--- name: "freelan" section: "1" platform: "linux" package: "freelan" version: "2.2-3+b2" release: "Debian 11 (Bullseye)" platforms: ["linux"] url: "https://new.carta.tech/freelan" --- # freelan(1) peer-to-peer VPN ## NAME freelan - peer-to-peer VPN ## DESCRIPTION ### Generic options: - **-h** \[ **--help** \] Produce help message. - **-v** \[ **--version** \] Get the program version. - **-d** \[ **--debug** \] Enables debug output. - **-t** \[ **--threads** \] arg (=0) The number of threads to use. - **-c** \[ **--configuration\_file** \] arg The configuration file to use. Configuration: Configuration: ### FreeLAN Secure Channel Protocol (FSCP) options: - **--fscp**.hostname\_resolution\_protocol arg (=ipv4) The hostname resolution protocol to use. **--fscp**.listen\_on arg (=0.0.0.0:12000) The endpoint to listen on. - **--fscp**.listen\_on\_device arg The endpoint to listen on. - **--fscp**.hello\_timeout arg (=3000) The default timeout for HELLO messages, in milliseconds. - **--fscp**.contact arg The address of an host to contact. - **--fscp**.accept\_contact\_requests arg (=yes) Whether to accept CONTACT-REQUEST messages. - **--fscp**.accept\_contacts arg (=yes) Whether to accept CONTACT messages. - **--fscp**.dynamic\_contact\_file arg The certificate of an host to dynamically contact. - **--fscp**.never\_contact arg A network address to avoid when dynamically contacting hosts. - **--fscp**.cipher\_suite\_capability arg A cipher suite to allow. - **--fscp**.elliptic\_curve\_capability arg A elliptic curve to allow. - **--fscp**.upnp\_enabled arg (=yes) Enable UPnP. - **--fscp**.max\_unauthenticated\_messages\_per\_second arg (=1) Maximum unauthenticated messages from one host per second. ### Security options: - **--security**.passphrase arg A passphrase to generate the pre - shared key from. - **--security**.passphrase\_salt arg (=freelan) The salt to use during the pre-shared key derivation. - **--security**.passphrase\_iterations\_count arg (=2000) The number of iterations to use during the pre-shared key derivation. - **--security**.signature\_certificate\_file arg The certificate file to use for signing. - **--security**.signature\_private\_key\_file arg The private key file to use for signing. - **--security**.certificate\_validation\_method arg (=default) The certificate validation method. - **--security**.certificate\_validation\_script arg (="") The certificate validation script to use. - **--security**.authority\_certificate\_file arg An authority certificate file to use. - **--security**.certificate\_revocation\_validation\_method arg (=none) The certificate revocation validation method. - **--security**.certificate\_revocation\_list\_file arg A certificate revocation list file to use. ### Tap adapter options: - **--tap\_adapter**.type arg (=tap) The TAP adapter type. - **--tap\_adapter**.enabled arg (=yes) Whether to enable the tap adapter. - **--tap\_adapter**.name arg The name of the tap adapter to use or create. - **--tap\_adapter**.mtu arg (=auto) The MTU of the tap adapter. - **--tap\_adapter**.mss\_override arg (=auto) The MSS override. - **--tap\_adapter**.metric arg (=auto) The metric of the tap adapter. - **--tap\_adapter**.ipv4\_address\_prefix\_length arg The tap adapter IPv4 address and prefix length. - **--tap\_adapter**.ipv4\_dhcp arg (=0) The tap adapter IPv4 DHCP status. - **--tap\_adapter**.ipv6\_address\_prefix\_length arg The tap adapter IPv6 address and prefix length. **--tap\_adapter**.remote\_ipv4\_address arg The tap adapter IPv4 remote address. - **--tap\_adapter**.arp\_proxy\_enabled arg (=0) Whether to enable the ARP proxy. - **--tap\_adapter**.arp\_proxy\_fake\_ethernet\_address arg (=00:aa:bb:cc:dd:ee) The ARP proxy fake ethernet address. - **--tap\_adapter**.dhcp\_proxy\_enabled arg (=1) Whether to enable the DHCP proxy. - **--tap\_adapter**.dhcp\_server\_ipv4\_address\_prefix\_length arg (=9.0.0.0/24) The DHCP proxy server IPv4 address and prefix length. - **--tap\_adapter**.dhcp\_server\_ipv6\_address\_prefix\_length arg (=fe80::/10) The DHCP proxy server IPv6 address and prefix length. - **--tap\_adapter**.up\_script arg (="") The tap adapter up script. - **--tap\_adapter**.down\_script arg (="") The tap adapter down script. ### Switch options: **--switch**.routing\_method arg (=switch) The routing method for messages. **--switch**.relay\_mode\_enabled arg (=no) Whether to enable the relay mode. ### Router options: - **--router**.local\_ip\_route arg A route to advertise to the other peers. - **--router**.local\_dns\_server arg A DNS server to advertise to the other peers. - **--router**.client\_routing\_enabled arg (=yes) Whether to enable client routing. - **--router**.accept\_routes\_requests arg (=yes) Whether to accept routes requests. - **--router**.internal\_route\_acceptance\_policy arg (=unicast\_in\_network) The internal route acceptance policy. - **--router**.system\_route\_acceptance\_policy arg (=none) The system route acceptance policy. - **--router**.maximum\_routes\_limit arg (=1) The maximum count of routes to accept for a given host. - **--router**.dns\_servers\_acceptance\_policy arg (=in\_network) The DNS servers acceptance policy. - **--router**.dns\_script arg (="") The DNS script. ### FreeLAN Client options: - **--client**.enabled arg (=no) Whether to enable the client mechanism. - **--client**.server\_endpoint arg (=127.0.0.1:443) The endpoint to connect to. - **--client**.protocol arg (=https) The protocol to use to contact the server. - **--client**.disable\_peer\_verification arg (=no) Whether to disable peer verification. - **--client**.disable\_host\_verification arg (=no) Whether to disable host verification. - **--client**.username arg The client username. - **--client**.password arg The client password. - **--client**.public\_endpoint arg A hostname or IP address to advertise. ### Daemon: - **-f** \[ **--foreground** \] Do not run as a daemon. - **-s** \[ **--syslog** \] Always log to syslog (useful when running with **--foreground** on OSX with launchd). - **-p** \[ **--pid\_file** \] arg A pid file to use. ### Miscellaneous: - **--nocolor** Disable color output. ## SEE ALSO The full documentation for **freelan** is maintained as a Texinfo manual. If the **info** and **freelan** programs are properly installed at your site, the command - **info freelan** should give you access to the complete manual.