Settings stored persistently using QSettings.

[openvpnui.git] / OpenVPN-help.txt

--dev tun
--proto udp
--remote www.flypig.org.uk 1194
--resolv-retry infinite
--nobind
--user nemo
--group nemo
--persist-key
--persist-tun
--ca "/home/flypig/Documents/Configure/OpenVPN/ca.crt"
--cert "/home/flypig/Documents/Configure/OpenVPN/Montefalco.crt"
--key "/home/flypig/Documents/Configure/OpenVPN/Montefalco.key"
--tls-auth "/home/flypig/Documents/Configure/OpenVPN/ta.key" 1
--comp-lzo
--mute 20


OpenVPN 2.2.2 armv7l-unknown-linux-gnueabi [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Jan 20 2014

General Options:
--config file   : Read configuration options from file.
--help          : Show options.
--version       : Show copyright and version information.

Tunnel Options:
--local host    : Local host name or ip address. Implies --bind.
--remote host [port] : Remote host name or ip address.
--remote-random : If multiple --remote options specified, choose one randomly.
--remote-random-hostname : Add a random string to remote DNS name.
--mode m        : Major mode, m = 'p2p' (default, point-to-point) or 'server'.
--proto p       : Use protocol p for communicating with peer.
                  p = udp (default), tcp-server, or tcp-client
--proto-force p : only consider protocol p in list of connection profiles.
--connect-retry n : For --proto tcp-client, number of seconds to wait
                    between connection retries (default=5).
--connect-timeout n : For --proto tcp-client, connection timeout (in seconds).
--connect-retry-max n : Maximum connection attempt retries, default infinite.
--auto-proxy    : Try to sense proxy settings (or lack thereof) automatically.
--show-proxy-settings : Show sensed proxy settings.
--http-proxy s p [up] [auth] : Connect to remote host
                  through an HTTP proxy at address s and port p.
                  If proxy authentication is required,
                  up is a file containing username/password on 2 lines, or
                  'stdin' to prompt from console.  Add auth='ntlm' if
                  the proxy requires NTLM authentication.
--http-proxy s p 'auto[-nct]' : Like the above directive, but automatically
                  determine auth method and query for username/password
                  if needed.  auto-nct disables weak proxy auth methods.
--http-proxy-retry     : Retry indefinitely on HTTP proxy errors.
--http-proxy-timeout n : Proxy timeout in seconds, default=5.
--http-proxy-option type [parm] : Set extended HTTP proxy options.
                                  Repeat to set multiple options.
                  VERSION version (default=1.0)
                  AGENT user-agent
--socks-proxy s [p] [up] : Connect to remote host through a Socks5 proxy at
                  address s and port p (default port = 1080).
                  If proxy authentication is required,
                  up is a file containing username/password on 2 lines, or
                  'stdin' to prompt for console.
--socks-proxy-retry : Retry indefinitely on Socks proxy errors.
--resolv-retry n: If hostname resolve fails for --remote, retry
                  resolve for n seconds before failing (disabled by default).
                  Set n="infinite" to retry indefinitely.
--float         : Allow remote to change its IP address/port, such as through
                  DHCP (this is the default if --remote is not used).
--ipchange cmd  : Execute shell command cmd on remote ip address initial
                  setting or change -- execute as: cmd ip-address port#
--port port     : TCP/UDP port # for both local and remote.
--lport port    : TCP/UDP port # for local (default=1194). Implies --bind.
--rport port    : TCP/UDP port # for remote (default=1194).
--bind          : Bind to local address and port. (This is the default unless
                  --proto tcp-client or --http-proxy or --socks-proxy is used).
--nobind        : Do not bind to local address and port.
--dev tunX|tapX : tun/tap device (X can be omitted for dynamic device.
--dev-type dt   : Which device type are we using? (dt = tun or tap) Use
                  this option only if the tun/tap device used with --dev
                  does not begin with "tun" or "tap".
--dev-node node : Explicitly set the device node rather than using
                  /dev/net/tun, /dev/tun, /dev/tap, etc.
--lladdr hw     : Set the link layer address of the tap device.
--topology t    : Set --dev tun topology: 'net30', 'p2p', or 'subnet'.
--tun-ipv6      : Build tun link capable of forwarding IPv6 traffic.
--iproute cmd   : Use this command instead of default /sbin/ip.
--ifconfig l rn : TUN: configure device to use IP address l as a local
                  endpoint and rn as a remote endpoint.  l & rn should be
                  swapped on the other peer.  l & rn must be private
                  addresses outside of the subnets used by either peer.
                  TAP: configure device to use IP address l as a local
                  endpoint and rn as a subnet mask.
--ifconfig-noexec : Don't actually execute ifconfig/netsh command, instead
                    pass --ifconfig parms by environment to scripts.
