1.\" $FreeBSD$ 2.Dd 20 September 1995 3.nr XX \w'\fC00' 4.Os FreeBSD 5.Dt PPP 8 6.Sh NAME 7.Nm ppp 8.Nd Point to Point Protocol (a.k.a. user-ppp) 9.Sh SYNOPSIS 10.Nm 11.Op Fl Va mode 12.Op Fl nat 13.Op Fl quiet 14.Op Fl unit Ns Ar N 15.Op Ar system Ns 16.No ... 17.Sh DESCRIPTION 18This is a user process 19.Em PPP 20software package. Normally, 21.Em PPP 22is implemented as a part of the kernel (e.g. as managed by 23.Xr pppd 8 ) 24and it's thus somewhat hard to debug and/or modify its behaviour. 25However, in this implementation 26.Em PPP 27is done as a user process with the help of the 28tunnel device driver (tun). 29.Pp 30The 31.Fl nat 32flag (or 33.Fl alias 34flag for backwards compatability) does the equivalent of a 35.Dq nat enable yes , 36enabling 37.Nm ppp Ns No s 38network address translation features. This allows 39.Nm ppp 40to act as a NAT or masquerading engine for all machines on an internal 41LAN. Refer to 42.Xr libalias 3 43for details. 44.Pp 45The 46.Fl quiet 47flag tells 48.Nm 49to be silent at startup rather than displaying the mode and interface 50to standard output. 51.Pp 52The 53.Fl unit 54flag tells 55.Nm 56to only attempt to open 57.Pa /dev/tun Ns Ar N . 58Normally, 59.Nm 60will start with a value of 0 for 61.Ar N , 62and keep trying to open a tunnel device by incrementing the value of 63.Ar N 64by one each time until it succeeds. If it fails three times in a row 65because the device file is missing, it gives up. 66.Pp 67The following 68.Va mode Ns No s 69are understood by 70.Nm ppp : 71.Bl -tag -width XXX -offset XXX 72.It Fl auto 73.Nm 74opens the tun interface, configures it then goes into the background. 75The link isn't brought up until outgoing data is detected on the tun 76interface at which point 77.Nm 78attempts to bring up the link. Packets received (including the first one) 79while 80.Nm 81is trying to bring the link up will remain queued for a default of 822 minutes. See the 83.Dq set choked 84command below. 85.Pp 86In 87.Fl auto 88mode, at least one 89.Dq system 90must be given on the command line (see below) and a 91.Dq set ifaddr 92must be done in the system profile that specifies a peer IP address to 93use when configuring the interface. Something like 94.Dq 10.0.0.1/0 95is usually appropriate. See the 96.Dq pmdemand 97system in 98.Pa /usr/share/examples/ppp/ppp.conf.sample 99for an example. 100.It Fl background 101Here, 102.Nm 103attempts to establish a connection with the peer immediately. If it 104succeeds, 105.Nm 106goes into the background and the parent process returns an exit code 107of 0. If it fails, 108.Nm 109exits with a non-zero result. 110.It Fl foreground 111In foreground mode, 112.Nm 113attempts to establish a connection with the peer immediately, but never 114becomes a daemon. The link is created in background mode. This is useful 115if you wish to control 116.Nm ppp Ns No s 117invocation from another process. 118.It Fl direct 119This is used for receiving incoming connections. 120.Nm 121ignores the 122.Dq set device 123line and uses descriptor 0 as the link. 124.Pp 125If callback is configured, 126.Nm 127will use the 128.Dq set device 129information when dialing back. 130.It Fl dedicated 131This option is designed for machines connected with a dedicated 132wire. 133.Nm 134will always keep the device open and will never use any configured 135chat scripts. 136.It Fl ddial 137This mode is equivalent to 138.Fl auto 139mode except that 140.Nm 141will bring the link back up any time it's dropped for any reason. 142.It Fl interactive 143This is a no-op, and gives the same behaviour as if none of the above 144modes have been specified. 145.Nm 146loads any sections specified on the command line then provides an 147interactive prompt. 148.El 149.Pp 150One or more configuration entries or systems 151.Pq as specified in Pa /etc/ppp/ppp.conf 152may also be specified on the command line. 153.Nm 154will read the 155.Dq default 156system from 157.Pa /etc/ppp/ppp.conf 158at startup, followed by each of the systems specified on the command line. 159.Sh Major Features 160.Bl -diag 161.It Provides an interactive user interface. 162Using its command mode, the user can 163easily enter commands to establish the connection with the remote end, check 164the status of connection and close the connection. All functions can 165also be optionally password protected for security. 166.It Supports both manual and automatic dialing. 167Interactive mode has a 168.Dq term 169command which enables you to talk to the device directly. When you 170are connected to the remote peer and it starts to talk 171.Em PPP , 172.Nm 173detects it and switches to packet mode automatically. Once you have 174determined the proper sequence for connecting with the remote host, you 175can write a chat script to define the necessary dialing and login 176procedure for later convenience. 177.It Supports on-demand dialup capability. 178By using 179.Fl auto 180mode, 181.Nm 182will act as a daemon and wait for a packet to be sent over the 183.Em PPP 184link. When this happens, the daemon automatically dials and establishes the 185connection. 186In almost the same manner 187.Fl ddial 188mode (direct-dial mode) also automatically dials and establishes the 189connection. However, it differs in that it will dial the remote site 190any time it detects the link is down, even if there are no packets to be 191sent. This mode is useful for full-time connections where we worry less 192about line charges and more about being connected full time. 193A third 194.Fl dedicated 195mode is also available. This mode is targeted at a dedicated link 196between two machines. 197.Nm 198will never voluntarily quit from dedicated mode - you must send it the 199.Dq quit all 200command via its diagnostic socket. A 201.Dv SIGHUP 202will force an LCP renegotiation, and a 203.Dv SIGTERM 204will force it to exit. 205.It Supports client callback. 206.Nm 207can use either the standard LCP callback protocol or the Microsoft 208CallBack Control Protocol (ftp://ftp.microsoft.com/developr/rfc/cbcp.txt). 209.It Supports NAT or packet aliasing. 210Packet aliasing (a.k.a. IP masquerading) allows computers on a 211private, unregistered network to access the Internet. The 212.Em PPP 213host acts as a masquerading gateway. IP addresses as well as TCP and 214UDP port numbers are aliased for outgoing packets and de-aliased for 215returning packets. 216.It Supports background PPP connections. 217In background mode, if 218.Nm 219successfully establishes the connection, it will become a daemon. 220Otherwise, it will exit with an error. This allows the setup of 221scripts that wish to execute certain commands only if the connection 222is successfully established. 223.It Supports server-side PPP connections. 224In direct mode, 225.Nm 226acts as server which accepts incoming 227.Em PPP 228connections on stdin/stdout. 229.It Supports PAP and CHAP (rfc 1994) authentication. 230With PAP or CHAP, it is possible to skip the Unix style 231.Xr login 1 232procedure, and use the 233.Em PPP 234protocol for authentication instead. If the peer requests Microsoft 235CHAP authentication and 236.Nm 237is compiled with DES support, an appropriate MD4/DES response will be 238made. 239.It Supports RADIUS (rfc 2138) authentication. 240An extension to PAP and CHAP, 241.Em \&R Ns No emote 242.Em \&A Ns No ccess 243.Em \&D Ns No ial 244.Em \&I Ns No n 245.Em \&U Ns No ser 246.Em \&S Ns No ervice 247allows authentication information to be stored in a central or 248distributed database along with various per-user framed connection 249characteristics. If 250.Pa libradius 251is available at compile time, 252.Nm 253will use it to make 254.Em RADIUS 255requests when configured to do so. 256.It Supports Proxy Arp. 257.Nm 258can be configured to make one or more proxy arp entries on behalf of 259the peer. This allows routing from the peer to the LAN without 260configuring each machine on that LAN. 261.It Supports packet filtering. 262User can define four kinds of filters: the 263.Em in 264filter for incoming packets, the 265.Em out 266filter for outgoing packets, the 267.Em dial 268filter to define a dialing trigger packet and the 269.Em alive 270filter for keeping a connection alive with the trigger packet. 271.It Tunnel driver supports bpf. 272The user can use 273.Xr tcpdump 1 274to check the packet flow over the 275.Em PPP 276link. 277.It Supports PPP over TCP and PPP over UDP. 278If a device name is specified as 279.Em host Ns No : Ns Em port Ns 280.Xo 281.Op / Ns tcp|udp , 282.Xc 283.Nm 284will open a TCP or UDP connection for transporting data rather than using a 285conventional serial device. UDP connections force 286.Nm 287into synchronous mode. 288.It Supports PPP over ISDN. 289If 290.Nm 291is given a raw B-channel i4b device to open as a link, it's able to talk 292to the 293.Xr isdnd 8 294daemon to establish an ISDN connection. 295.It Supports PPP over Ethernet (rfc 2516). 296If 297.Nm 298is given a device specification of the format 299.No PPPoE: Ns Ar iface Ns Xo 300.Op \&: Ns Ar provider Ns 301.Xc 302and if 303.Xr netgraph 4 304is available, 305.Nm 306will attempt talk 307.Em PPP 308over Ethernet to 309.Ar provider 310using the 311.Ar iface 312network interface. 313.It "Supports IETF draft Predictor-1 (rfc 1978) and DEFLATE (rfc 1979) compression." 314.Nm 315supports not only VJ-compression but also Predictor-1 and DEFLATE compression. 316Normally, a modem has built-in compression (e.g. v42.bis) and the system 317may receive higher data rates from it as a result of such compression. 318While this is generally a good thing in most other situations, this 319higher speed data imposes a penalty on the system by increasing the 320number of serial interrupts the system has to process in talking to the 321modem and also increases latency. Unlike VJ-compression, Predictor-1 and 322DEFLATE compression pre-compresses 323.Em all 324network traffic flowing through the link, thus reducing overheads to a 325minimum. 326.It Supports Microsoft's IPCP extensions (rfc 1877). 327Name Server Addresses and NetBIOS Name Server Addresses can be negotiated 328with clients using the Microsoft 329.Em PPP 330stack (ie. Win95, WinNT) 331.It Supports Multi-link PPP (rfc 1990) 332It is possible to configure 333.Nm 334to open more than one physical connection to the peer, combining the 335bandwidth of all links for better throughput. 336.El 337.Sh PERMISSIONS 338.Nm 339is installed as user 340.Dv root 341and group 342.Dv network , 343with permissions 344.Dv 04554 . 345By default, 346.Nm 347will not run if the invoking user id is not zero. This may be overridden 348by using the 349.Dq allow users 350command in 351.Pa /etc/ppp/ppp.conf . 352When running as a normal user, 353.Nm 354switches to user id 0 in order to alter the system routing table, set up 355system lock files and read the ppp configuration files. All 356external commands (executed via the "shell" or "!bg" commands) are executed 357as the user id that invoked 358.Nm ppp . 359Refer to the 360.Sq ID0 361logging facility if you're interested in what exactly is done as user id 362zero. 363.Sh GETTING STARTED 364When you first run 365.Nm 366you may need to deal with some initial configuration details. 367.Bl -bullet 368.It 369Your kernel must include a tunnel device (the GENERIC kernel includes 370one by default). If it doesn't, or if you require more than one tun 371interface, you'll need to rebuild your kernel with the following line in 372your kernel configuration file: 373.Pp 374.Dl pseudo-device tun N 375.Pp 376where 377.Ar N 378is the maximum number of 379.Em PPP 380connections you wish to support. 381.It 382Check your 383.Pa /dev 384directory for the tunnel device entries 385.Pa /dev/tunN , 386where 387.Sq N 388represents the number of the tun device, starting at zero. 389If they don't exist, you can create them by running "sh ./MAKEDEV tunN". 390This will create tun devices 0 through 391.Ar N . 392.It 393Make sure that your system has a group named 394.Dq network 395in the 396.Pa /etc/group 397file and that that group contains the names of all users expected to use 398.Nm ppp . 399Refer to the 400.Xr group 5 401manual page for details. Each of these users must also be given access 402using the 403.Dq allow users 404command in 405.Pa /etc/ppp/ppp.conf . 406.It 407Create a log file. 408.Nm 409uses 410.Xr syslog 3 411to log information. A common log file name is 412.Pa /var/log/ppp.log . 