Address pool handed to road-warrior clients.
|
|
address_pool =
|
|
# CN for the CA created when /etc/vpn-router/pki is empty.
|
|
ca_name = VPN Router CA
|
|
|
|
[wireguard]
|
|
enabled = false
|
|
# Address and prefix length for wg0, for example 192.168.200.1/24.
|
|
address =
|
|
listen_port = 51820
|