--ifconfig-nowarn : Don't warn if the --ifconfig option on this side of the
                    connection doesn't match the remote side.
--route network [netmask] [gateway] [metric] :
                  Add route to routing table after connection
                  is established.  Multiple routes can be specified.
                  netmask default: 255.255.255.255
                  gateway default: taken from --route-gateway or --ifconfig
                  Specify default by leaving blank or setting to "nil".
--max-routes n :  Specify the maximum number of routes that may be defined
                  or pulled from a server.
--route-gateway gw|'dhcp' : Specify a default gateway for use with --route.
--route-metric m : Specify a default metric for use with --route.
--route-delay n [w] : Delay n seconds after connection initiation before
                  adding routes (may be 0).  If not specified, routes will
                  be added immediately after tun/tap open.  On Windows, wait
                  up to w seconds for TUN/TAP adapter to come up.
--route-up cmd  : Execute shell cmd after routes are added.
--route-noexec  : Don't add routes automatically.  Instead pass routes to
                  --route-up script using environmental variables.
--route-nopull  : When used with --client or --pull, accept options pushed
                  by server EXCEPT for routes.
--allow-pull-fqdn : Allow client to pull DNS names from server for
                    --ifconfig, --route, and --route-gateway.
--redirect-gateway [flags]: Automatically execute routing
                  commands to redirect all outgoing IP traffic through the
                  VPN.  Add 'local' flag if both OpenVPN servers are directly
                  connected via a common subnet, such as with WiFi.
                  Add 'def1' flag to set default route using using 0.0.0.0/1
                  and 128.0.0.0/1 rather than 0.0.0.0/0.  Add 'bypass-dhcp'
                  flag to add a direct route to DHCP server, bypassing tunnel.
                  Add 'bypass-dns' flag to similarly bypass tunnel for DNS.
--redirect-private [flags]: Like --redirect-gateway, but omit actually changing
                  the default gateway.  Useful when pushing private subnets.
--push-peer-info : (client only) push client info to server.
--setenv name value : Set a custom environmental variable to pass to script.
--setenv FORWARD_COMPATIBLE 1 : Relax config file syntax checking to allow
                  directives for future OpenVPN versions to be ignored.
--script-security level mode : mode='execve' (default) or 'system', level=
                  0 -- strictly no calling of external programs
                  1 -- (default) only call built-ins such as ifconfig
                  2 -- allow calling of built-ins and scripts
                  3 -- allow password to be passed to scripts via env
--shaper n      : Restrict output to peer to n bytes per second.
--keepalive n m : Helper option for setting timeouts in server mode.  Send
                  ping once every n seconds, restart if ping not received
                  for m seconds.
--inactive n [bytes] : Exit after n seconds of activity on tun/tap device
                  produces a combined in/out byte count < bytes.
--ping-exit n   : Exit if n seconds pass without reception of remote ping.
--ping-restart n: Restart if n seconds pass without reception of remote ping.
--ping-timer-rem: Run the --ping-exit/--ping-restart timer only if we have a
                  remote address.
--ping n        : Ping remote once every n seconds over TCP/UDP port.
--multihome     : Configure a multi-homed UDP server.
--fast-io       : (experimental) Optimize TUN/TAP/UDP writes.
--remap-usr1 s  : On SIGUSR1 signals, remap signal (s='SIGHUP' or 'SIGTERM').
--persist-tun   : Keep tun/tap device open across SIGUSR1 or --ping-restart.
--persist-remote-ip : Keep remote IP address across SIGUSR1 or --ping-restart.
--persist-local-ip  : Keep local IP address across SIGUSR1 or --ping-restart.
--persist-key   : Don't re-read key files across SIGUSR1 or --ping-restart.
--passtos       : TOS passthrough (applies to IPv4 only).
--tun-mtu n     : Take the tun/tap device MTU to be n and derive the
                  TCP/UDP MTU from it (default=1500).
--tun-mtu-extra n : Assume that tun/tap device might return as many
                  as n bytes more than the tun-mtu size on read
                  (default TUN=0 TAP=32).
--link-mtu n    : Take the TCP/UDP device MTU to be n and derive the tun MTU
                  from it.
--mtu-disc type : Should we do Path MTU discovery on TCP/UDP channel?
                  'no'    -- Never send DF (Don't Fragment) frames
                  'maybe' -- Use per-route hints
                  'yes'   -- Always DF (Don't Fragment)
--mtu-test      : Empirically measure and report MTU.
--fragment max  : Enable internal datagram fragmentation so that no UDP
                  datagrams are sent which are larger than max bytes.
                  Adds 4 bytes of overhead per datagram.
--mssfix [n]    : Set upper bound on TCP MSS, default = tun-mtu size
