Provided by: iwd_2.4-0ubuntu1_amd64 bug

NAME

       iwd.config - Configuration file for wireless daemon

SYNOPSIS

       Configuration file main.conf

DESCRIPTION

       The  main.conf  configuration file configures the system-wide settings for iwd.  This file
       lives  in  the   configuration   directory   specified   by   the   environment   variable
       $CONFIGURATION_DIRECTORY,  which  is normally provided by systemd.  In the absence of such
       an environment variable it defaults to /etc/iwd.  If no main.conf is present, then default
       values are chosen.  The presence of main.conf is not required.

FILE FORMAT

       See iwd.network for details on the file format.

SETTINGS

       The settings are split into several categories.  Each category has a group associated with
       it and described in separate tables below.

   General Settings
       The group [General] contains general settings.

                 ┌─────────────────────────────────┬──────────────────────────────────┐
                 │EnableNetworkConfiguration       │ Values: true, false              │
                 │                                 │                                  │
                 │                                 │ Enable network configuration.    │
                 │                                 │                                  │
                 │                                 │ Setting  this  option  to   true │
                 │                                 │ enables  iwd  to  configure  the │
                 │                                 │ network interfaces with  the  IP │
                 │                                 │ addresses.   There are two types │
                 │                                 │ IP addressing supported by  iwd: │
                 │                                 │ static  and dynamic.  The static │
                 │                                 │ IP  addresses   are   configured │
                 │                                 │ through        the       network │
                 │                                 │ configuration  files.    If   no │
                 │                                 │ static IP configuration has been │
                 │                                 │ provided for a network, iwd will │
                 │                                 │ attempt  to  obtain  the dynamic │
                 │                                 │ addresses   from   the   network │
                 │                                 │ through    the   built-in   DHCP │
                 │                                 │ client.                          │
                 │                                 │                                  │
                 │                                 │ This   also   enables    network │
                 │                                 │ configuration   and   the   DHCP │
                 │                                 │ server when in AP mode  and  the │
                 │                                 │ AP  profile being activated does │
                 │                                 │ not override it.                 │
                 │                                 │                                  │
                 │                                 │ The    network     configuration │
                 │                                 │ feature  is disabled by default. │
                 │                                 │ See   [Network]   settings   for │
                 │                                 │ additional  settings  related to │
                 │                                 │ network configuration.           │
                 └─────────────────────────────────┴──────────────────────────────────┘