413To make output go to this file, put the following lines in the 414.Pa /etc/syslog.conf 415file: 416.Bd -literal -offset indent 417!ppp 418*.*<TAB>/var/log/ppp.log 419.Ed 420.Pp 421It is possible to have more than one 422.Em PPP 423log file by creating a link to the 424.Nm 425executable: 426.Pp 427.Dl # cd /usr/sbin 428.Dl # ln ppp ppp0 429.Pp 430and using 431.Bd -literal -offset indent 432!ppp0 433*.*<TAB>/var/log/ppp0.log 434.Ed 435.Pp 436in 437.Pa /etc/syslog.conf . 438Don't forget to send a 439.Dv HUP 440signal to 441.Xr syslogd 8 442after altering 443.Pa /etc/syslog.conf . 444.It 445Although not strictly relevant to 446.Nm ppp Ns No s 447operation, you should configure your resolver so that it works correctly. 448This can be done by configuring a local DNS 449.Pq using Xr named 8 450or by adding the correct 451.Sq name-server 452lines to the file 453.Pa /etc/resolv.conf . 454Refer to the 455.Xr resolv.conf 5 456manual page for details. 457.Pp 458Alternatively, if the peer supports it, 459.Nm 460can be configured to ask the peer for the nameserver address(es) and to 461update 462.Pa /etc/resolv.conf 463automatically. Refer to the 464.Dq enable dns 465command below for details. 466.El 467.Sh MANUAL DIALING 468In the following examples, we assume that your machine name is 469.Dv awfulhak . 470when you invoke 471.Nm 472(see 473.Sx PERMISSIONS 474above) with no arguments, you are presented with a prompt: 475.Bd -literal -offset indent 476ppp ON awfulhak> 477.Ed 478.Pp 479The 480.Sq ON 481part of your prompt should always be in upper case. If it is in lower 482case, it means that you must supply a password using the 483.Dq passwd 484command. This only ever happens if you connect to a running version of 485.Nm 486and have not authenticated yourself using the correct password. 487.Pp 488You can start by specifying the device name and speed: 489.Bd -literal -offset indent 490ppp ON awfulhak> set device /dev/cuaa0 491ppp ON awfulhak> set speed 38400 492.Ed 493.Pp 494Normally, hardware flow control (CTS/RTS) is used. However, under 495certain circumstances (as may happen when you are connected directly 496to certain PPP-capable terminal servers), this may result in 497.Nm 498hanging as soon as it tries to write data to your communications link 499as it is waiting for the CTS (clear to send) signal - which will never 500come. Thus, if you have a direct line and can't seem to make a 501connection, try turning CTS/RTS off with 502.Dq set ctsrts off . 503If you need to do this, check the 504.Dq set accmap 505description below too - you'll probably need to 506.Dq set accmap 000a0000 . 507.Pp 508Usually, parity is set to 509.Dq none , 510and this is 511.Nm ppp Ns No s 512default. Parity is a rather archaic error checking mechanism that is no 513longer used because modern modems do their own error checking, and most 514link-layer protocols (that's what 515.Nm 516is) use much more reliable checking mechanisms. Parity has a relatively 517huge overhead (a 12.5% increase in traffic) and as a result, it is always 518disabled 519.Pq set to Dq none 520when 521.Dv PPP 522is opened. However, some ISPs (Internet Service Providers) may use 523specific parity settings at connection time (before 524.Dv PPP 525is opened). Notably, Compuserve insist 526on even parity when logging in: 527.Bd -literal -offset indent 528ppp ON awfulhak> set parity even 529.Ed 530.Pp 531You can now see what your current device settings look like: 532.Bd -literal -offset indent 533ppp ON awfulhak> show physical 534Name: deflink 535 State: closed 536 Device: N/A 537 Link Type: interactive 538 Connect Count: 0 539 Queued Packets: 0 540 Phone Number: N/A 541 542Defaults: 543 Device List: /dev/cuaa0 544 Characteristics: 38400bps, cs8, even parity, CTS/RTS on 545 546Connect time: 0 secs 5470 octets in, 0 octets out 548Overall 0 bytes/sec 549ppp ON awfulhak> 550.Ed 551.Pp 552The term command can now be used to talk directly to the device: 553.Bd -literal -offset indent 554ppp ON awfulhak> term 555at 556OK 557atdt123456 558CONNECT 559login: myispusername 560Password: myisppassword 561Protocol: ppp 562.Ed 563.Pp 564When the peer starts to talk in 565.Em PPP , 566.Nm 567detects this automatically and returns to command mode. 568.Bd -literal -offset indent 569ppp ON awfulhak> # No link has been established 570Ppp ON awfulhak> # We've connected & finished LCP 571PPp ON awfulhak> # We've authenticated 572PPP ON awfulhak> # We've agreed IP numbers 573.Ed 574.Pp 575If it does not, it's probable that the peer is waiting for your end to 576start negotiating. To force 577.Nm 578to start sending 579.Em PPP 580configuration packets to the peer, use the 581.Dq ~p 582command to drop out of terminal mode and enter packet mode. 583.Pp 584If you never even receive a login prompt, it is quite likely that the 585peer wants to use PAP or CHAP authentication instead of using Unix-style 586login/password authentication. To set things up properly, drop back to 587the prompt and set your authentication name and key, then reconnect: 588.Bd -literal -offset indent 589~. 590ppp ON awfulhak> set authname myispusername 591ppp ON awfulhak> set authkey myisppassword 592ppp ON awfulhak> term 593at 594OK 595atdt123456 596CONNECT 597.Ed 598.Pp 599You may need to tell ppp to initiate negotiations with the peer here too: 600.Bd -literal -offset indent 601~p 602ppp ON awfulhak> # No link has been established 603Ppp ON awfulhak> # We've connected & finished LCP 604PPp ON awfulhak> # We've authenticated 605PPP ON awfulhak> # We've agreed IP numbers 606.Ed 607.Pp 608You are now connected! Note that 609.Sq PPP 610in the prompt has changed to capital letters to indicate that you have 611a peer connection. If only some of the three Ps go uppercase, wait until 612either everything is uppercase or lowercase. If they revert to lowercase, 613it means that 614.Nm 615couldn't successfully negotiate with the peer. A good first step 616for troubleshooting at this point would be to 617.Bd -literal -offset indent 618ppp ON awfulhak> set log local phase lcp ipcp 619.Ed 620.Pp 621and try again. Refer to the 622.Dq set log 623command description below for further details. If things fail at this point, 624it is quite important that you turn logging on and try again. It is also 625important that you note any prompt changes and report them to anyone trying 626to help you. 627.Pp 628When the link is established, the show command can be used to see how 629things are going: 630.Bd -literal -offset indent 631PPP ON awfulhak> show physical 632* Modem related information is shown here * 633PPP ON awfulhak> show ccp 634* CCP (compression) related information is shown here * 635PPP ON awfulhak> show lcp 636* LCP (line control) related information is shown here * 637PPP ON awfulhak> show ipcp 638* IPCP (IP) related information is shown here * 639PPP ON awfulhak> show link 640* Link (high level) related information is shown here * 641PPP ON awfulhak> show bundle 642* Logical (high level) connection related information is shown here * 643.Ed 644.Pp 645At this point, your machine has a host route to the peer. This means 646that you can only make a connection with the host on the other side 647of the link. If you want to add a default route entry (telling your 648machine to send all packets without another routing entry to the other 649side of the 650.Em PPP 651link), enter the following command: 652.Bd -literal -offset indent 653PPP ON awfulhak> add default HISADDR 654.Ed 655.Pp 656The string 657.Sq HISADDR 658represents the IP address of the connected peer. 659If the 660.Dq add 661command fails due to an existing route, you can overwrite the existing 662route using 663.Bd -literal -offset indent 664PPP ON awfulhak> add! default HISADDR 665.Ed 666.Pp 667This command can also be executed before actually making the connection. 668If a new IP address is negotiated at connection time, 669.Nm 670will update your default route accordingly. 671.Pp 672You can now use your network applications (ping, telnet, ftp etc.) 673in other windows or terminals on your machine. If you wish to reuse 674the current terminal, you can put 675.Nm 676into the background using your standard shell suspend and background 677commands (usually 678.Dq ^Z 679followed by 680.Dq bg ) . 681.Pp 682Refer to the 683.Sx PPP COMMAND LIST 684section for details on all available commands. 685.Sh AUTOMATIC DIALING 686To use automatic dialing, you must prepare some Dial and Login chat scripts. 687See the example definitions in 688.Pa /usr/share/examples/ppp/ppp.conf.sample 689(the format of 690.Pa /etc/ppp/ppp.conf 691is pretty simple). 692Each line contains one comment, inclusion, label or command: 693.Bl -bullet 694.It 695A line starting with a 696.Pq Dq # 697character is treated as a comment line. Leading whitespace are ignored 698when identifying comment lines. 699.It 700An inclusion is a line beginning with the word 701.Sq !include . 702It must have one argument - the file to include. You may wish to 703.Dq !include ~/.ppp.conf 704for compatibility with older versions of 705.Nm ppp . 706.It 707A label name starts in the first column and is followed by 708a colon 709.Pq Dq \&: . 710.It 711A command line must contain a space or tab in the first column. 712.El 713.Pp 714The 715.Pa /etc/ppp/ppp.conf 716file should consist of at least a 717.Dq default 718section. This section is always executed. It should also contain 719one or more sections, named according to their purpose, for example, 720.Dq MyISP 721would represent your ISP, and 722.Dq ppp-in 723would represent an incoming 724.Nm 725configuration. 726You can now specify the destination label name when you invoke 727.Nm ppp . 728Commands associated with the 729.Dq default 730label are executed, followed by those associated with the destination 731label provided. When 732.Nm 733is started with no arguments, the 734.Dq default 735section is still executed. The load command can be used to manually 736load a section from the 737.Pa /etc/ppp/ppp.conf 738file: 739.Bd -literal -offset indent 740ppp ON awfulhak> load MyISP 741.Ed 742.Pp 743Note, no action is taken by 744.Nm 745after a section is loaded, whether it's the result of passing a label on 746the command line or using the 747.Dq load 748command. Only the commands specified for that label in the configuration 749file are executed. However, when invoking 750.Nm 751with the 752.Fl background , 753.Fl ddial , 754or 755.Fl dedicated 756switches, the link mode tells 757.Nm 758to establish a connection. Refer to the 759.Dq set mode 760command below for further details. 761.Pp 762Once the connection is made, the 763.Sq ppp 764portion of the prompt will change to 765.Sq PPP : 766.Bd -literal -offset indent 767# ppp MyISP 768\&... 769ppp ON awfulhak> dial 770Ppp ON awfulhak> 771PPp ON awfulhak> 772PPP ON awfulhak> 773.Ed 774.Pp 775The Ppp prompt indicates that 776.Nm 777has entered the authentication phase. The PPp prompt indicates that 778.Nm 779has entered the network phase. The PPP prompt indicates that 780.Nm 781has successfully negotiated a network layer protocol and is in 782a usable state. 783.Pp 784If the 785.Pa /etc/ppp/ppp.linkup 786file is available, its contents are executed 787when the 788.Em PPP 789connection is established. See the provided 790.Dq pmdemand 791example in 792.Pa /usr/share/examples/ppp/ppp.conf.sample 793which runs a script in the background after the connection is established 794(refer to the 795.Dq shell 796and 797.Dq bg 798commands below for a description of possible substitution strings). Similarly, 799when a connection is closed, the contents of the 800.Pa /etc/ppp/ppp.linkdown 801file are executed. Both of these files have the same format as 802.Pa /etc/ppp/ppp.conf . 803.Pp 804In previous versions of 805.Nm ppp , 806it was necessary to re-add routes such as the default route in the 807.Pa ppp.linkup 808file. 809.Nm 810now supports 811.Sq sticky routes , 812where all routes that contain the 813.Dv HISADDR 814or 815.Dv MYADDR 816literals will automatically be updated when the values of 817.Dv HISADDR 818and/or 819.Dv MYADDR 820change. 821.Sh BACKGROUND DIALING 822If you want to establish a connection using 823.Nm 824non-interactively (such as from a 825.Xr crontab 5 826entry or an 827.Xr at 1 828job) you should use the 829.Fl background 830option. 