                  or --fragment max value, whichever is lower.
--sndbuf size   : Set the TCP/UDP send buffer size.
--rcvbuf size   : Set the TCP/UDP receive buffer size.
--txqueuelen n  : Set the tun/tap TX queue length to n (Linux only).
--mlock         : Disable Paging -- ensures key material and tunnel
                  data will never be written to disk.
--up cmd        : Shell cmd to execute after successful tun device open.
                  Execute as: cmd tun/tap-dev tun-mtu link-mtu \
                              ifconfig-local-ip ifconfig-remote-ip
                  (pre --user or --group UID/GID change)
--up-delay      : Delay tun/tap open and possible --up script execution
                  until after TCP/UDP connection establishment with peer.
--down cmd      : Shell cmd to run after tun device close.
                  (post --user/--group UID/GID change and/or --chroot)
                  (script parameters are same as --up option)
--down-pre      : Call --down cmd/script before TUN/TAP close.
--up-restart    : Run up/down scripts for all restarts including those
                  caused by --ping-restart or SIGUSR1
--user user     : Set UID to user after initialization.
--group group   : Set GID to group after initialization.
--chroot dir    : Chroot to this directory after initialization.
--cd dir        : Change to this directory before initialization.
--daemon [name] : Become a daemon after initialization.
                  The optional 'name' parameter will be passed
                  as the program name to the system logger.
--syslog [name] : Output to syslog, but do not become a daemon.
                  See --daemon above for a description of the 'name' parm.
--inetd [name] ['wait'|'nowait'] : Run as an inetd or xinetd server.
                  See --daemon above for a description of the 'name' parm.
--log file      : Output log to file which is created/truncated on open.
--log-append file : Append log to file, or create file if nonexistent.
--suppress-timestamps : Don't log timestamps to stdout/stderr.
--writepid file : Write main process ID to file.
--nice n        : Change process priority (>0 = lower, <0 = higher).
--echo [parms ...] : Echo parameters to log output.
--verb n        : Set output verbosity to n (default=1):
                  (Level 3 is recommended if you want a good summary
                  of what's happening without being swamped by output).
                : 0 -- no output except fatal errors
                : 1 -- startup info + connection initiated messages +
                non-fatal encryption & net errors
         : 2,3 -- show TLS negotiations & route info
         : 4 -- show parameters
         : 5 -- show 'RrWw' chars on console for each packet sent
                and received from TCP/UDP (caps) or tun/tap (lc)
         : 6 to 11 -- debug messages of increasing verbosity
--mute n        : Log at most n consecutive messages in the same category.
--status file n : Write operational status to file every n seconds.
--status-version [n] : Choose the status file format version number.
           Currently, n can be 1, 2, or 3 (default=1).
--disable-occ   : Disable options consistency check between peers.
--gremlin mask  : Special stress testing mode (for debugging only).
--comp-lzo      : Use fast LZO compression -- may add up to 1 byte per
           packet for uncompressible data.
--comp-noadapt  : Don't use adaptive compression when --comp-lzo
           is specified.
--management ip port [pass] : Enable a TCP server on ip:port to handle
           management functions.  pass is a password file
           or 'stdin' to prompt from console.
           To listen on a unix domain socket, specific the pathname
           in place of ip and use 'unix' as the port number.
--management-client : Management interface will connect as a TCP client to
               ip/port rather than listen as a TCP server.
--management-query-passwords : Query management channel for private key
           and auth-user-pass passwords.
--management-hold : Start OpenVPN in a hibernating state, until a client
             of the management interface explicitly starts it.
--management-signal : Issue SIGUSR1 when management disconnect event occurs.
--management-forget-disconnect : Forget passwords when management disconnect
                          event occurs.
--management-log-cache n : Cache n lines of log file history for usage
           by the management channel.
--management-client-user u  : When management interface is a unix socket, only
                       allow connections from user u.
--management-client-group g : When management interface is a unix socket, only
                       allow connections from group g.
--management-client-auth : gives management interface client the responsibility
                    to authenticate clients after their client certificate
                       has been verified.
--management-client-pf : management interface clients must specify a packet
                  filter file for each connecting client.
--plugin m [str]: Load plug-in module m passing str as an argument
           to its initialization function.

