Provided by: connman_1.41-2_amd64 
NAME
connection_name.config - ConnMan vpn connection provisioning file
SYNOPSIS
/var/lib/connman-vpn/connection-name.config
DESCRIPTION
ConnMan's vpn connections are configured with so called "provisioning files" which reside
under /var/lib/connman-vpn/. The files can be named anything, as long as they contain
only printable ascii characters, for example letters, numbers and underscores. The file
must end with .config. Each VPN connection requires a provisioning file, but multiple
connections can be specified in the same file.
FILE FORMAT
The configuration file consists of sections (groups) of key-value pairs. Lines beginning
with a '#' and blank lines are considered comments. Sections are started by a header line
containing the section enclosed in '[' and ']', and ended implicitly by the start of the
next section or the end of the file. Each key-value pair must be contained in a section.
Description of sections and available keys follows:
[global]
This section is optional, and can be used to describe the actual file. The two allowed
fields for this section are:
Name=name
Name of the network.
Description=description
Description of the network.
[provider_*]
Each provisioned connection must start with a [provider_*] tag, with * replaced by an
unique name within the file. The following fields are mandatory:
Type=OpenConnect | OpenVPN | VPNC | L2TP | PPTP
Specifies the VPN type.
Host=IP
VPN server IP address.
Domain=domain
Domain name for the VPN service.
The following field is optional:
Networks=network/netmask/gateway[,...]
Networks behind the VPN. If all traffic should go through the VPN, this field can
be left out. The gateway can be left out. For IPv6 addresses, only the prefix
length is accepted as the netmask.
OpenConnect
The following keys can be used for openconnect(8) networks:
OpenConnect.ServerCert=cert
SHA1 fingerprint of the VPN server's certificate.
OpenConnect.CACert=cert
File containing additional CA certificates in addition to the system trusted
certificate authorities.
OpenConnect.ClientCert=cert
Client certificate, if needed by web authentication.
OpenConnect.MTU=mtu
Request mtu from the server as the MTU of the tunnel.
OpenConnect.Cookie=cookie
The resulting cookie of the authentication process. As the cookie lifetime can be
very limited, it does not usually make sense to add it into the configuration file.
OpenConnect.VPNHost=host
The final VPN server to use after completing the web authentication. Only usable
for extremely simple VPN configurations and should normally be set only via the VPN
Agent API.
If OpenConnect.Cookie, OpenConnect.VPNHost or OpenConnect.ServerCert are missing, the VPN
Agent will be contacted to supply the information.
OpenVPN
The following keys are mandatory for openvpn(8) networks:
OpenVPN.CACert=cert
Certificate authority file.
OpenVPN.Cert=cert
Local peer's signed certificate.
OpenVPN.Cert=cert
Local peer's signed certificate.
OpenVPN.Key=key
Local peer's private key.
The following keys are optional for openvpn(8) networks:
OpenVPN.MTU=mtu
MTU of the tunnel.
OpenVPN.NSCertType=client | server
Peer certificate type, either client or server.
OpenVPN.Proto=protocol
Use protocol.
OpenVPN.Port=port
TCP/UDP port number.
OpenVPN.AuthUserPass=true | false
Authenticate on the server using username/password.
OpenVPN.AskPass=file
Get certificate password from file.
OpenVPN.AuthNoCache=true | false
Don't cache AskPass or AuthUserPass value.
OpenVPN.TLSRemote=name
Accept connections only from a host with X509 name or common name equal to name.
OpenVPN.TLSAuth=file
Use file for HMAC authentication.
OpenVPN.TLSAuthDir=direction
Use direction for HMAC authentication direction.
OpenVPN.Cipher=cipher
Use cipher as the cipher.
OpenVPN.Auth=true | false
Use HMAC authentication.
OpenVPN.CompLZO=yes | no | adaptive
Use fast LZO compression.
OpenVPN.RemoteCertTls=client | server
Require that remote certificate is signed based on RFC3280 TLS rules.
OpenVPN.ConfigFile=file
OpenVPN config file for extra options not supported by the OpenVPN plugin.
OpenVPN.DeviceType=tun|tap
Whether the VPN should use a tun (OSI layer 3) or tap (OSI layer 2) device.
Defaults to tun if omitted.
VPNC
The following key is mandatory for vpnc(8) networks:
VPNC.IPSec.ID=id
Group username.
The following keys are optional for vpnc(8) networks:
VPNC.IPSec.Secret=secret
Group password.
VPNC.XAuth.Username=username
Username.
VPNC.XAuth.Password=password
Password.
VPNC.IKE.Authmode=mode
IKE authentication mode.
VPNC.IKE.DHGroup=group
IKE DH group name.
VPNC.PFS=group
Diffie-Hellman group for perfect forward secrecy.
VPNC.Domain=domain
Domain name for authentication.
VPNC.Vendor=vendor
Vendor of the IPSec gateway.
VPNC.LocalPort=port
Local ISAKMP port number to use.
VPNC.CiscoPort=port
Cisco UDP Encapsulation Port.
VPNC.AppVersion=version
Application version to report.
VPNC.NATTMode=mode
NAT-Traversal Method to use.
VPNC.DPDTimeout=timeout
DPD idle timeout.
VPNC.SingleDES=true | false
Enable single DES encryption.
VPNC.NoEncryption=true | false
Enable usage of no encryption for data traffic.
VPNC.DeviceType=tun|tap
Whether the VPN should use a tun (OSI layer 3) or tap (OSI layer 2) device.