831When 832.Fl background 833is specified, 834.Nm 835attempts to establish the connection immediately. If multiple phone 836numbers are specified, each phone number will be tried once. If the 837attempt fails, 838.Nm 839exits immediately with a non-zero exit code. 840If it succeeds, then 841.Nm 842becomes a daemon, and returns an exit status of zero to its caller. 843The daemon exits automatically if the connection is dropped by the 844remote system, or it receives a 845.Dv TERM 846signal. 847.Sh DIAL ON DEMAND 848Demand dialing is enabled with the 849.Fl auto 850or 851.Fl ddial 852options. You must also specify the destination label in 853.Pa /etc/ppp/ppp.conf 854to use. It must contain the 855.Dq set ifaddr 856command to define the remote peers IP address. (refer to 857.Pa /usr/share/examples/ppp/ppp.conf.sample ) 858.Bd -literal -offset indent 859# ppp -auto pmdemand 860.Ed 861.Pp 862When 863.Fl auto 864or 865.Fl ddial 866is specified, 867.Nm 868runs as a daemon but you can still configure or examine its 869configuration by using the 870.Dq set server 871command in 872.Pa /etc/ppp/ppp.conf , 873.Pq for example, Dq set server +3000 mypasswd 874and connecting to the diagnostic port as follows: 875.Bd -literal -offset indent 876# pppctl 3000 (assuming tun0) 877Password: 878PPP ON awfulhak> show who 879tcp (127.0.0.1:1028) * 880.Ed 881.Pp 882The 883.Dq show who 884command lists users that are currently connected to 885.Nm 886itself. If the diagnostic socket is closed or changed to a different 887socket, all connections are immediately dropped. 888.Pp 889In 890.Fl auto 891mode, when an outgoing packet is detected, 892.Nm 893will perform the dialing action (chat script) and try to connect 894with the peer. In 895.Fl ddial 896mode, the dialing action is performed any time the line is found 897to be down. 898If the connect fails, the default behaviour is to wait 30 seconds 899and then attempt to connect when another outgoing packet is detected. 900This behaviour can be changed using the 901.Dq set redial 902command: 903.Pp 904.No set redial Ar secs Ns Xo 905.Oo + Ns Ar inc Ns 906.Op - Ns Ar max Ns 907.Oc Op . Ns Ar next 908.Op Ar attempts 909.Xc 910.Pp 911.Bl -tag -width attempts -compact 912.It Ar secs 913is the number of seconds to wait before attempting 914to connect again. If the argument is the literal string 915.Sq Li random , 916the delay period is a random value between 1 and 30 seconds inclusive. 917.It Ar inc 918is the number of seconds that 919.Ar secs 920should be incremented each time a new dial attempt is made. The timeout 921reverts to 922.Ar secs 923only after a successful connection is established. The default value for 924.Ar inc 925is zero. 926.It Ar max 927is the maximum number of times 928.Nm 929should increment 930.Ar secs . 931The default value for 932.Ar max 933is 10. 934.It Ar next 935is the number of seconds to wait before attempting 936to dial the next number in a list of numbers (see the 937.Dq set phone 938command). The default is 3 seconds. Again, if the argument is the literal 939string 940.Sq Li random , 941the delay period is a random value between 1 and 30 seconds. 942.It Ar attempts 943is the maximum number of times to try to connect for each outgoing packet 944that triggers a dial. The previous value is unchanged if this parameter 945is omitted. If a value of zero is specified for 946.Ar attempts , 947.Nm 948will keep trying until a connection is made. 949.El 950.Pp 951So, for example; 952.Bd -literal -offset indent 953set redial 10.3 4 954.Ed 955.Pp 956will attempt to connect 4 times for each outgoing packet that causes 957a dial attempt with a 3 second delay between each number and a 10 second 958delay after all numbers have been tried. If multiple phone numbers 959are specified, the total number of attempts is still 4 (it does not 960attempt each number 4 times). 961.Pp 962Alternatively, 963.Pp 964.Bd -literal -offset indent 965set redial 10+10-5.3 20 966.Ed 967.Pp 968tells 969.Nm 970to attempt to connect 20 times. After the first attempt, 971.Nm 972pauses for 10 seconds. After the next attempt it pauses for 20 seconds 973and so on until after the sixth attempt it pauses for 1 minute. The next 97414 pauses will also have a duration of one minute. If 975.Nm 976connects, disconnects and fails to connect again, the timeout starts again 977at 10 seconds. 978.Pp 979Modifying the dial delay is very useful when running 980.Nm 981in 982.Fl auto 983mode on both ends of the link. If each end has the same timeout, 984both ends wind up calling each other at the same time if the link 985drops and both ends have packets queued. 986At some locations, the serial link may not be reliable, and carrier 987may be lost at inappropriate times. It is possible to have 988.Nm 989redial should carrier be unexpectedly lost during a session. 990.Bd -literal -offset indent 991set reconnect timeout ntries 992.Ed 993.Pp 994This command tells 995.Nm 996to re-establish the connection 997.Ar ntries 998times on loss of carrier with a pause of 999.Ar timeout 1000seconds before each try. For example, 1001.Bd -literal -offset indent 1002set reconnect 3 5 1003.Ed 1004.Pp 1005tells 1006.Nm 1007that on an unexpected loss of carrier, it should wait 1008.Ar 3 1009seconds before attempting to reconnect. This may happen up to 1010.Ar 5 1011times before 1012.Nm 1013gives up. The default value of ntries is zero (no reconnect). Care 1014should be taken with this option. If the local timeout is slightly 1015longer than the remote timeout, the reconnect feature will always be 1016triggered (up to the given number of times) after the remote side 1017times out and hangs up. 1018NOTE: In this context, losing too many LQRs constitutes a loss of 1019carrier and will trigger a reconnect. 1020If the 1021.Fl background 1022flag is specified, all phone numbers are dialed at most once until 1023a connection is made. The next number redial period specified with 1024the 1025.Dq set redial 1026command is honoured, as is the reconnect tries value. If your redial 1027value is less than the number of phone numbers specified, not all 1028the specified numbers will be tried. 1029To terminate the program, type 1030.Bd -literal -offset indent 1031PPP ON awfulhak> close 1032ppp ON awfulhak> quit all 1033.Ed 1034.Pp 1035A simple 1036.Dq quit 1037command will terminate the 1038.Xr pppctl 8 1039or 1040.Xr telnet 1 1041connection but not the 1042.Nm 1043program itself. 1044You must use 1045.Dq quit all 1046to terminate 1047.Nm 1048as well. 1049.Sh RECEIVING INCOMING PPP CONNECTIONS (Method 1) 1050To handle an incoming 1051.Em PPP 1052connection request, follow these steps: 1053.Bl -enum 1054.It 1055Make sure the modem and (optionally) 1056.Pa /etc/rc.serial 1057is configured correctly. 1058.Bl -bullet -compact 1059.It 1060Use Hardware Handshake (CTS/RTS) for flow control. 1061.It 1062Modem should be set to NO echo back (ATE0) and NO results string (ATQ1). 1063.El 1064.Pp 1065.It 1066Edit 1067.Pa /etc/ttys 1068to enable a 1069.Xr getty 8 1070on the port where the modem is attached. 1071For example: 1072.Pp 1073.Dl ttyd1 "/usr/libexec/getty std.38400" dialup on secure 1074.Pp 1075Don't forget to send a 1076.Dv HUP 1077signal to the 1078.Xr init 8 1079process to start the 1080.Xr getty 8 : 1081.Pp 1082.Dl # kill -HUP 1 1083.It 1084Create a 1085.Pa /usr/local/bin/ppplogin 1086file with the following contents: 1087.Bd -literal -offset indent 1088#! /bin/sh 1089exec /usr/sbin/ppp -direct incoming 1090.Ed 1091.Pp 1092Direct mode 1093.Pq Fl direct 1094lets 1095.Nm 1096work with stdin and stdout. You can also use 1097.Xr pppctl 8 1098to connect to a configured diagnostic port, in the same manner as with 1099client-side 1100.Nm ppp . 1101.Pp 1102Here, the 1103.Ar incoming 1104section must be set up in 1105.Pa /etc/ppp/ppp.conf . 1106.Pp 1107Make sure that the 1108.Ar incoming 1109section contains the 1110.Dq allow users 1111command as appropriate. 1112.It 1113Prepare an account for the incoming user. 1114.Bd -literal 1115ppp:xxxx:66:66:PPP Login User:/home/ppp:/usr/local/bin/ppplogin 1116.Ed 1117.Pp 1118Refer to the manual entries for 1119.Xr adduser 8 1120and 1121.Xr vipw 8 1122for details. 1123.It 1124Support for IPCP Domain Name Server and NetBIOS Name Server negotiation 1125can be enabled using the 1126.Dq accept dns 1127and 1128.Dq set nbns 1129commands. Refer to their descriptions below. 1130.El 1131.Pp 1132.Sh RECEIVING INCOMING PPP CONNECTIONS (Method 2) 1133This method differs in that we use 1134.Nm ppp 1135to authenticate the connection rather than 1136.Xr login 1 : 1137.Bl -enum 1138.It 1139Configure your default section in 1140.Pa /etc/gettytab 1141with automatic ppp recognition by specifying the 1142.Dq pp 1143capability: 1144.Bd -literal 1145default:\\ 1146 :pp=/usr/local/bin/ppplogin:\\ 1147 ..... 1148.Ed 1149.It 1150Configure your serial device(s), enable a 1151.Xr getty 8 1152and create 1153.Pa /usr/local/bin/ppplogin 1154as in the first three steps for method 1 above. 1155.It 1156Add either 1157.Dq enable chap 1158or 1159.Dq enable pap 1160.Pq or both 1161to 1162.Pa /etc/ppp/ppp.conf 1163under the 1164.Sq incoming 1165label (or whatever label 1166.Pa ppplogin 1167uses). 1168.It 1169Create an entry in 1170.Pa /etc/ppp/ppp.secret 1171for each incoming user: 1172.Bd -literal 1173Pfred<TAB>xxxx 1174Pgeorge<TAB>yyyy 1175.Ed 1176.El 1177.Pp 1178Now, as soon as 1179.Xr getty 8 1180detects a ppp connection (by recognising the HDLC frame headers), it runs 1181.Dq /usr/local/bin/ppplogin . 1182.Pp 1183It is 1184.Em VITAL 1185that either PAP or CHAP are enabled as above. If they are not, you are 1186allowing anybody to establish ppp session with your machine 1187.Em without 1188a password, opening yourself up to all sorts of potential attacks. 1189.Sh AUTHENTICATING INCOMING CONNECTIONS 1190Normally, the receiver of a connection requires that the peer 1191authenticates itself. This may be done using 1192.Xr login 1 , 1193but alternatively, you can use PAP or CHAP. CHAP is the more secure 1194of the two, but some clients may not support it. Once you decide which 1195you wish to use, add the command 1196.Sq enable chap 1197or 1198.Sq enable pap 1199to the relevant section of 1200.Pa ppp.conf . 1201.Pp 1202You must then configure the 1203.Pa /etc/ppp/ppp.secret 1204file. This file contains one line per possible client, each line 1205containing up to five fields: 1206.Pp 1207.Ar name Ar key Oo 1208.Ar hisaddr Op Ar label Op Ar callback-number 1209.Oc 1210.Pp 1211The 1212.Ar name 1213and 1214.Ar key 1215specify the client username and password. If 1216.Ar key 1217is 1218.Dq \&* 1219and PAP is being used, 1220.Nm 1221will look up the password database 1222.Pq Xr passwd 5 1223when authenticating. If the client does not offer a suitable 1224response based on any 1225.Ar name Ns No / Ns Ar key 1226combination in 1227.Pa ppp.secret , 1228authentication fails. 1229.Pp 1230If authentication is successful, 1231.Ar hisaddr 1232.Pq if specified 1233is used when negotiating IP numbers. See the 1234.Dq set ifaddr 1235command for details. 1236.Pp 1237If authentication is successful and 1238.Ar label 1239is specified, the current system label is changed to match the given 1240.Ar label . 1241This will change the subsequent parsing of the 1242.Pa ppp.linkup 1243and 1244.Pa ppp.linkdown 1245files. 1246.Pp 1247If authentication is successful and 1248.Ar callback-number 1249is specified and 1250.Dq set callback 1251has been used in 1252.Pa ppp.conf , 1253the client will be called back on the given number. If CBCP is being used, 1254.Ar callback-number 1255may also contain a list of numbers or a 1256.Dq \&* , 1257as if passed to the 1258.Dq set cbcp 1259command. The value will be used in 1260.Nm ppp Ns No s 1261subsequent CBCP phase. 1262.Sh PPP OVER TCP and UDP (a.k.a Tunnelling) 1263Instead of running 1264.Nm 1265over a serial link, it is possible to 1266use a TCP connection instead by specifying the host, port and protocol as the 1267device: 1268.Pp 1269.Dl set device ui-gate:6669/tcp 1270.Pp 1271Instead of opening a serial device, 1272.Nm 1273will open a TCP connection to the given machine on the given 1274socket. It should be noted however that 1275.Nm 1276doesn't use the telnet protocol and will be unable to negotiate 1277with a telnet server. You should set up a port for receiving this 1278.Em PPP 1279connection on the receiving machine (ui-gate). This is 1280done by first updating 1281.Pa /etc/services 1282to name the service: 1283.Pp 1284.Dl ppp-in 6669/tcp # Incoming PPP connections over TCP 1285.Pp 1286and updating 1287.Pa /etc/inetd.conf 1288to tell 1289.Xr inetd 8 1290how to deal with incoming connections on that port: 1291.Pp 1292.Dl ppp-in stream tcp nowait root /usr/sbin/ppp ppp -direct ppp-in 1293.Pp 1294Don't forget to send a 1295.Dv HUP 1296signal to 1297.Xr inetd 8 1298after you've updated 1299.Pa /etc/inetd.conf . 