Multi-Client Server options (when --mode server is used):
--server network netmask : Helper option to easily configure server mode.
--server-bridge [IP netmask pool-start-IP pool-end-IP] : Helper option to
             easily configure ethernet bridging server mode.
--push "option" : Push a config file option back to the peer for remote
           execution.  Peer must specify --pull in its config file.
--push-reset    : Don't inherit global push list for specific
           client instance.
--ifconfig-pool start-IP end-IP [netmask] : Set aside a pool of subnets
           to be dynamically allocated to connecting clients.
--ifconfig-pool-linear : Use individual addresses rather than /30 subnets
           in tun mode.  Not compatible with Windows clients.
--ifconfig-pool-persist file [seconds] : Persist/unpersist ifconfig-pool
           data to file, at seconds intervals (default=600).
           If seconds=0, file will be treated as read-only.
--ifconfig-push local remote-netmask : Push an ifconfig option to remote,
           overrides --ifconfig-pool dynamic allocation.
           Only valid in a client-specific config file.
--iroute network [netmask] : Route subnet to client.
Sets up internal routes only.
Only valid in a client-specific config file.
--disable       : Client is disabled.
Only valid in a client-specific config file.
--client-cert-not-required : Don't require client certificate, client
will authenticate using username/password.
--username-as-common-name  : For auth-user-pass authentication, use
the authenticated username as the common name,
rather than the common name from the client cert.
--auth-user-pass-verify cmd method: Query client for username/password and
run script cmd to verify.  If method='via-env', pass
user/pass via environment, if method='via-file', pass
user/pass via temporary file.
--opt-verify    : Clients that connect with options that are incompatible
with those of the server will be disconnected.
--auth-user-pass-optional : Allow connections by clients that don't
specify a username/password.
--no-name-remapping : Allow Common Name and X509 Subject to include
    any printable character.
--client-to-client : Internally route client-to-client traffic.
--duplicate-cn  : Allow multiple clients with the same common name to
concurrently connect.
--client-connect cmd : Run script cmd on client connection.
--client-disconnect cmd : Run script cmd on client disconnection.
--client-config-dir dir : Directory for custom client config files.
--ccd-exclusive : Refuse connection unless custom client config is found.
--tmp-dir dir   : Temporary directory, used for --client-connect return file and plugin communication.
--hash-size r v : Set the size of the real address hash table to r and the
virtual address table to v.
--bcast-buffers n : Allocate n broadcast buffers.
--tcp-queue-limit n : Maximum number of queued TCP output packets.
--tcp-nodelay   : Macro that sets TCP_NODELAY socket flag on the server
as well as pushes it to connecting clients.
--learn-address cmd : Run script cmd to validate client virtual addresses.
--connect-freq n s : Allow a maximum of n new connections per s seconds.
--max-clients n : Allow a maximum of n simultaneously connected clients.
--max-routes-per-client n : Allow a maximum of n internal routes per client.
--port-share host port : When run in TCP mode, proxy incoming HTTPS sessions
to a web server at host:port.