                 │APRanges                         │ Values: <IP in prefix notation>  │
                 │                                 │                                  │
                 │                                 │ Sets the range of IP's used  for │
                 │                                 │ DHCP  server  (AP  mode). The IP │
                 │                                 │ should  be  in  prefix  notation │
                 │                                 │ e.g.  192.168.1.0/24. AP's which │
                 │                                 │ are started  in  a  profile-less │
                 │                                 │ configuration will use this pool │
                 │                                 │ of  IP's   to   set   the   AP's │
                 │                                 │ interface  address  as  well  as │
                 │                                 │ default  DHCP  server   options. │
                 │                                 │ Each  AP  will  get a new subnet │
                 │                                 │ from the range and clients  will │
                 │                                 │ be  addressed  in that subnet to │
                 │                                 │ avoid IP conflicts  if  multiple │
                 │                                 │ AP's are started.                │
                 ├─────────────────────────────────┼──────────────────────────────────┤
                 │UseDefaultInterface              │ Values: true, false              │
                 │                                 │                                  │
                 │                                 │ Do  not  allow  iwd to destroy / │
                 │                                 │ recreate wireless interfaces  at │
                 │                                 │ startup,    including    default │
                 │                                 │ interfaces.      Enable     this │
                 │                                 │ behavior  if  your wireless card │
                 │                                 │ driver  is  buggy  or  does  not │
                 │                                 │ allow  such  an operation, or if │
                 │                                 │ you do not want  iwd  to  manage │
                 │                                 │ netdevs for another reason.  For │
                 │                                 │ most  users  with  an   upstream │
                 │                                 │ driver  it  should  be  safe  to │
                 │                                 │ omit/disable this setting.       │
                 ├─────────────────────────────────┼──────────────────────────────────┤
                 │AddressRandomization             │ Values: disabled, once, network  │
                 │                                 │                                  │
                 │                                 │ If AddressRandomization  is  set │
                 │                                 │ to  disabled, the default kernel │
                 │                                 │ behavior is  used.   This  means │
                 │                                 │ the  kernel  will  assign  a mac │
                 │                                 │ address from the  permanent  mac │
                 │                                 │ address  range  provided  by the │
                 │                                 │ hardware / driver.  Thus  it  is │
                 │                                 │ possible  for  networks to track │
                 │                                 │ the  user  by  the  mac  address │
                 │                                 │ which is permanent.              │
                 │                                 │                                  │
                 │                                 │ If  AddressRandomization  is set │
                 │                                 │ to   once,   MAC   address    is │
                 │                                 │ randomized  a  single  time when │
                 │                                 │ iwd starts or when the  hardware │
                 │                                 │ is  detected  for the first time │
                 │                                 │ (due to hotplug, etc.)           │
                 │                                 │                                  │
                 │                                 │ If AddressRandomization  is  set │
                 │                                 │ to  network,  the MAC address is │
                 │                                 │ randomized on each connection to │
                 │                                 │ a  network. The MAC is generated │
                 │                                 │ based on the SSID and  permanent │
                 │                                 │ address  of  the  adapter.  This │
                 │                                 │ allows  the  same  MAC   to   be │
                 │                                 │ generated  each  time connecting │
                 │                                 │ to  a  given  SSID  while  still │
                 │                                 │ hiding the permanent address.    │
                 └─────────────────────────────────┴──────────────────────────────────┘

                 │AddressRandomizationRange        │ Values: full, nic                │
                 │                                 │                                  │
                 │                                 │ One  can  control  which part of │
                 │                                 │ the address is randomized  using │
                 │                                 │ this setting.                    │
                 │                                 │                                  │
                 │                                 │ When                       using │
                 │                                 │ AddressRandomizationRange set to │
                 │                                 │ nic,   only   the  NIC  specific │
                 │                                 │ octets  (last  3   octets)   are │
                 │                                 │ randomized.    Note   that   the │
                 │                                 │ randomization range  is  limited │
                 │                                 │ to  00:00:01  to  00:00:FE.  The │
                 │                                 │ permanent  mac  address  of  the │
                 │                                 │ card  is  used for the initial 3 │
                 │                                 │ octets.                          │
                 │                                 │                                  │
                 │                                 │ When                       using │
                 │                                 │ AddressRandomizationRange set to │
                 │                                 │ full,  all  6  octets   of   the │
                 │                                 │ address   are  randomized.   The │
                 │                                 │ locally-administered bit will be │
                 │                                 │ set.                             │
                 ├─────────────────────────────────┼──────────────────────────────────┤
                 │RoamThreshold                    │ Value: rssi dBm value, from -100 │
                 │                                 │ to 1, default: -70               │
                 │                                 │                                  │
                 │                                 │ This  value  can  be   used   to │
                 │                                 │ control   how  aggressively  iwd │
                 │                                 │ roams when connected to a 2.4Ghz │
                 │                                 │ access point.                    │
                 ├─────────────────────────────────┼──────────────────────────────────┤
                 │RoamThreshold5G                  │ Value: rssi dBm value, from -100 │
                 │                                 │ to 1, default: -76               │
                 │                                 │                                  │
                 │                                 │ This  value  can  be   used   to │
                 │                                 │ control   how  aggressively  iwd │
                 │                                 │ roams when connected to  a  5GHz │
                 │                                 │ access point.                    │
                 ├─────────────────────────────────┼──────────────────────────────────┤
                 │RoamRetryInterval                │ Value:  unsigned  int  value  in │
                 │                                 │ seconds (default: 60)            │
                 │                                 │                                  │
                 │                                 │ Specifies how long iwd will wait │
                 │                                 │ before  attempting to roam again │
                 │                                 │ if the last roam attempt failed, │
                 │                                 │ or  if  the  signal of the newly │
                 │                                 │ connected    BSS    is     still │
                 │                                 │ considered weak.                 │
                 └─────────────────────────────────┴──────────────────────────────────┘

