# prol2tpd configuration - L2TP VPN server

# The system block defines system-wide settings.

system {
    # Set the IP addresses and optionally UDP ports that prol2tpd listens on.
    listen 10.42.42.10

    # When the LNS communicates with peers to setup L2TP tunnels, it
    # indicates its hostname to peers. This defaults to the Linux
    # system's hostname but can be overridden.
    hostname "mylns"

    # Tunnel and session limits. By default, limits are set by the license.
    max_tunnels 5
    max_sessions 10000

    # Log level.
    log_level notice
}

# The set of L2TP peers from which L2TP tunnel setup requests are
# accepted is defined by peer profiles. For VPNs, connections are
# allowed from any IP. peer_ipaddr 0.0.0.0 matches any peer.
peer profile "vpn" {
    peer_ipaddr 0.0.0.0
    tunnel_profile_name "vpn"
}

# When a tunnel setup request is received from a peer, parameters for
# the new tunnel are defined in a tunnel profile. Tunnel profiles may
# be shared by multiple tunnel instances if those tunnels share the
# same settings.
tunnel profile "vpn" {
    # Force L2TPv2. If proto_version is not set, we allow L2TPv2 or
    # L2TPv3 peers.
    proto_version 2

    # Don't use ephemeral UDP ports to simplify IPSec config since it
    # would otherwise need to be configured to match each ephemeral
    # UDP port that is used.
    local_ipaddr 10.42.42.10:1701

    # Disable L2TP tunnel auth since we are using IPSec.
    auth_mode none

    # Tune L2TP control message reliable delivery.
    #retry_timeout 1
    #max_retries 5
    #rx_window_size 10
    #tx_window_size 10

    # Send a periodic L2TP Hello message to the peer every 60s.
    hello_timeout 60

    # Close the tunnel if it has no sessions for longer than 60s. This
    # shouldn't be needed, but if a buggy peer keeps its tunnel open
    # with no session, we'll close the tunnel.
    idle_timeout 60

    # Indicate the session profile to use for sessions in this tunnel.
    session_profile_name "vpn"
}

# Session parameters are defined in session profiles. With L2TPv2, all
# sessions are PPP. The session profile calls out the pseudowire
# profile to use.
session profile "vpn" {
    pseudowire_profile_name "ppp"
}

# For PPP, the pseudowire configuration is defined in a propppd profile.
pseudowire profile "ppp" {
    pseudowire_type ppp

    # Add args to be added in proppp create requests. PPP parameters
    # for the session can be overridden here. In this config, we use
    # the config of propppd's default profile.
    #extra_options "profile default"
}