Client options (when connecting to a multi-client server):
--client         : Helper option to easily configure client mode.
--auth-user-pass [up] : Authenticate with server using username/password.
up is a file containing username/password on 2 lines,
or omit to prompt from console.
--pull           : Accept certain config file options from the peer as if they
were part of the local config file.  Must be specified
when connecting to a '--mode server' remote host.
--auth-retry t  : How to handle auth failures.  Set t to
none (default), interact, or nointeract.
--server-poll-timeout n : when polling possible remote servers to connect to
in a round-robin fashion, spend no more than n seconds
waiting for a response before trying the next server.
--explicit-exit-notify [n] : On exit/restart, send exit signal to
server/remote. n = # of retries, default=1.

Data Channel Encryption Options (must be compatible between peers):
(These options are meaningful for both Static Key & TLS-mode)
--secret f [d]  : Enable Static Key encryption mode (non-TLS).
Use shared secret file f, generate with --genkey.
The optional d parameter controls key directionality.
If d is specified, use separate keys for each
direction, set d=0 on one side of the connection,
and d=1 on the other side.
--auth alg      : Authenticate packets with HMAC using message
digest algorithm alg (default=SHA1).
(usually adds 16 or 20 bytes per packet)
Set alg=none to disable authentication.
--cipher alg    : Encrypt packets with cipher algorithm alg
(default=BF-CBC).
Set alg=none to disable encryption.
--prng alg [nsl] : For PRNG, use digest algorithm alg, and
 nonce_secret_len=nsl.  Set alg=none to disable PRNG.
--keysize n     : Size of cipher key in bits (optional).
If unspecified, defaults to cipher-specific default.
--engine [name] : Enable OpenSSL hardware crypto engine functionality.
--no-replay     : Disable replay protection.
--mute-replay-warnings : Silence the output of replay warnings to log file.
--replay-window n [t]  : Use a replay protection sliding window of size n
       and a time window of t seconds.
       Default n=64 t=15
--no-iv         : Disable cipher IV -- only allowed with CBC mode ciphers.
--replay-persist file : Persist replay-protection state across sessions
using file.
--test-crypto   : Run a self-test of crypto features enabled.
For debugging only.