                 │ManagementFrameProtection        │ Values: 0, 1 or 2                │
                 │                                 │                                  │
                 │                                 │ When   ManagementFrameProtection │
                 │                                 │ is 0, MFP is  completely  turned │
                 │                                 │ off,  even  if  the  hardware is │
                 │                                 │ capable.  This  setting  is  not │
                 │                                 │ recommended.                     │
                 │                                 │                                  │
                 │                                 │ When   ManagementFrameProtection │
                 │                                 │ is 1,  MFP  is  enabled  if  the │
                 │                                 │ local  hardware  and  remote  AP │
                 │                                 │ both support it.                 │
                 │                                 │                                  │
                 │                                 │ When   ManagementFrameProtection │
                 │                                 │ is  2,  MFP  is always required. │
                 │                                 │ This  can   prevent   successful │
                 │                                 │ connection establishment on some │
                 │                                 │ hardware or to some networks.    │
                 ├─────────────────────────────────┼──────────────────────────────────┤
                 │ControlPortOverNL80211           │ Values: false, true              │
                 │                                 │                                  │
                 │                                 │ Enable/Disable   sending   EAPoL │
                 │                                 │ packets  over  NL80211.  Enabled │
                 │                                 │ by default if kernel support  is │
                 │                                 │ available.   Doing  so sends all │
                 │                                 │ EAPoL traffic over  directly  to │
                 │                                 │ the   supplicant  process  (iwd) │
                 │                                 │ instead of putting these on  the │
                 │                                 │ Ethernet device.  Since only the │
                 │                                 │ supplicant  can   usually   make │
                 │                                 │ sense  /  decrypt these packets, │
                 │                                 │ enabling this  option  can  save │
                 │                                 │ some  CPU  cycles on your system │
                 │                                 │ and avoids certain long-standing │
                 │                                 │ race conditions.                 │
                 ├─────────────────────────────────┼──────────────────────────────────┤
                 │DisableANQP                      │ Values: false, true              │
                 │                                 │                                  │
                 │                                 │ Enable/disable ANQP queries. The │
                 │                                 │ way IWD  does  ANQP  queries  is │
                 │                                 │ dependent  on  a  recent  kernel │
                 │                                 │ patch (available in Kernel 5.3). │
                 │                                 │ If  your  kernel  does  not have │
                 │                                 │ this functionality  this  should │
                 │                                 │ be   disabled  (default).   Some │
                 │                                 │ drivers also do a  terrible  job │
                 │                                 │ of  sending public action frames │
                 │                                 │ (freezing or crashes)  which  is │
                 │                                 │ another reason why this has been │
                 │                                 │ turned off by default.   If  you │
                 │                                 │ want  to  easily utilize Hotspot │
                 │                                 │ 2.0   networks,   then   setting │
                 │                                 │ DisableANQP    to    false    is │
                 │                                 │ recommended.                     │
                 ├─────────────────────────────────┼──────────────────────────────────┤
                 │DisableOCV                       │ Value: false, true               │
                 │                                 │                                  │
                 │                                 │ Disable    Operating     Channel │
                 │                                 │ Validation.  Support for this is │
                 │                                 │ not advertised by the kernel  so │
                 │                                 │ if  kernels/drivers  exist which │
                 │                                 │ don't  support  OCV  it  can  be │
                 │                                 │ disabled here.                   │
                 └─────────────────────────────────┴──────────────────────────────────┘

