# setup-retries max retransmits of a key setup packet
# setup-timeout wait between retransmits of key setup packets, in ms
# wait-time wait between unsuccessful key setup attempts, in ms
+# renegotiate-time set up a new key if we see any traffic after this time
# Use the universal TUN/TAP driver to get packets to and from the kernel
+# (use tun-old if you are not on Linux-2.4)
netlink tun {
name "netlink-tun"; # Printed in log messages from this netlink
# interface "tun0"; # You may set your own interface name if you wish;
};
# log is defined earlier - we share it with the system
-log-events "init","up","down"; # XXX not yet used
+log-events "setup-init","setup-timeout","activate-key","timeout-key","errors",
+ "security";
# A source of random bits for nonces and session keys. The 'no' specifies
# that it's non-blocking. XXX 'yes' isn't implemented yet.
max-sequence-skew 10;
};
-include /etc/secnet/sites
+include /etc/secnet/sites.conf
# Here you must list all the VPN sites that you wish to communicate with.
# The /etc/secnet/sites file contains information on all reachable sites;
# contains public keys for all sites.
sites
- site(example-vpn/some-site),
- site(example-vpn/some-other-site),
- site(example-vpn/a-third-site);
+ site(vpn-data/example/location1/site1),
+ site(vpn-data/example/location2/site1),
+ site(vpn-data/example/location2/site2);
+
+# If you want to communicate with all the VPN sites, you can use something
+# like the following instead:
+
+# sites map(site,vpn/example/all-sites);
+
+# If you want to communicate with a subset of locations, try the following:
+
+# sites map(site,vpn/example/location1,vpn/example/location2);