Defaults to tun if omitted.
L2TP
The following keys are optional for l2tp (xl2tp.conf(5), pppd(8)) networks:
L2TP.User=user
L2TP username.
L2TP.Password=password
L2TP password.
L2TP.BPS=bps
Max bandwidth to use.
L2TP.TXBPS=bps
Max transmit bandwidth to use.
L2TP.RXBPS=bps
Max receive bandwidth to use.
L2TP.LengthBit=yes | no
Use length bit.
L2TP.Challenge=yes | no
Use challenge authentication.
L2TP.DefaultRoute=route
Add route to the routing tables.
L2TP.FlowBit=yes | no
Use seq numbers.
L2TP.TunnelRWS=size
Window size.
L2TP.Exclusive=yes | no
Use only one control channel.
L2TP.Redial=yes | no
Redial if disconnected.
L2TP.RedialTimeout=timeout
Redial timeout.
L2TP.MaxRedials=count
Maximum amount of redial tries.
L2TP.RequirePAP=yes | no
Require PAP.
L2TP.RequireCHAP=yes | no
Require CHAP.
L2TP.ReqAuth=yes | no
Require authentication.
L2TP.AccessControl=yes | no
Use access control.
L2TP.AuthFile=file
Authentication file location.
L2TP.ListenAddr=address
Listen address.
L2TP.IPSecSaref=yes | no
Listen address.
L2TP.Port=port
UDP port used.
PPPD.EchoFailure=count
Echo failure count.
PPPD.EchoFailure=count
Dead peer check count.
PPPD.EchoInterval=interval
Dead peer check interval.
PPPD.Debug=level
Debug level.
PPPD.RefuseEAP=true | false
Refuse EAP authentication.
PPPD.RefusePAP=true | false
Refuse PAP authentication.
PPPD.RefuseCHAP=true | false
Refuse CHAP authentication.
PPPD.RefuseMSCHAP=true | false
Refuse MSCHAP authentication.
PPPD.RefuseMSCHAP2=true | false
Refuse MSCHAPv2 authentication.
PPPD.NoBSDComp=true | false
Disable BSD compression.
PPPD.NoPcomp=true | false
Disable protocol compression.
PPPD.UseAccomp=true | false
Disable Access/Control compression.
PPPD.NoDeflate=true | false
Disable deflate compression.
PPPD.ReqMPPE=true | false
Require the use of MPPE.
PPPD.ReqMPPE40=true | false
Require the use of MPPE 40 bit.
PPPD.ReqMPPE128=true | false
Require the use of MPPE 128 bit.
PPPD.ReqMPPEStateful=true | false
Allow MPPE to use stateful mode.
PPPD.NoVJ=true | false
No Van Jacobson compression.
PPTP
The following keys are optional for pptp(8) (see also pppd(8)) networks:
PPTP.User=username
Username.
PPTP.Password=password
Password.
PPPD.EchoFailure=count
Echo failure count.
PPPD.EchoFailure=count
Dead peer check count.
PPPD.EchoInterval=interval
Dead peer check interval.
PPPD.Debug=level
Debug level.
PPPD.RefuseEAP=true | false
Refuse EAP authentication.
PPPD.RefusePAP=true | false
Refuse PAP authentication.
PPPD.RefuseCHAP=true | false
Refuse CHAP authentication.
PPPD.RefuseMSCHAP=true | false
Refuse MSCHAP authentication.
PPPD.RefuseMSCHAP2=true | false
Refuse MSCHAPv2 authentication.
PPPD.NoBSDComp=true | false
Disable BSD compression.
PPPD.NoPcomp=true | false
Disable protocol compression.
PPPD.UseAccomp=true | false
Disable Access/Control compression.
PPPD.NoDeflate=true | false
Disable deflate compression.
PPPD.ReqMPPE=true | false
Require the use of MPPE.
PPPD.ReqMPPE40=true | false
Require the use of MPPE 40 bit.
PPPD.ReqMPPE128=true | false
Require the use of MPPE 128 bit.
PPPD.ReqMPPEStateful=true | false
Allow MPPE to use stateful mode.
PPPD.NoVJ=true | false
No Van Jacobson compression.
EXAMPLE
This is a configuration file for a VPN providing L2TP, OpenVPN and OpenConnect services.
It could, for example, be in the file /var/lib/connman-vpn/example.config.
[global]
Name = Example
Description = Example VPN configuration
[provider_l2tp]
Type = L2TP
Name = Connection to corporate network
Host = 1.2.3.4
Domain = corporate.com
Networks = 10.10.30.0/24
L2TP.User = username
[provider_openconnect]
Type = OpenConnect
Name = Connection to corporate network using Cisco VPN
Host = 7.6.5.4
Domain = corporate.com
Networks = 10.10.20.0/255.255.255.0/10.20.1.5,192.168.99.1/24,2001:db8::1/64
OpenConnect.ServerCert = 263AFAB4CB2E6621D12E90182008AEF44AEFA031
OpenConnect.CACert = /etc/certs/certificate.p12
[provider_openvpn]
Type = OpenVPN
Name = Connection to corporate network using OpenVPN
Host = 3.2.5.6
Domain = my.home.network
OpenVPN.CACert = /etc/certs/cacert.pem
OpenVPN.Cert = /etc/certs/cert.pem
OpenVPN.Key = /etc/certs/cert.key
SEE ALSO
connmanctl(1), connman(8), connman-vpn(8)
2015-10-15 connection_name.config(5)