                 │SystemdEncrypt                   │ Value: Systemd key ID            │
                 │                                 │                                  │
                 │Warning:   This   is   a  highly │ Enables     network      profile │
                 │experimental feature             │ encryption   using   a   systemd │
                 │                                 │ provided   secret   key.    Once │
                 │                                 │ enabled  all  PSK/8021x  network │
                 │                                 │ profiles   will   be   encrypted │
                 │                                 │ automatically.  Once the profile │
                 │                                 │ is encrypted there is no way  of │
                 │                                 │ going  back  using  IWD alone. A │
                 │                                 │ tool,  iwd-decrypt-profile,   is │
                 │                                 │ provided  assuming the secret is │
                 │                                 │ known  which  will   decrypt   a │
                 │                                 │ profile.  This decrypted profile │
                 │                                 │ could   manually   be   set   to │
                 │                                 │ /var/lib/iwd   to   'undo'   any │
                 │                                 │ profile  encryption,   but   its │
                 │                                 │ going to be a manual process.    │
                 │                                 │                                  │
                 │                                 │ Setting  up  systemd  to provide │
                 │                                 │ the secret is  left  up  to  the │
                 │                                 │ user   as  IWD  has  no  way  of │
                 │                                 │ performing  this  automatically. │
                 │                                 │ The systemd options required are │
                 │                                 │ LoadCredentialEncrypted       or │
                 │                                 │ SetCredentialEncrypted,  and the │
                 │                                 │ secret  identifier   should   be │
                 │                                 │ named whatever SystemdEncrypt is │
                 │                                 │ set to.                          │
                 ├─────────────────────────────────┼──────────────────────────────────┤
                 │Country                          │ Value:   Country    Code    (ISO │
                 │                                 │ Alpha-2)                         │
                 │                                 │                                  │
                 │                                 │ Requests  the country be set for │
                 │                                 │ the system.  Note  that  setting │
                 │                                 │ this  is simply a request to set │
                 │                                 │ the  country,   and   does   not │
                 │                                 │ guarantee  the  country  will be │
                 │                                 │ set. For a self-managed wiphy it │
                 │                                 │ is  never  possible  to  set the │
                 │                                 │ country  from   userspace.   For │
                 │                                 │ other   devices  any  regulatory │
                 │                                 │ domain request is just a  'hint' │
                 │                                 │ and  ultimately  left  up to the │
                 │                                 │ kernel to set the country.       │
                 └─────────────────────────────────┴──────────────────────────────────┘

   Network
       The group [Network] contains network configuration related settings.

                       ┌─────────────────────┬──────────────────────────────────┐
                       │EnableIPv6           │ Values: true, false              │
                       │                     │                                  │
                       │                     │ Sets  the  global  default  that │
                       │                     │ tells   iwd  whether  it  should │
                       │                     │ configure  IPv6  addresses   and │
                       │                     │ routes   (either   provided  via │
                       │                     │ static     settings,      Router │
                       │                     │ Advertisements     or     DHCPv6 │
                       │                     │ protocol).   This   setting   is │
                       │                     │ enabled    by   default.    This │
                       │                     │ setting can also  be  overridden │
                       │                     │ on a per-network basis.          │
                       └─────────────────────┴──────────────────────────────────┘