1300Here, we use a label named 1301.Dq ppp-in . 1302The entry in 1303.Pa /etc/ppp/ppp.conf 1304on ui-gate (the receiver) should contain the following: 1305.Bd -literal -offset indent 1306ppp-in: 1307 set timeout 0 1308 set ifaddr 10.0.4.1 10.0.4.2 1309 add 10.0.1.0/24 10.0.4.2 1310.Ed 1311.Pp 1312You may also want to enable PAP or CHAP for security. To enable PAP, add 1313the following line: 1314.Bd -literal -offset indent 1315 enable PAP 1316.Ed 1317.Pp 1318You'll also need to create the following entry in 1319.Pa /etc/ppp/ppp.secret : 1320.Bd -literal -offset indent 1321MyAuthName MyAuthPasswd 1322.Ed 1323.Pp 1324If 1325.Ar MyAuthPasswd 1326is a 1327.Pq Dq * , 1328the password is looked up in the 1329.Xr passwd 5 1330database. 1331.Pp 1332The entry in 1333.Pa /etc/ppp/ppp.conf 1334on awfulhak (the initiator) should contain the following: 1335.Bd -literal -offset indent 1336ui-gate: 1337 set escape 0xff 1338 set device ui-gate:ppp-in/tcp 1339 set dial 1340 set timeout 30 1341 set log Phase Chat Connect hdlc LCP IPCP CCP tun 1342 set ifaddr 10.0.4.2 10.0.4.1 1343 add 10.0.2.0/24 10.0.4.1 1344.Ed 1345.Pp 1346Again, if you're enabling PAP, you'll also need: 1347.Bd -literal -offset indent 1348 set authname MyAuthName 1349 set authkey MyAuthKey 1350.Ed 1351.Pp 1352We're assigning the address of 10.0.4.1 to ui-gate, and the address 135310.0.4.2 to awfulhak. 1354To open the connection, just type 1355.Pp 1356.Dl awfulhak # ppp -background ui-gate 1357.Pp 1358The result will be an additional "route" on awfulhak to the 135910.0.2.0/24 network via the TCP connection, and an additional 1360"route" on ui-gate to the 10.0.1.0/24 network. 1361The networks are effectively bridged - the underlying TCP 1362connection may be across a public network (such as the 1363Internet), and the 1364.Em PPP 1365traffic is conceptually encapsulated 1366(although not packet by packet) inside the TCP stream between 1367the two gateways. 1368.Pp 1369The major disadvantage of this mechanism is that there are two 1370"guaranteed delivery" mechanisms in place - the underlying TCP 1371stream and whatever protocol is used over the 1372.Em PPP 1373link - probably TCP again. If packets are lost, both levels will 1374get in each others way trying to negotiate sending of the missing 1375packet. 1376.Pp 1377To avoid this overhead, it is also possible to do all this using 1378UDP instead of TCP as the transport by simply changing the protocol 1379from "tcp" to "udp". When using UDP as a transport, 1380.Nm 1381will operate in synchronous mode. This is another gain as the incoming 1382data does not have to be rearranged into packets. 1383.Pp 1384.Sh NETWORK ADDRESS TRANSLATION (PACKET ALIASING) 1385The 1386.Fl nat 1387.Pq \&or Fl alias 1388command line option enables network address translation (a.k.a. packet 1389aliasing). This allows the 1390.Nm 1391host to act as a masquerading gateway for other computers over 1392a local area network. Outgoing IP packets are aliased so that 1393they appear to come from the 1394.Nm 1395host, and incoming packets are de-aliased so that they are routed 1396to the correct machine on the local area network. 1397Packet aliasing allows computers on private, unregistered 1398subnets to have Internet access, although they are invisible 1399from the outside world. 1400In general, correct 1401.Nm 1402operation should first be verified with network address translation disabled. 1403Then, the 1404.Fl nat 1405option should be switched on, and network applications (web browser, 1406.Xr telnet 1 , 1407.Xr ftp 1 , 1408.Xr ping 8 , 1409.Xr traceroute 8 ) 1410should be checked on the 1411.Nm 1412host. Finally, the same or similar applications should be checked on other 1413computers in the LAN. 1414If network applications work correctly on the 1415.Nm 1416host, but not on other machines in the LAN, then the masquerading 1417software is working properly, but the host is either not forwarding 1418or possibly receiving IP packets. Check that IP forwarding is enabled in 1419.Pa /etc/rc.conf 1420and that other machines have designated the 1421.Nm 1422host as the gateway for the LAN. 1423.Sh PACKET FILTERING 1424This implementation supports packet filtering. There are four kinds of 1425filters; the 1426.Em in 1427filter, the 1428.Em out 1429filter, the 1430.Em dial 1431filter and the 1432.Em alive 1433filter. Here are the basics: 1434.Bl -bullet 1435.It 1436A filter definition has the following syntax: 1437.Pp 1438set filter 1439.Ar name 1440.Ar rule-no 1441.Ar action 1442.Op \&! 1443.Oo 1444.Op host 1445.Ar src_addr Ns Op / Ns Ar width 1446.Op Ar dst_addr Ns Op / Ns Ar width 1447.Oc 1448.Oo Ar proto Op src Ar cmp port 1449.Op dst Ar cmp port 1450.Op estab 1451.Op syn 1452.Op finrst 1453.Oc 1454.Bl -enum 1455.It 1456.Ar Name 1457should be one of 1458.Sq in , 1459.Sq out , 1460.Sq dial 1461or 1462.Sq alive . 1463.It 1464.Ar Rule-no 1465is a numeric value between 1466.Sq 0 1467and 1468.Sq 39 1469specifying the rule number. Rules are specified in numeric order according to 1470.Ar rule-no , 1471but only if rule 1472.Sq 0 1473is defined. 1474.It 1475.Ar Action 1476may be specified as 1477.Sq permit 1478or 1479.Sq deny , 1480in which case, if a given packet matches the rule, the associated action 1481is taken immediately. 1482.Ar Action 1483can also be specified as 1484.Sq clear 1485to clear the action associated with that particular rule, or as a new 1486rule number greater than the current rule. In this case, if a given 1487packet matches the current rule, the packet will next be matched against 1488the new rule number (rather than the next rule number). 1489.Pp 1490The 1491.Ar action 1492may optionally be followed with an exclamation mark 1493.Pq Dq ! , 1494telling 1495.Nm 1496to reverse the sense of the following match. 1497.It 1498.Op Ar src_addr Ns Op / Ns Ar width 1499and 1500.Op Ar dst_addr Ns Op / Ns Ar width 1501are the source and destination IP number specifications. If 1502.Op / Ns Ar width 1503is specified, it gives the number of relevant netmask bits, 1504allowing the specification of an address range. 1505.Pp 1506Either 1507.Ar src_addr 1508or 1509.Ar dst_addr 1510may be given the values 1511.Dv MYADDR 1512or 1513.Dv HISADDR 1514(refer to the description of the 1515.Dq bg 1516command for a description of these values). When these values are used, 1517the filters will be updated any time the values change. This is similar 1518to the behaviour of the 1519.Dq add 1520command below. 1521.It 1522.Ar Proto 1523must be one of 1524.Sq icmp , 1525.Sq igmp , 1526.Sq ospf , 1527.Sq udp 1528or 1529.Sq tcp . 1530.It 1531.Ar Cmp 1532is one of 1533.Sq \< , 1534.Sq \&eq 1535or 1536.Sq \> , 1537meaning less-than, equal and greater-than respectively. 1538.Ar Port 1539can be specified as a numeric port or by service name from 1540.Pa /etc/services . 1541.It 1542The 1543.Sq estab , 1544.Sq syn , 1545and 1546.Sq finrst 1547flags are only allowed when 1548.Ar proto 1549is set to 1550.Sq tcp , 1551and represent the TH_ACK, TH_SYN and TH_FIN or TH_RST TCP flags respectively. 1552.El 1553.Pp 1554.It 1555Each filter can hold up to 40 rules, starting from rule 0. 1556The entire rule set is not effective until rule 0 is defined, 1557ie. the default is to allow everything through. 1558.It 1559If no rule is matched to a packet, that packet will be discarded 1560(blocked). 1561.It 1562Use 1563.Dq set filter Ar name No -1 1564to flush all rules. 1565.El 1566.Pp 1567See 1568.Pa /usr/share/examples/ppp/ppp.conf.sample . 1569.Sh SETTING THE IDLE TIMER 1570To check/set the idle timer, use the 1571.Dq show bundle 1572and 1573.Dq set timeout 1574commands: 1575.Bd -literal -offset indent 1576ppp ON awfulhak> set timeout 600 1577.Ed 1578.Pp 1579The timeout period is measured in seconds, the default value for which 1580is 180 seconds 1581.Pq or 3 min . 1582To disable the idle timer function, use the command 1583.Bd -literal -offset indent 1584ppp ON awfulhak> set timeout 0 1585.Ed 1586.Pp 1587In 1588.Fl ddial 1589and 1590.Fl dedicated 1591modes, the idle timeout is ignored. In 1592.Fl auto 1593mode, when the idle timeout causes the 1594.Em PPP 1595session to be 1596closed, the 1597.Nm 1598program itself remains running. Another trigger packet will cause it to 1599attempt to re-establish the link. 1600.Sh PREDICTOR-1 and DEFLATE COMPRESSION 1601.Nm 1602supports both Predictor type 1 and deflate compression. 1603By default, 1604.Nm 1605will attempt to use (or be willing to accept) both compression protocols 1606when the peer agrees 1607.Pq or requests them . 1608The deflate protocol is preferred by 1609.Nm ppp . 1610Refer to the 1611.Dq disable 1612and 1613.Dq deny 1614commands if you wish to disable this functionality. 1615.Pp 1616It is possible to use a different compression algorithm in each direction 1617by using only one of 1618.Dq disable deflate 1619and 1620.Dq deny deflate 1621.Pq assuming that the peer supports both algorithms . 1622.Pp 1623By default, when negotiating DEFLATE, 1624.Nm 1625will use a window size of 15. Refer to the 1626.Dq set deflate 1627command if you wish to change this behaviour. 1628.Pp 1629A special algorithm called DEFLATE24 is also available, and is disabled 1630and denied by default. This is exactly the same as DEFLATE except that 1631it uses CCP ID 24 to negotiate. This allows 1632.Nm 1633to successfully negotiate DEFLATE with 1634.Nm pppd 1635version 2.3.*. 1636.Sh CONTROLLING IP ADDRESS 1637.Nm 1638uses IPCP to negotiate IP addresses. Each side of the connection 1639specifies the IP address that it's willing to use, and if the requested 1640IP address is acceptable then 1641.Nm 1642returns ACK to the requester. Otherwise, 1643.Nm 1644returns NAK to suggest that the peer use a different IP address. When 1645both sides of the connection agree to accept the received request (and 1646send ACK), IPCP is set to the open state and a network level connection 1647is established. 1648To control this IPCP behaviour, this implementation has the 1649.Dq set ifaddr 1650command for defining the local and remote IP address: 1651.Bd -literal -offset indent 1652.No set ifaddr Oo Ar src_addr Ns 1653.Op / Ns Ar \&nn 1654.Oo Ar dst_addr Ns Op / Ns Ar \&nn 1655.Oo Ar netmask 1656.Op Ar trigger_addr 1657.Oc 1658.Oc 1659.Oc 1660.Ed 1661.Pp 1662where, 1663.Sq src_addr 1664is the IP address that the local side is willing to use, 1665.Sq dst_addr 1666is the IP address which the remote side should use and 1667.Sq netmask 1668is the netmask that should be used. 1669.Sq Src_addr 1670defaults to the current 1671.Xr hostname 1 , 1672.Sq dst_addr 1673defaults to 0.0.0.0, and 1674.Sq netmask 1675defaults to whatever mask is appropriate for 1676.Sq src_addr . 1677It is only possible to make 1678.Sq netmask 1679smaller than the default. The usual value is 255.255.255.255, as 1680most kernels ignore the netmask of a POINTOPOINT interface. 1681.Pp 1682Some incorrect 1683.Em PPP 1684implementations require that the peer negotiates a specific IP 1685address instead of 1686.Sq src_addr . 1687If this is the case, 1688.Sq trigger_addr 1689may be used to specify this IP number. This will not affect the 1690routing table unless the other side agrees with this proposed number. 1691.Bd -literal -offset indent 1692set ifaddr 192.244.177.38 192.244.177.2 255.255.255.255 0.0.0.0 1693.Ed 1694.Pp 1695The above specification means: 1696.Pp 1697.Bl -bullet -compact 1698.It 1699I will first suggest that my IP address should be 0.0.0.0, but I 1700will only accept an address of 192.244.177.38. 1701.It 1702I strongly insist that the peer uses 192.244.177.2 as his own 1703address and won't permit the use of any IP address but 192.244.177.2. 1704When the peer requests another IP address, I will always suggest that 1705it uses 192.244.177.2. 1706.It 1707The routing table entry will have a netmask of 0xffffffff. 