TLS Key Negotiation Options:
(These options are meaningful only for TLS-mode)
--tls-server    : Enable TLS and assume server role during TLS handshake.
--tls-client    : Enable TLS and assume client role during TLS handshake.
--key-method m  : Data channel key exchange method.  m should be a method
number, such as 1 (default), 2, etc.
--ca file       : Certificate authority file in .pem format containing
root certificate.
--capath dir    : A directory of trusted certificates (CAs and CRLs).
--dh file       : File containing Diffie Hellman parameters
in .pem format (for --tls-server only).
Use "openssl dhparam -out dh1024.pem 1024" to generate.
--cert file     : Local certificate in .pem format -- must be signed
by a Certificate Authority in --ca file.
--key file      : Local private key in .pem format.
--pkcs12 file   : PKCS#12 file containing local private key, local certificate
and optionally the root CA certificate.
--tls-cipher l  : A list l of allowable TLS ciphers separated by : (optional).
: Use --show-tls to see a list of supported TLS ciphers.
--tls-timeout n : Packet retransmit timeout on TLS control channel
if no ACK from remote within n seconds (default=2).
--reneg-bytes n : Renegotiate data chan. key after n bytes sent and recvd.
--reneg-pkts n  : Renegotiate data chan. key after n packets sent and recvd.
--reneg-sec n   : Renegotiate data chan. key after n seconds (default=3600).
--hand-window n : Data channel key exchange must finalize within n seconds
of handshake initiation by any peer (default=60).
--tran-window n : Transition window -- old key can live this many seconds
after new key renegotiation begins (default=3600).
--single-session: Allow only one session (reset state on restart).
--tls-exit      : Exit on TLS negotiation failure.
--tls-auth f [d]: Add an additional layer of authentication on top of the TLS
control channel to protect against DoS attacks.
f (required) is a shared-secret passphrase file.
The optional d parameter controls key directionality,
see --secret option for more info.
--askpass [file]: Get PEM password from controlling tty before we daemonize.
--auth-nocache  : Don't cache --askpass or --auth-user-pass passwords.
--crl-verify crl: Check peer certificate against a CRL.
--tls-verify cmd: Execute shell command cmd to verify the X509 name of a
pending TLS connection that has otherwise passed all other
tests of certification.  cmd should return 0 to allow
TLS handshake to proceed, or 1 to fail.  (cmd is
executed as 'cmd certificate_depth X509_NAME_oneline')
--tls-export-cert [directory] : Get peer cert in PEM format and store it
in an openvpn temporary file in [directory]. Peer cert is
stored before tls-verify script execution and deleted after.
--tls-remote x509name: Accept connections only from a host with X509 name
x509name. The remote host must also pass all other tests
of verification.
--ns-cert-type t: Require that peer certificate was signed with an explicit
nsCertType designation t = 'client' | 'server'.
--remote-cert-ku v ... : Require that the peer certificate was signed with
explicit key usage, you can specify more than one value.
value should be given in hex format.
--remote-cert-eku oid : Require that the peer certificate was signed with
explicit extended key usage. Extended key usage can be encoded
as an object identifier or OpenSSL string representation.
--remote-cert-tls t: Require that peer certificate was signed with explicit
key usage and extended key usage based on RFC3280 TLS rules.
t = 'client' | 'server'.

PKCS#11 Options:
--pkcs11-providers provider ... : PKCS#11 provider to load.
--pkcs11-protected-authentication [0|1] ... : Use PKCS#11 protected authentication
            path. Set for each provider.
--pkcs11-private-mode hex ...   : PKCS#11 private key mode mask.
            0       : Try  to determind automatically (default).
            1       : Use Sign.
            2       : Use SignRecover.
            4       : Use Decrypt.
            8       : Use Unwrap.
--pkcs11-cert-private [0|1] ... : Set if login should be performed before
                certificate can be accessed. Set for each provider.
--pkcs11-pin-cache seconds      : Number of seconds to cache PIN. The default is -1
                cache until token is removed.
--pkcs11-id-management          : Acquire identity from management interface.
--pkcs11-id serialized-id 'id'  : Identity to use, get using standalone --show-pkcs11-ids

SSL Library information:
--show-ciphers  : Show cipher algorithms to use with --cipher option.
--show-digests  : Show message digest algorithms to use with --auth option.
--show-engines  : Show hardware crypto accelerator engines (if available).
--show-tls      : Show all TLS ciphers (TLS used only as a control channel).

Generate a random key (only for non-TLS static key encryption mode):
--genkey        : Generate a random key to be used as a shared secret,
for use with the --secret option.
--secret file   : Write key to file.

Tun/tap config mode (available with linux 2.4+):
--mktun         : Create a persistent tunnel.
--rmtun         : Remove a persistent tunnel.
--dev tunX|tapX : tun/tap device
--dev-type dt   : Device type.  See tunnel options above for details.
--user user     : User to set privilege to.
--group group   : Group to set privilege to.

PKCS#11 standalone options:
--show-pkcs11-ids provider [cert_private] : Show PKCS#11 available ids.
                          --verb option can be added *BEFORE* this.