                       │NameResolvingService │ Values:   resolvconf,   systemd, │
                       │                     │ none                             │
                       │                     │                                  │
                       │                     │ Configures  a   DNS   resolution │
                       │                     │ method used by the system.       │
                       │                     │                                  │
                       │                     │ This  configuration  option must │
                       │                     │ be  used  in  conjunction   with │
                       │                     │ EnableNetworkConfiguration   and │
                       │                     │ provides the  choice  of  system │
                       │                     │ resolver integration.            │
                       │                     │                                  │
                       │                     │ If  not  specified,  systemd  is │
                       │                     │ used as default.                 │
                       │                     │                                  │
                       │                     │ If none is specified,  then  DNS │
                       │                     │ and  domain  name information is │
                       │                     │ ignored.                         │
                       ├─────────────────────┼──────────────────────────────────┤
                       │RoutePriorityOffset  │ Values: uint32  value  (default: │
                       │                     │ 300)                             │
                       │                     │                                  │
                       │                     │ Configures   a   route  priority │
                       │                     │ offset used  by  the  system  to │
                       │                     │ prioritize  the  default routes. │
                       │                     │ The route  with  lower  priority │
                       │                     │ offset is preferred.             │
                       │                     │                                  │
                       │                     │ If not specified, 300 is used as │
                       │                     │ default.                         │
                       └─────────────────────┴──────────────────────────────────┘

   Blacklist
       The group [Blacklist]  contains  settings  related  to  blacklisting  of  BSSes.   If  iwd
       determines  that  a  connection  to  a  BSS  fails  for a reason that indicates the BSS is
       currently misbehaving or misconfigured (e.g.  timeouts,  unexpected  status/reason  codes,
       etc),  then  iwd  will blacklist this BSS and avoid connecting to it for a period of time.
       These options let the user control how long a misbehaved BSS spends on the blacklist.

                          ┌───────────────┬──────────────────────────────────┐
                          │InitialTimeout │ Values: uint64 value in  seconds │
                          │               │ (default: 60)                    │
                          │               │                                  │
                          │               │ The  initial  time  that  a  BSS │
                          │               │ spends on the blacklist.         │
                          ├───────────────┼──────────────────────────────────┤
                          │Multiplier     │ Values: unsigned  int  value  in │
                          │               │ seconds (default: 30)            │
                          │               │                                  │
                          │               │ If   the   BSS  was  blacklisted │
                          │               │ previously      and      another │
                          │               │ connection  attempt  has  failed │
                          │               │ after the  initial  timeout  has │
                          │               │ expired,  then the BSS blacklist │
                          │               │ time  will  be  extended  by   a │
                          │               │ multiple  of Multiplier for each │
                          │               │ unsuccessful   attempt   up   to │
                          │               │ MaxiumTimeout time in seconds.   │
                          ├───────────────┼──────────────────────────────────┤
                          │MaximumTimeout │ Values:  uint64 value in seconds │
                          │               │ (default: 86400)                 │
                          │               │                                  │
                          │               │ Maximum  time  that  a  BSS   is │
                          │               │ blacklisted.                     │
                          └───────────────┴──────────────────────────────────┘

   Rank
       The  group  [Rank]  contains  settings  related  to  ranking  of  networks for autoconnect
       purposes.

                         ┌─────────────────┬──────────────────────────────────┐
                         │BandModifier5Ghz │ Values:  floating  point   value │
                         │                 │ (default: 1.0)                   │
                         │                 │                                  │
                         │                 │ Increase    or    decrease   the │
                         │                 │ preference   for   5GHz   access │
                         │                 │ points    by    increasing    or │
                         │                 │ decreasing  the  value  of  this │
                         │                 │ modifier.    5GHz  networks  are │
                         │                 │ already preferred due  to  their │
                         │                 │ increase throughput / data rate. │
                         │                 │ However,   5GHz   networks   are │
                         │                 │ highly  RSSI sensitive, so it is │
                         │                 │ still possible for IWD to prefer │
                         │                 │ 2.4Ghz     APs     in    certain │
                         │                 │ circumstances.                   │
                         ├─────────────────┼──────────────────────────────────┤
                         │BandModifier6Ghz │ Values:  floating  point   value │
                         │                 │ (default: 1.0)                   │
                         │                 │                                  │
                         │                 │ Increase    or    decrease   the │
                         │                 │ preference   for   6GHz   access │
                         │                 │ points    by    increasing    or │
                         │                 │ decreasing  the  value  of  this │
                         │                 │ modifier.   Since  6GHz networks │
                         │                 │ are highly RSSI sensitive,  this │
                         │                 │ gives  an  option to prefer 6GHz │
                         │                 │ APs over 5GHz APs.               │
                         └─────────────────┴──────────────────────────────────┘

   Scan
       The group [Scan] contains settings related to  scanning  functionality.   No  modification
       from defaults is normally required.