1708.El 1709.Pp 1710This is all fine when each side has a pre-determined IP address, however 1711it is often the case that one side is acting as a server which controls 1712all IP addresses and the other side should go along with it. In order 1713to allow more flexible behaviour, the 1714.Dq set ifaddr 1715command allows the user to specify IP addresses more loosely: 1716.Pp 1717.Dl set ifaddr 192.244.177.38/24 192.244.177.2/20 1718.Pp 1719A number followed by a slash 1720.Pq Dq / 1721represents the number of bits significant in the IP address. The above 1722example means: 1723.Pp 1724.Bl -bullet -compact 1725.It 1726I'd like to use 192.244.177.38 as my address if it is possible, but I'll 1727also accept any IP address between 192.244.177.0 and 192.244.177.255. 1728.It 1729I'd like to make him use 192.244.177.2 as his own address, but I'll also 1730permit him to use any IP address between 192.244.176.0 and 1731192.244.191.255. 1732.It 1733As you may have already noticed, 192.244.177.2 is equivalent to saying 1734192.244.177.2/32. 1735.It 1736As an exception, 0 is equivalent to 0.0.0.0/0, meaning that I have no 1737preferred IP address and will obey the remote peers selection. When 1738using zero, no routing table entries will be made until a connection 1739is established. 1740.It 1741192.244.177.2/0 means that I'll accept/permit any IP address but I'll 1742try to insist that 192.244.177.2 be used first. 1743.El 1744.Pp 1745.Sh CONNECTING WITH YOUR INTERNET SERVICE PROVIDER 1746The following steps should be taken when connecting to your ISP: 1747.Bl -enum 1748.It 1749Describe your providers phone number(s) in the dial script using the 1750.Dq set phone 1751command. This command allows you to set multiple phone numbers for 1752dialing and redialing separated by either a pipe 1753.Pq Dq \&| 1754or a colon 1755.Pq Dq \&: : 1756.Bd -literal -offset indent 1757.No set phone Ar telno Ns Xo 1758.Oo \&| Ns Ar backupnumber 1759.Oc Ns ... Ns Oo : Ns Ar nextnumber 1760.Oc Ns ... 1761.Xc 1762.Ed 1763.Pp 1764Numbers after the first in a pipe-separated list are only used if the 1765previous number was used in a failed dial or login script. Numbers 1766separated by a colon are used sequentially, irrespective of what happened 1767as a result of using the previous number. For example: 1768.Bd -literal -offset indent 1769set phone "1234567|2345678:3456789|4567890" 1770.Ed 1771.Pp 1772Here, the 1234567 number is attempted. If the dial or login script fails, 1773the 2345678 number is used next time, but *only* if the dial or login script 1774fails. On the dial after this, the 3456789 number is used. The 4567890 1775number is only used if the dial or login script using the 3456789 fails. If 1776the login script of the 2345678 number fails, the next number is still the 17773456789 number. As many pipes and colons can be used as are necessary 1778(although a given site would usually prefer to use either the pipe or the 1779colon, but not both). The next number redial timeout is used between all 1780numbers. When the end of the list is reached, the normal redial period is 1781used before starting at the beginning again. 1782The selected phone number is substituted for the \\\\T string in the 1783.Dq set dial 1784command (see below). 1785.It 1786Set up your redial requirements using 1787.Dq set redial . 1788For example, if you have a bad telephone line or your provider is 1789usually engaged (not so common these days), you may want to specify 1790the following: 1791.Bd -literal -offset indent 1792set redial 10 4 1793.Ed 1794.Pp 1795This says that up to 4 phone calls should be attempted with a pause of 10 1796seconds before dialing the first number again. 1797.It 1798Describe your login procedure using the 1799.Dq set dial 1800and 1801.Dq set login 1802commands. The 1803.Dq set dial 1804command is used to talk to your modem and establish a link with your 1805ISP, for example: 1806.Bd -literal -offset indent 1807set dial "ABORT BUSY ABORT NO\\\\sCARRIER TIMEOUT 4 \\"\\" \e 1808 ATZ OK-ATZ-OK ATDT\\\\T TIMEOUT 60 CONNECT" 1809.Ed 1810.Pp 1811This modem "chat" string means: 1812.Bl -bullet 1813.It 1814Abort if the string "BUSY" or "NO CARRIER" are received. 1815.It 1816Set the timeout to 4 seconds. 1817.It 1818Expect nothing. 1819.It 1820Send ATZ. 1821.It 1822Expect OK. If that's not received within the 4 second timeout, send ATZ 1823and expect OK. 1824.It 1825Send ATDTxxxxxxx where xxxxxxx is the next number in the phone list from 1826above. 1827.It 1828Set the timeout to 60. 1829.It 1830Wait for the CONNECT string. 1831.El 1832.Pp 1833Once the connection is established, the login script is executed. This 1834script is written in the same style as the dial script, but care should 1835be taken to avoid having your password logged: 1836.Bd -literal -offset indent 1837set authkey MySecret 1838set login "TIMEOUT 15 login:-\\\\r-login: awfulhak \e 1839 word: \\\\P ocol: PPP HELLO" 1840.Ed 1841.Pp 1842This login "chat" string means: 1843.Bl -bullet 1844.It 1845Set the timeout to 15 seconds. 1846.It 1847Expect "login:". If it's not received, send a carriage return and expect 1848"login:" again. 1849.It 1850Send "awfulhak" 1851.It 1852Expect "word:" (the tail end of a "Password:" prompt). 1853.It 1854Send whatever our current 1855.Ar authkey 1856value is set to. 1857.It 1858Expect "ocol:" (the tail end of a "Protocol:" prompt). 1859.It 1860Send "PPP". 1861.It 1862Expect "HELLO". 1863.El 1864.Pp 1865The 1866.Dq set authkey 1867command is logged specially. When 1868.Ar command 1869or 1870.Ar chat 1871logging is enabled, the actual password is not logged; 1872.Sq ******** Ns 1873is logged instead. 1874.Pp 1875Login scripts vary greatly between ISPs. If you're setting one up 1876for the first time, 1877.Em ENABLE CHAT LOGGING 1878so that you can see if your script is behaving as you expect. 1879.It 1880Use 1881.Dq set device 1882and 1883.Dq set speed 1884to specify your serial line and speed, for example: 1885.Bd -literal -offset indent 1886set device /dev/cuaa0 1887set speed 115200 1888.Ed 1889.Pp 1890Cuaa0 is the first serial port on FreeBSD. If you're running 1891.Nm 1892on OpenBSD, cua00 is the first. A speed of 115200 should be specified 1893if you have a modem capable of bit rates of 28800 or more. In general, 1894the serial speed should be about four times the modem speed. 1895.It 1896Use the 1897.Dq set ifaddr 1898command to define the IP address. 1899.Bl -bullet 1900.It 1901If you know what IP address your provider uses, then use it as the remote 1902address (dst_addr), otherwise choose something like 10.0.0.2/0 (see below). 1903.It 1904If your provider has assigned a particular IP address to you, then use 1905it as your address (src_addr). 1906.It 1907If your provider assigns your address dynamically, choose a suitably 1908unobtrusive and unspecific IP number as your address. 10.0.0.1/0 would 1909be appropriate. The bit after the / specifies how many bits of the 1910address you consider to be important, so if you wanted to insist on 1911something in the class C network 1.2.3.0, you could specify 1.2.3.1/24. 1912.It 1913If you find that your ISP accepts the first IP number that you suggest, 1914specify third and forth arguments of 1915.Dq 0.0.0.0 . 1916This will force your ISP to assign a number. (The third argument will 1917be ignored as it is less restrictive than the default mask for your 1918.Sq src_addr . 1919.El 1920.Pp 1921An example for a connection where you don't know your IP number or your 1922ISPs IP number would be: 1923.Bd -literal -offset indent 1924set ifaddr 10.0.0.1/0 10.0.0.2/0 0.0.0.0 0.0.0.0 1925.Ed 1926.Pp 1927.It 1928In most cases, your ISP will also be your default router. If this is 1929the case, add the line 1930.Bd -literal -offset indent 1931add default HISADDR 1932.Ed 1933.Pp 1934to 1935.Pa /etc/ppp/ppp.conf . 1936.Pp 1937This tells 1938.Nm 1939to add a default route to whatever the peer address is 1940.Pq 10.0.0.2 in this example . 1941This route is 1942.Sq sticky , 1943meaning that should the value of 1944.Dv HISADDR 1945change, the route will be updated accordingly. 1946.Pp 1947Previous versions of 1948.Nm 1949required a similar entry in the 1950.Pa /etc/ppp/ppp.linkup 1951file. Since the advent of 1952.Sq sticky routes , 1953this is no longer required. 1954.It 1955If your provider requests that you use PAP/CHAP authentication methods, add 1956the next lines to your 1957.Pa /etc/ppp/ppp.conf 1958file: 1959.Bd -literal -offset indent 1960set authname MyName 1961set authkey MyPassword 1962.Ed 1963.Pp 1964Both are accepted by default, so 1965.Nm 1966will provide whatever your ISP requires. 1967.Pp 1968It should be noted that a login script is rarely (if ever) required 1969when PAP or CHAP are in use. 1970.It 1971Ask your ISP to authenticate your nameserver address(es) with the line 1972.Bd -literal -offset indent 1973enable dns 1974.Ed 1975Do 1976.Em NOT 1977do this if you are running an local DNS, as 1978.Nm 1979will simply circumvent its use by entering some nameserver lines in 1980.Pa /etc/resolv.conf . 1981.El 1982.Pp 1983Please refer to 1984.Pa /usr/share/examples/ppp/ppp.conf.sample 1985and 1986.Pa /usr/share/examples/ppp/ppp.linkup.sample 1987for some real examples. The pmdemand label should be appropriate for most 1988ISPs. 1989.Sh LOGGING FACILITY 1990.Nm 1991is able to generate the following log info either via 1992.Xr syslog 3 1993or directly to the screen: 1994.Pp 1995.Bl -tag -width XXXXXXXXX -offset XXX -compact 1996.It Li Async 1997Dump async level packet in hex. 1998.It Li CBCP 1999Generate CBCP (CallBack Control Protocol) logs. 2000.It Li CCP 2001Generate a CCP packet trace. 2002.It Li Chat 2003Generate 2004.Sq dial , 2005.Sq login , 2006.Sq logout 2007and 2008.Sq hangup 2009chat script trace logs. 2010.It Li Command 2011Log commands executed either from the command line or any of the configuration 2012files. 2013.It Li Connect 2014Log Chat lines containing the string "CONNECT". 2015.It Li Debug 2016Log debug information. 2017.It Li HDLC 2018Dump HDLC packet in hex. 2019.It Li ID0 2020Log all function calls specifically made as user id 0. 2021.It Li IPCP 2022Generate an IPCP packet trace. 2023.It Li LCP 2024Generate an LCP packet trace. 2025.It Li LQM 2026Generate LQR reports. 2027.It Li Phase 2028Phase transition log output. 2029.It Li Physical 2030Dump physical level packet in hex. 2031.It Li Sync 2032Dump sync level packet in hex. 2033.It Li TCP/IP 2034Dump all TCP/IP packets. 2035.It Li Timer 2036Log timer manipulation. 2037.It Li TUN 2038Include the tun device on each log line. 2039.It Li Warning 2040Output to the terminal device. If there is currently no terminal, 2041output is sent to the log file using syslogs 2042.Dv LOG_WARNING . 2043.It Li Error 2044Output to both the terminal device 2045and the log file using syslogs 2046.Dv LOG_ERROR . 2047.It Li Alert 2048Output to the log file using 2049.Dv LOG_ALERT . 2050.El 2051.Pp 2052The 2053.Dq set log 2054command allows you to set the logging output level. Multiple levels 2055can be specified on a single command line. The default is equivalent to 2056.Dq set log Phase . 2057.Pp 2058It is also possible to log directly to the screen. The syntax is 2059the same except that the word 2060.Dq local 2061should immediately follow 2062.Dq set log . 2063The default is 2064.Dq set log local 2065(ie. only the un-maskable warning, error and alert output). 2066.Pp 2067If The first argument to 2068.Dq set log Op local 2069begins with a 2070.Sq + 2071or a 2072.Sq - 2073character, the current log levels are 2074not cleared, for example: 2075.Bd -literal -offset indent 2076PPP ON awfulhak> set log phase 2077PPP ON awfulhak> show log 2078Log: Phase Warning Error Alert 2079Local: Warning Error Alert 2080PPP ON awfulhak> set log +tcp/ip -warning 2081PPP ON awfulhak> set log local +command 2082PPP ON awfulhak> show log 2083Log: Phase TCP/IP Warning Error Alert 2084Local: Command Warning Error Alert 2085.Ed 2086.Pp 2087Log messages of level Warning, Error and Alert are not controllable 2088using 2089.Dq set log Op local . 2090.Pp 2091The 2092.Ar Warning 2093level is special in that it will not be logged if it can be displayed 2094locally. 2095.Sh SIGNAL HANDLING 2096.Nm 2097deals with the following signals: 2098.Bl -tag -width XX 2099.It INT 2100Receipt of this signal causes the termination of the current connection 2101(if any). This will cause 2102.Nm 2103to exit unless it is in 2104.Fl auto 2105or 2106.Fl ddial 2107mode. 2108.It HUP, TERM & QUIT 2109These signals tell 2110.Nm 2111to exit. 2112.It USR2 2113This signal, tells 2114.Nm 2115to close any existing server socket, dropping all existing diagnostic 2116connections. 2117.El 2118.Pp 2119.Sh MULTI-LINK PPP 2120If you wish to use more than one physical link to connect to a 2121.Em PPP 2122peer, that peer must also understand the 2123.Em MULTI-LINK PPP 2124protocol. Refer to RFC 1990 for specification details. 2125.Pp 2126The peer is identified using a combination of his 2127.Dq endpoint discriminator 2128and his 2129.Dq authentication id . 2130Either or both of these may be specified. It is recommended that 2131at least one is specified, otherwise there is no way of ensuring that 2132all links are actually connected to the same peer program, and some 2133confusing lock-ups may result. Locally, these identification variables 2134are specified using the 2135.Dq set enddisc 2136and 2137.Dq set authname 2138commands. The 2139.Sq authname 2140.Pq and Sq authkey 2141must be agreed in advance with the peer. 2142.Pp 2143Multi-link capabilities are enabled using the 2144.Dq set mrru 2145command (set maximum reconstructed receive unit). Once multi-link 2146is enabled, 2147.Nm 2148will attempt to negotiate a multi-link connection with the peer. 2149.Pp 2150By default, only one 2151.Sq link 2152is available 2153.Pq called Sq deflink . 2154To create more links, the 2155.Dq clone 2156command is used. This command will clone existing links, where all 2157characteristics are the same except: 2158.Bl -enum 2159.It 2160The new link has its own name as specified on the 2161.Dq clone 2162command line. 2163.It 2164The new link is an 2165.Sq interactive 2166link. It's mode may subsequently be changed using the 2167.Dq set mode 2168command. 2169.It 2170The new link is in a 2171.Sq closed 2172state. 2173.El 2174.Pp 2175A summary of all available links can be seen using the 2176.Dq show links 2177command. 2178.Pp 2179Once a new link has been created, command usage varies. All link 2180specific commands must be prefixed with the 2181.Dq link Ar name 2182command, specifying on which link the command is to be applied. When 2183only a single link is available, 2184.Nm 2185is smart enough not to require the 2186.Dq link Ar name 2187prefix. 2188.Pp 2189Some commands can still be used without specifying a link - resulting 2190in an operation at the 2191.Sq bundle 2192level. For example, once two or more links are available, the command 2193.Dq show ccp 2194will show CCP configuration and statistics at the multi-link level, and 2195.Dq link deflink show ccp 2196will show the same information at the 2197.Dq deflink 2198link level. 2199.Pp 2200Armed with this information, the following configuration might be used: 2201.Pp 2202.Bd -literal -offset indent 2203mp: 2204 set timeout 0 2205 set log phase chat 2206 set device /dev/cuaa0 /dev/cuaa1 /dev/cuaa2 2207 set phone "123456789" 2208 set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \\"\\" ATZ \e 2209 OK-AT-OK \\\\dATDT\\\\T TIMEOUT 45 CONNECT" 2210 set login 2211 set ifaddr 10.0.0.1/0 10.0.0.2/0 2212 set authname ppp 2213 set authkey ppppassword 2214 2215 set mrru 1500 2216 clone 1,2,3 2217 link deflink remove 2218.Ed 2219.Pp 2220Note how all cloning is done at the end of the configuration. Usually, 2221the link will be configured first, then cloned. If you wish all links 2222to be up all the time, you can add the following line to the end of your 2223configuration. 2224.Pp 2225.Bd -literal -offset indent 2226 link 1,2,3 set mode ddial 2227.Ed 2228.Pp 2229If you want the links to dial on demand, this command could be used: 2230.Pp 2231.Bd -literal -offset indent 2232 link * set mode auto 2233.Ed 2234.Pp 2235Links may be tied to specific names by removing the 2236.Dq set device 2237line above, and specifying the following after the 2238.Dq clone 2239command: 2240.Pp 2241.Bd -literal -offset indent 2242 link 1 set device /dev/cuaa0 2243 link 2 set device /dev/cuaa1 2244 link 3 set device /dev/cuaa2 2245.Ed 2246.Pp 2247Use the 2248.Dq help 2249command to see which commands require context (using the 2250.Dq link 2251command), which have optional 2252context and which should not have any context. 2253.Pp 2254When 2255.Nm 2256has negotiated 2257.Em MULTI-LINK 2258mode with the peer, it creates a local domain socket in the 2259.Pa /var/run 2260directory. This socket is used to pass link information (including 2261the actual link file descriptor) between different 2262.Nm 2263invocations. This facilitates 2264.Nm ppp Ns No s 2265ability to be run from a 2266.Xr getty 8 2267or directly from 2268.Pa /etc/gettydefs 2269(using the 2270.Sq pp= 2271capability), without needing to have initial control of the serial 2272line. Once 2273.Nm 2274negotiates multi-link mode, it will pass its open link to any 2275already running process. If there is no already running process, 2276.Nm 2277will act as the master, creating the socket and listening for new 2278connections. 2279.Sh PPP COMMAND LIST 2280This section lists the available commands and their effect. They are 2281usable either from an interactive 2282.Nm 2283session, from a configuration file or from a 2284.Xr pppctl 8 2285or 2286.Xr telnet 1 2287session. 2288.Bl -tag -width XX 2289.It accept|deny|enable|disable Ar option.... 2290These directives tell 2291.Nm 2292how to negotiate the initial connection with the peer. Each 2293.Dq option 2294has a default of either accept or deny and enable or disable. 2295.Dq Accept 2296means that the option will be ACK'd if the peer asks for it. 2297.Dq Deny 2298means that the option will be NAK'd if the peer asks for it. 2299.Dq Enable 2300means that the option will be requested by us. 2301.Dq Disable 2302means that the option will not be requested by us. 2303.Pp 2304.Dq Option 2305may be one of the following: 2306.Bl -tag -width XX 2307.It acfcomp 2308Default: Enabled and Accepted. ACFComp stands for Address and Control 2309Field Compression. Non LCP packets will usually have an address 2310field of 0xff (the All-Stations address) and a control field of 23110x03 (the Unnumbered Information command). If this option is 2312negotiated, these two bytes are simply not sent, thus minimising 2313traffic. 2314.Pp 2315See 2316.Pa rfc1662 2317for details. 2318.It chap Ns Op \&05 2319Default: Disabled and Accepted. CHAP stands for Challenge Handshake 2320Authentication Protocol. Only one of CHAP and PAP (below) may be 2321negotiated. With CHAP, the authenticator sends a "challenge" message 2322to its peer. The peer uses a one-way hash function to encrypt the 2323challenge and sends the result back. The authenticator does the same, 2324and compares the results. The advantage of this mechanism is that no 2325passwords are sent across the connection. 2326A challenge is made when the connection is first made. Subsequent 2327challenges may occur. If you want to have your peer authenticate 2328itself, you must 2329.Dq enable chap . 2330in 2331.Pa /etc/ppp/ppp.conf , 2332and have an entry in 2333.Pa /etc/ppp/ppp.secret 2334for the peer. 2335.Pp 2336When using CHAP as the client, you need only specify 2337.Dq AuthName 2338and 2339.Dq AuthKey 2340in 2341.Pa /etc/ppp/ppp.conf . 2342CHAP is accepted by default. 2343Some 2344.Em PPP 2345implementations use "MS-CHAP" rather than MD5 when encrypting the 2346challenge. MS-CHAP is a combination of MD4 and DES. If 2347.Nm 2348was built on a machine with DES libraries available, it will respond 2349to MS-CHAP authentication requests, but will never request them. 2350.It deflate 2351Default: Enabled and Accepted. This option decides if deflate 2352compression will be used by the Compression Control Protocol (CCP). 2353This is the same algorithm as used by the 2354.Xr gzip 1 2355program. 2356Note: There is a problem negotiating 2357.Ar deflate 2358capabilities with 2359.Xr pppd 8 2360- a 2361.Em PPP 2362implementation available under many operating systems. 2363.Nm pppd 2364(version 2.3.1) incorrectly attempts to negotiate 2365.Ar deflate 2366compression using type 2367.Em 24 2368as the CCP configuration type rather than type 2369.Em 26 2370as specified in 2371.Pa rfc1979 . 2372Type 2373.Ar 24 2374is actually specified as 2375.Dq PPP Magna-link Variable Resource Compression 2376in 2377.Pa rfc1975 Ns No ! 2378.Nm 2379is capable of negotiating with 2380.Nm pppd , 2381but only if 2382.Dq deflate24 2383is 2384.Ar enable Ns No d 2385and 2386.Ar accept Ns No ed . 2387.It deflate24 2388Default: Disabled and Denied. This is a variance of the 2389.Ar deflate 2390option, allowing negotiation with the 2391.Xr pppd 8 2392program. Refer to the 2393.Ar deflate 2394section above for details. It is disabled by default as it violates 2395.Pa rfc1975 . 2396.It dns 2397Default: Disabled and Denied. This option allows DNS negotiation. 2398.Pp 2399If 2400.Dq enable Ns No d, 2401.Nm 2402will request that the peer confirms the entries in 2403.Pa /etc/resolv.conf . 2404If the peer NAKs our request (suggesting new IP numbers), 2405.Pa /etc/resolv.conf 2406is updated and another request is sent to confirm the new entries. 2407.Pp 2408If 2409.Dq accept Ns No ed, 2410.Nm 2411will answer any DNS queries requested by the peer rather than rejecting 2412them. The answer is taken from 2413.Pa /etc/resolv.conf 2414unless the 2415.Dq set dns 2416command is used as an override. 2417.It enddisc 2418Default: Enabled and Accepted. This option allows control over whether we 2419negotiate an endpoint discriminator. We only send our discriminator if 2420.Dq set enddisc 2421is used and 2422.Ar enddisc 2423is enabled. We reject the peers discriminator if 2424.Ar enddisc 2425is denied. 2426.It LANMan|chap80lm 2427Default: Disabled and Accepted. The use of this authentication protocol 2428is discouraged as it partially violates the authentication protocol by 2429implementing two different mechanisms (LANMan & NT) under the guise of 2430a single CHAP type (0x80). 2431.Dq LANMan 2432uses a simple DES encryption mechanism and is the least secure of the 2433CHAP alternatives (although is still more secure than PAP). 2434.Pp 2435Refer to the 2436.Dq MSChap 2437description below for more details. 2438.It lqr 2439Default: Disabled and Accepted. This option decides if Link Quality 2440Requests will be sent or accepted. LQR is a protocol that allows 2441.Nm 2442to determine that the link is down without relying on the modems 2443carrier detect. When LQR is enabled, 2444.Nm 2445sends the 2446.Em QUALPROTO 2447option (see 2448.Dq set lqrperiod 2449below) as part of the LCP request. If the peer agrees, both sides will 2450exchange LQR packets at the agreed frequency, allowing detailed link 2451quality monitoring by enabling LQM logging. If the peer doesn't agree, 2452ppp will send ECHO LQR requests instead. These packets pass no 2453information of interest, but they 2454.Em MUST 2455be replied to by the peer. 2456.Pp 2457Whether using LQR or ECHO LQR, 2458.Nm 2459will abruptly drop the connection if 5 unacknowledged packets have been 2460sent rather than sending a 6th. A message is logged at the 2461.Em PHASE 2462level, and any appropriate 2463.Dq reconnect 2464values are honoured as if the peer were responsible for dropping the 2465connection. 2466.It MSChap|chap80nt 2467Default: Disabled and Accepted. The use of this authentication protocol 2468is discouraged as it partially violates the authentication protocol by 2469implementing two different mechanisms (LANMan & NT) under the guise of 2470a single CHAP type (0x80). It is very similar to standard CHAP (type 0x05) 2471except that it issues challenges of a fixed 8 bytes in length and uses a 2472combination of MD4 and DES to encrypt the challenge rather than using the 2473standard MD5 mechanism. CHAP type 0x80 for LANMan is also supported - see 2474.Dq enable LANMan 2475for details. 2476.Pp 2477Because both 2478.Dq LANMan 2479and 2480.Dq NT 2481use CHAP type 0x80, when acting as authenticator with both 2482.Dq enable Ns No d , 2483.Nm 2484will rechallenge the peer up to three times if it responds using the wrong 2485one of the two protocols. This gives the peer a chance to attempt using 2486both protocols. 2487.Pp 2488Conversely, when 2489.Nm 2490acts as the authenticatee with both protocols 2491.Dq accept Ns No ed , 2492the protocols are used alternately in response to challenges. 2493.Pp 2494Note: If only LANMan is enabled, 2495.Xr pppd 8 2496(version 2.3.5) misbehaves when acting as authenticatee. It provides both 2497the NT and the LANMan answers, but also suggests that only the NT answer 2498should be used. 2499.It pap 2500Default: Disabled and Accepted. PAP stands for Password Authentication 2501Protocol. Only one of PAP and CHAP (above) may be negotiated. With 2502PAP, the ID and Password are sent repeatedly to the peer until 2503authentication is acknowledged or the connection is terminated. This 2504is a rather poor security mechanism. It is only performed when the 2505connection is first established. 