                    ┌────────────────────────────┬──────────────────────────────────┐
                    │DisablePeriodicScan         │ Values: true, false              │
                    │                            │                                  │
                    │                            │ Disable  periodic  scan. Setting │
                    │                            │ this  option  to   'true'   will │
                    │                            │ prevent  iwd  from  issuing  the │
                    │                            │ periodic scans for the available │
                    │                            │ networks   while   disconnected. │
                    │                            │ The     behavior     of      the │
                    │                            │ user-initiated    scans    isn't │
                    │                            │ affected.  The periodic scan  is │
                    │                            │ enabled by default.              │
                    ├────────────────────────────┼──────────────────────────────────┤
                    │InitialPeriodicScanInterval │ Values:  unsigned  int  value in │
                    │                            │ seconds (default: 10)            │
                    │                            │                                  │
                    │                            │ The   initial   periodic    scan │
                    │                            │ interval upon disconnect.        │
                    ├────────────────────────────┼──────────────────────────────────┤
                    │MaximumPeriodicScanInterval │ Values:  unsigned  int  value in │
                    │                            │ seconds (default: 300)           │
                    │                            │                                  │
                    │                            │ The   maximum   periodic    scan │
                    │                            │ interval.                        │
                    └────────────────────────────┴──────────────────────────────────┘

                    │DisableRoamingScan          │ Values: true, false              │
                    │                            │                                  │
                    │                            │ Disable  roaming  scan.  Setting │
                    │                            │ this  option  to   'true'   will │
                    │                            │ prevent  iwd from trying to scan │
                    │                            │ when   roaming   decisions   are │
                    │                            │ activated.  This can prevent iwd │
                    │                            │ from roaming properly,  but  can │
                    │                            │ be useful for networks operating │
                    │                            │ under extremely low rssi  levels │
                    │                            │ where roaming isn't possible.    │
                    └────────────────────────────┴──────────────────────────────────┘

   IPv4
       The group [IPv4] contains settings related to IPv4 network configuration.

                           ┌──────────────┬──────────────────────────────────┐
                           │APAddressPool │ Values:  comma-separated list of │
                           │              │ prefix-notation IP strings       │
                           │              │                                  │
                           │              │ Defines the space  of  IPs  used │
                           │              │ for the Access Point-mode subnet │
                           │              │ addresses and the  DHCP  server. │
                           │              │ Defaults to 192.168.0.0/16.  The │
                           │              │ prefix length decides  the  size │
                           │              │ of   the   pool  from  which  an │
                           │              │ address  is  selected  but   the │
                           │              │ actual  subnet size (netmask) is │
                           │              │ based on the  AP  profile  being │
                           │              │ activated  and  defaults  to  28 │
                           │              │ bits.     The    AP    profile's │
                           │              │ [IPv4].Address setting overrides │
                           │              │ the  global  value   set   here. │
                           │              │ Setting   a  too  small  address │
                           │              │ space will limit the  number  of │
                           │              │ access   points   that   can  be │
                           │              │ running    simultaneously     on │
                           │              │ different interfaces.            │
                           └──────────────┴──────────────────────────────────┘

SEE ALSO

       iwd(8), iwd.network(5)

AUTHOR

       Marcel   Holtmann   <marcel@holtmann.org>,   Denis   Kenzior  <denkenz@gmail.com>,  Andrew
       Zaborowski <andrew.zaborowski@intel.com>, Tim Kourt  <tim.a.kourt@linux.intel.com>,  James
       Prestwood <prestwoj@gmail.com>

COPYRIGHT

       2013-2019 Intel Corporation