2506If you want to have your peer authenticate itself, you must 2507.Dq enable pap . 2508in 2509.Pa /etc/ppp/ppp.conf , 2510and have an entry in 2511.Pa /etc/ppp/ppp.secret 2512for the peer (although see the 2513.Dq passwdauth 2514and 2515.Dq set radius 2516options below). 2517.Pp 2518When using PAP as the client, you need only specify 2519.Dq AuthName 2520and 2521.Dq AuthKey 2522in 2523.Pa /etc/ppp/ppp.conf . 2524PAP is accepted by default. 2525.It pred1 2526Default: Enabled and Accepted. This option decides if Predictor 1 2527compression will be used by the Compression Control Protocol (CCP). 2528.It protocomp 2529Default: Enabled and Accepted. This option is used to negotiate 2530PFC (Protocol Field Compression), a mechanism where the protocol 2531field number is reduced to one octet rather than two. 2532.It shortseq 2533Default: Enabled and Accepted. This option determines if 2534.Nm 2535will request and accept requests for short 2536.Pq 12 bit 2537sequence numbers when negotiating multi-link mode. This is only 2538applicable if our MRRU is set (thus enabling multi-link). 2539.It vjcomp 2540Default: Enabled and Accepted. This option determines if Van Jacobson 2541header compression will be used. 2542.El 2543.Pp 2544The following options are not actually negotiated with the peer. 2545Therefore, accepting or denying them makes no sense. 2546.Bl -tag -width XX 2547.It idcheck 2548Default: Enabled. When 2549.Nm 2550exchanges low-level LCP, CCP and IPCP configuration traffic, the 2551.Em Identifier 2552field of any replies is expected to be the same as that of the request. 2553By default, 2554.Nm 2555drops any reply packets that do not contain the expected identifier 2556field, reporting the fact at the respective log level. If 2557.Ar idcheck 2558is disabled, 2559.Nm 2560will ignore the identifier field. 2561.It keep-session 2562Default: Disabled. When 2563.Nm 2564runs as a Multi-link server, a different 2565.Nm 2566instance initially receives each connection. After determining that 2567the link belongs to an already existing bundle (controlled by another 2568.Nm 2569invocation), 2570.Nm 2571will transfer the link to that process. 2572.Pp 2573If the link is a tty device or if this option is enabled, 2574.Nm 2575will not exit, but will change its process name to 2576.Dq session owner 2577and wait for the controlling 2578.Nm 2579to finish with the link and deliver a signal back to the idle process. 2580This prevents the confusion that results from 2581.Nm ppp Ns No 's 2582parent considering the link resource available again. 2583.Pp 2584For tty devices that have entries in 2585.Pa /etc/ttys , 2586this is necessary to prevent another 2587.Xr getty 8 2588from being started, and for program links such as 2589.Xr sshd 8 , 2590it prevents 2591.Xr sshd 8 2592from exiting due to the death of its child. As 2593.Nm 2594cannot determine its parents requirements (except for the tty case), this 2595option must be enabled manually depending on the circumstances. 2596.It loopback 2597Default: Enabled. When 2598.Ar loopback 2599is enabled, 2600.Nm 2601will automatically loop back packets being sent 2602out with a destination address equal to that of the 2603.Em PPP 2604interface. If disabled, 2605.Nm 2606will send the packet, probably resulting in an ICMP redirect from 2607the other end. It is convenient to have this option enabled when 2608the interface is also the default route as it avoids the necessity 2609of a loopback route. 2610.It passwdauth 2611Default: Disabled. Enabling this option will tell the PAP authentication 2612code to use the password database (see 2613.Xr passwd 5 ) 2614to authenticate the caller if they cannot be found in the 2615.Pa /etc/ppp/ppp.secret 2616file. 2617.Pa /etc/ppp/ppp.secret 2618is always checked first. If you wish to use passwords from 2619.Xr passwd 5 , 2620but also to specify an IP number or label for a given client, use 2621.Dq \&* 2622as the client password in 2623.Pa /etc/ppp/ppp.secret . 2624.It proxy 2625Default: Disabled. Enabling this option will tell 2626.Nm 2627to proxy ARP for the peer. This means that 2628.Nm 2629will make an entry in the ARP table using 2630.Dv HISADDR 2631and the 2632.Dv MAC 2633address of the local network in which 2634.Dv HISADDR 2635appears. The proxy entry cannot be made unless 2636.Dv HISADDR 2637is an address from a LAN. 2638.It proxyall 2639Default: Disabled. Enabling this will tell 2640.Nm 2641to add proxy arp entries for every IP address in all class C or 2642smaller subnets routed via the tun interface. 2643.Pp 2644Proxy arp entries are only made for sticky routes that are added 2645using the 2646.Dq add 2647command. No proxy arp entries are made for the interface address itself 2648(as created by the 2649.Dq set ifaddr 2650command). 2651.It sroutes 2652Default: Enabled. When the 2653.Dq add 2654command is used with the 2655.Dv HISADDR 2656or 2657.Dv MYADDR 2658values, entries are stored in the 2659.Sq stick route 2660list. Each time 2661.Dv HISADDR 2662or 2663.Dv MYADDR 2664change, this list is re-applied to the routing table. 2665.Pp 2666Disabling this option will prevent the re-application of sticky routes, 2667although the 2668.Sq stick route 2669list will still be maintained. 2670.It throughput 2671Default: Enabled. This option tells 2672.Nm 2673to gather throughput statistics. Input and output is sampled over 2674a rolling 5 second window, and current, best and total figures are 2675retained. This data is output when the relevant 2676.Em PPP 2677layer shuts down, and is also available using the 2678.Dq show 2679command. Throughput statistics are available at the 2680.Dq IPCP 2681and 2682.Dq physical 2683levels. 2684.It utmp 2685Default: Enabled. Normally, when a user is authenticated using PAP or 2686CHAP, and when 2687.Nm 2688is running in 2689.Fl direct 2690mode, an entry is made in the utmp and wtmp files for that user. Disabling 2691this option will tell 2692.Nm 2693not to make any utmp or wtmp entries. This is usually only necessary if 2694you require the user to both login and authenticate themselves. 2695.It iface-alias 2696Default: Enabled if 2697.Fl nat 2698is specified. This option simply tells 2699.Nm 2700to add new interface addresses to the interface rather than replacing them. 2701The option can only be enabled if network address translation is enabled 2702.Pq Dq nat enable yes . 2703.Pp 2704With this option enabled, 2705.Nm 2706will pass traffic for old interface addresses through the NAT engine 2707.Pq see Xr libalias 5 , 2708resulting in the ability (in 2709.Fl auto 2710mode) to properly connect the process that caused the PPP link to 2711come up in the first place. 2712.Pp 2713Disabling NAT with 2714.Dq nat enable no 2715will also disable 2716.Sq iface-alias . 2717.El 2718.Pp 2719.It add Ns Xo 2720.Op \&! 2721.Ar dest Ns Op / Ns Ar nn 2722.Op Ar mask 2723.Op Ar gateway 2724.Xc 2725.Ar Dest 2726is the destination IP address. The netmask is specified either as a 2727number of bits with 2728.Ar /nn 2729or as an IP number using 2730.Ar mask . 2731.Ar 0 0 2732or simply 2733.Ar 0 2734with no mask refers to the default route. It is also possible to use the 2735literal name 2736.Sq default 2737instead of 2738.Ar 0 . 2739.Ar Gateway 2740is the next hop gateway to get to the given 2741.Ar dest 2742machine/network. Refer to the 2743.Xr route 8 2744command for further details. 2745.Pp 2746It is possible to use the symbolic names 2747.Sq MYADDR 2748or 2749.Sq HISADDR 2750as the destination, and 2751.Sq HISADDR 2752as the 2753.Ar gateway . 2754.Sq MYADDR 2755is replaced with the interface address and 2756.Sq HISADDR 2757is replaced with the interface destination (peer) address. 2758.Pp 2759If the 2760.Ar add! 2761command is used 2762.Pq note the trailing Dq \&! , 2763then if the route already exists, it will be updated as with the 2764.Sq route change 2765command (see 2766.Xr route 8 2767for further details). 2768.Pp 2769Routes that contain the 2770.Dq HISADDR 2771or 2772.Dq MYADDR 2773constants are considered 2774.Sq sticky . 2775They are stored in a list (use 2776.Dq show ipcp 2777to see the list), and each time the value of 2778.Dv HISADDR 2779or 2780.Dv MYADDR 2781changes, the appropriate routing table entries are updated. This facility 2782may be disabled using 2783.Dq disable sroutes . 2784.It allow Ar command Op Ar args 2785This command controls access to 2786.Nm 2787and its configuration files. It is possible to allow user-level access, 2788depending on the configuration file label and on the mode that 2789.Nm 2790is being run in. For example, you may wish to configure 2791.Nm 2792so that only user 2793.Sq fred 2794may access label 2795.Sq fredlabel 2796in 2797.Fl background 2798mode. 2799.Pp 2800User id 0 is immune to these commands. 2801.Bl -tag -width XX 2802.It allow user Ns Xo 2803.Op s 2804.Ar logname Ns No ... 2805.Xc 2806By default, only user id 0 is allowed access to 2807.Nm ppp . 2808If this command is used, all of the listed users are allowed access to 2809the section in which the 2810.Dq allow users 2811command is found. The 2812.Sq default 2813section is always checked first (even though it is only ever automatically 2814loaded at startup). Each successive 2815.Dq allow users 2816command overrides the previous one, so it's possible to allow users access 2817to everything except a given label by specifying default users in the 2818.Sq default 2819section, and then specifying a new user list for that label. 2820.Pp 2821If user 2822.Sq * 2823is specified, access is allowed to all users. 2824.It allow mode Ns Xo 2825.Op s 2826.Ar mode Ns No ... 2827.Xc 2828By default, access using any 2829.Nm 2830mode is possible. If this command is used, it restricts the access 2831.Ar modes 2832allowed to load the label under which this command is specified. 2833Again, as with the 2834.Dq allow users 2835command, each 2836.Dq allow modes 2837command overrides any previous settings, and the 2838.Sq default 2839section is always checked first. 2840.Pp 2841Possible modes are: 2842.Sq interactive , 2843.Sq auto , 2844.Sq direct , 2845.Sq dedicated , 2846.Sq ddial , 2847.Sq background 2848and 2849.Sq * . 2850.Pp 2851When running in multi-link mode, a section can be loaded if it allows 2852.Em any 2853of the currently existing line modes. 2854.El 2855.Pp 2856.It nat Ar command Op Ar args 2857This command allows the control of the network address translation (also 2858known as masquerading or IP aliasing) facilities that are built into 2859.Nm ppp . 2860NAT is done on the external interface only, and is unlikely to make sense 2861if used with the 2862.Fl direct 2863flag. 2864.Pp 2865For backwards compatibility, the word 2866.Dq alias 2867may be used in place of 2868.Dq nat . 2869If nat is enabled on your system (it may be omitted at compile time), 2870the following commands are possible: 2871.Bl -tag -width XX 2872.It nat enable yes|no 2873This command either switches network address translation on or turns it off. 2874The 2875.Fl nat 2876command line flag is synonymous with 2877.Dq nat enable yes . 2878.It nat addr Op Ar addr_local addr_alias 2879This command allows data for 2880.Ar addr_alias 2881to be redirected to 2882.Ar addr_local . 2883It is useful if you own a small number of real IP numbers that 2884you wish to map to specific machines behind your gateway. 2885.It nat deny_incoming yes|no 2886If set to yes, this command will refuse all incoming connections 2887by dropping the packets in much the same way as a firewall would. 2888.It nat help|? 2889This command gives a summary of available nat commands. 2890.It nat log yes|no 2891This option causes various NAT statistics and information to 2892be logged to the file 2893.Pa /var/log/alias.log . 2894This file name is likely to change in the near future. 2895.It nat port Ar proto Ar targetIP Ns Xo 2896.No : Ns Ar targetPort Ns 2897.Oo 2898.No - Ns Ar targetPort 2899.Oc Ar aliasPort Ns 2900.Oo 2901.No - Ns Ar aliasPort 2902.Oc Oo Ar remoteIP : Ns 2903.Ar remotePort Ns 2904.Oo 2905.No - Ns Ar remotePort 2906.Oc Oc 2907.Xc 2908This command causes incoming 2909.Ar proto 2910connections to 2911.Ar aliasPort 2912to be redirected to 2913.Ar targetPort 2914on 2915.Ar targetIP . 2916.Ar proto 2917is either 2918.Dq tcp 2919or 2920.Dq udp . 2921.Pp 2922A range of port numbers may be specified as shown above. The ranges 2923must be of the same size. 2924.Pp 2925If 2926.Ar remoteIP 2927is specified, only data coming from that IP number is redirected. 2928.Ar remotePort 2929must either be 2930.Dq 0 2931.Pq indicating any source port 2932or a range of ports the same size as the other ranges. 2933.Pp 2934This option is useful if you wish to run things like Internet phone on 2935machines behind your gateway, but is limited in that connections to only 2936one interior machine per source machine and target port are possible. 2937.It nat pptp Op Ar addr 2938This tells 2939.Nm 2940to translate any 2941.Em G Ns No eneral 2942.Em R Ns No outing 2943.Em E Ns No encapsulated 2944.Pq Dv IPPROTO_GRE 2945packets using 2946.Ar addr 2947rather than the local interface address. This allows the uses of the 2948.Em P Ns No oint 2949to 2950.Em P Ns No oint 2951.Em T Ns No unneling 2952.Em P Ns No rotocol 2953on a machine on the internal network. 2954.Pp 2955If 2956.Ar addr 2957is not specified, 2958.Dv PPTP 2959address translation is disabled. 2960.It "nat proxy cmd" Ar arg Ns No ... 2961This command tells 2962.Nm 2963to proxy certain connections, redirecting them to a given server. Refer 2964to the description of 2965.Fn PacketAliasProxyRule 2966in 2967.Xr libalias 3 2968for details of the available commands. 2969.It nat same_ports yes|no 2970When enabled, this command will tell the network address translation engine to 2971 attempt to avoid changing the port number on outgoing packets. This is useful 2972if you want to support protocols such as RPC and LPD which require 2973connections to come from a well known port. 2974.It nat use_sockets yes|no 2975When enabled, this option tells the network address translation engine to 2976create a socket so that it can guarantee a correct incoming ftp data or 2977IRC connection. 2978.It nat unregistered_only yes|no 2979Only alter outgoing packets with an unregistered source ad- 2980dress. According to RFC 1918, unregistered source addresses 2981are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. 2982.El 2983.Pp 2984These commands are also discussed in the file 2985.Pa README.alias 2986which comes with the source distribution. 2987.Pp 2988.It Op \&! Ns Xo 2989.No bg Ar command 2990.Xc 2991The given 2992.Ar command 2993is executed in the background with the following words replaced: 2994.Bl -tag -width PEER_ENDDISC 2995.It Li AUTHNAME 2996This is replaced with the local 2997.Ar authname 2998value. See the 2999.Dq set authname 3000command below. 3001.It Li ENDDISC 3002This is replaced with the local endpoint discriminator value. See the 3003.Dq set enddisc 3004command below. 3005.It Li HISADDR 3006This is replaced with the peers IP number. 3007.It Li INTERFACE 3008This is replaced with the name of the interface that's in use. 3009.It Li LABEL 3010This is replaced with the last label name used. A label may be specified 3011on the 3012.Nm 3013command line, via the 3014.Dq load 3015or 3016.Dq dial 3017commands and in the 3018.Pa ppp.secret 3019file. 3020.It Li MYADDR 3021This is replaced with the IP number assigned to the local interface. 3022.It Li PEER_ENDDISC 3023This is replaced with the value of the peers endpoint discriminator. 3024.It Li PROCESSID 3025This is replaced with the current process id. 3026.It Li USER 3027This is replaced with the username that has been authenticated with PAP or 3028CHAP. Normally, this variable is assigned only in -direct mode. This value 3029is available irrespective of whether utmp logging is enabled. 3030.El 3031.Pp 3032These substitutions are also done by the 3033.Dq set proctitle 3034command. 3035.Pp 3036If you wish to pause 3037.Nm 3038while the command executes, use the 3039.Dq shell 3040command instead. 3041.It clear physical|ipcp Op current|overall|peak... 3042Clear the specified throughput values at either the 3043.Dq physical 3044or 3045.Dq ipcp 3046level. If 3047.Dq physical 3048is specified, context must be given (see the 3049.Dq link 3050command below). If no second argument is given, all values are 3051cleared. 3052.It clone Ar name Ns Xo 3053.Op \&, Ns Ar name Ns 3054.No ... 3055.Xc 3056Clone the specified link, creating one or more new links according to the 3057.Ar name 3058argument(s). This command must be used from the 3059.Dq link 3060command below unless you've only got a single link (in which case that 3061link becomes the default). Links may be removed using the 3062.Dq remove 3063command below. 3064.Pp 3065The default link name is 3066.Dq deflink . 3067.It close Op lcp|ccp Ns Op \&! 3068If no arguments are given, the relevant protocol layers will be brought 3069down and the link will be closed. If 3070.Dq lcp 3071is specified, the LCP layer is brought down, but 3072.Nm 3073will not bring the link offline. It is subsequently possible to use 3074.Dq term 3075.Pq see below 3076to talk to the peer machine if, for example, something like 3077.Dq slirp 3078is being used. If 3079.Dq ccp 3080is specified, only the relevant compression layer is closed. If the 3081.Dq \&! 3082is used, the compression layer will remain in the closed state, otherwise 3083it will re-enter the STOPPED state, waiting for the peer to initiate 3084further CCP negotiation. In any event, this command does not disconnect 3085the user from 3086.Nm 3087or exit 3088.Nm ppp . 3089See the 3090.Dq quit 3091command below. 3092.It delete Ns Xo 3093.Op \&! 3094.Ar dest 3095.Xc 3096This command deletes the route with the given 3097.Ar dest 3098IP address. If 3099.Ar dest 3100is specified as 3101.Sq ALL , 3102all non-direct entries in the routing table for the current interface, 3103and all 3104.Sq sticky route 3105entries are deleted. If 3106.Ar dest 3107is specified as 3108.Sq default , 3109the default route is deleted. 3110.Pp 3111If the 3112.Ar delete! 3113command is used 3114.Pq note the trailing Dq \&! , 3115.Nm 3116will not complain if the route does not already exist. 3117.It dial|call Op Ar label Ns Xo 3118.No ... 3119.Xc 3120This command is the equivalent of 3121.Dq load label 3122followed by 3123.Dq open , 3124and is provided for backwards compatibility. 3125.It down Op Ar lcp|ccp 3126Bring the relevant layer down ungracefully, as if the underlying layer 3127had become unavailable. It's not considered polite to use this command on 3128a Finite State Machine that's in the OPEN state. If no arguments are 3129supplied, the entire link is closed (or if no context is given, all links 3130are terminated). If 3131.Sq lcp 3132is specified, the 3133.Em LCP 3134layer is terminated but the device is not brought offline and the link 3135is not closed. If 3136.Sq ccp 3137is specified, only the relevant compression layer(s) are terminated. 3138.It help|? Op Ar command 3139Show a list of available commands. If 3140.Ar command 3141is specified, show the usage string for that command. 3142.It iface Ar command Op args 3143This command is used to control the interface used by 3144.Nm ppp . 3145.Ar Command 3146may be one of the following: 3147.Bl -tag -width XX 3148.It iface add Ns Xo 3149.Op \&! 3150.Ar addr Ns Op / Ns Ar bits 3151.Op Ar peer 3152.Xc 3153.It iface add Ns Xo 3154.Op \&! 3155.Ar addr 3156.Ar mask 3157.Ar peer 3158.Xc 3159Add the given 3160.Ar addr mask peer 3161combination to the interface. Instead of specifying 3162.Ar mask , 3163.Ar /bits 3164can be used 3165.Pq with no space between \&it and Ar addr . 3166If the given address already exists, the command fails unless the 3167.Dq \&! 3168is used - in which case the previous interface address entry is overwritten 3169with the new one, allowing a change of netmask or peer address. 3170.Pp 3171If only 3172.Ar addr 3173is specified, 3174.Ar bits 3175defaults to 3176.Dq 32 3177and 3178.Ar peer 3179defaults to 3180.Dq 255.255.255.255 . 3181This address (the broadcast address) is the only duplicate peer address that 3182.Nm 3183allows. 3184.It iface clear 3185If this command is used while 3186.Nm 3187is in the OPENED state or while in 3188.Fl auto 3189mode, all addresses except for the IPCP negotiated address are deleted 3190from the interface. If 3191.Nm 3192is not in the OPENED state and is not in 3193.Fl auto 3194mode, all interface addresses are deleted. 3195.Pp 3196.It iface delete Ns Xo 3197.Op \&! Ns 3198.No |rm Ns Op \&! 3199.Ar addr 3200.Xc 3201This command deletes the given 3202.Ar addr 3203from the interface. If the 3204.Dq \&! 3205is used, no error is given if the address isn't currently assigned to 3206the interface (and no deletion takes place). 3207.It iface show 3208Shows the current state and current addresses for the interface. It is 3209much the same as running 3210.Dq ifconfig INTERFACE . 3211.It iface help Op Ar sub-command 3212This command, when invoked without 3213.Ar sub-command , 3214will show a list of possible 3215.Dq iface 3216sub-commands and a brief synopsis for each. When invoked with 3217.Ar sub-command , 3218only the synopsis for the given sub-command is shown. 3219.El 3220.It Op data Ns Xo 3221.No link 3222.Ar name Ns Op , Ns Ar name Ns 3223.No ... Ar command Op Ar args 3224.Xc 3225This command may prefix any other command if the user wishes to 3226specify which link the command should affect. This is only 3227applicable after multiple links have been created in Multi-link 3228mode using the 3229.Dq clone 3230command. 3231.Pp 3232.Ar Name 3233specifies the name of an existing link. If 3234.Ar name 3235is a comma separated list, 3236.Ar command 3237is executed on each link. If 3238.Ar name 3239is 3240.Dq * , 3241.Ar command 3242is executed on all links. 3243.It load Op Ar label Ns Xo 3244.No ... 3245.Xc 3246Load the given 3247.Ar label Ns No (s) 3248from the 3249.Pa ppp.conf 3250file. If 3251.Ar label 3252is not given, the 3253.Ar default 3254label is used. 3255.Pp 3256Unless the 3257.Ar label 3258section uses the 3259.Dq set mode , 3260.Dq open 3261or 3262.Dq dial 3263commands, 3264.Nm 3265will not attempt to make an immediate connection. 3266.It open Op lcp|ccp|ipcp 3267This is the opposite of the 3268.Dq close 3269command. All closed links are immediately brought up apart from second 3270and subsequent 3271.Ar demand-dial 3272links - these will come up based on the 3273.Dq set autoload 3274command that has been used. 3275.Pp 3276If the 3277.Dq lcp 3278argument is used while the LCP layer is already open, LCP will be 3279renegotiated. This allows various LCP options to be changed, after which 3280.Dq open lcp 3281can be used to put them into effect. After renegotiating LCP, 3282any agreed authentication will also take place. 3283.Pp 3284If the 3285.Dq ccp 3286argument is used, the relevant compression layer is opened. Again, 3287if it is already open, it will be renegotiated. 3288.Pp 3289If the 3290.Dq ipcp 3291argument is used, the link will be brought up as normal, but if 3292IPCP is already open, it will be renegotiated and the network 3293interface will be reconfigured. 3294.Pp 3295It is probably not good practice to re-open the PPP state machines 3296like this as it's possible that the peer will not behave correctly. 3297It 3298.Em is 3299however useful as a way of forcing the CCP or VJ dictionaries to be reset. 3300.It passwd Ar pass 3301Specify the password required for access to the full 3302.Nm 3303command set. This password is required when connecting to the diagnostic 3304port (see the 3305.Dq set server 3306command). 3307.Ar Pass 3308is specified on the 3309.Dq set server 3310command line. The value of 3311.Ar pass 3312is not logged when 3313.Ar command 3314logging is active, instead, the literal string 3315.Sq ******** 3316is logged. 3317.It quit|bye Op all 3318If 3319.Dq quit 3320is executed from the controlling connection or from a command file, 3321ppp will exit after closing all connections. Otherwise, if the user 3322is connected to a diagnostic socket, the connection is simply dropped. 3323.Pp 3324If the 3325.Ar all 3326argument is given, 3327.Nm 3328will exit despite the source of the command after closing all existing 3329connections. 3330.It remove|rm 3331This command removes the given link. It is only really useful in 3332multi-link mode. A link must be 3333in the 3334.Dv CLOSED 3335state before it is removed. 3336.It rename|mv Ar name 3337This command renames the given link to 3338.Ar name . 3339It will fail if 3340.Ar name 3341is already used by another link. 3342.Pp 3343The default link name is 3344.Sq deflink . 3345Renaming it to 3346.Sq modem , 3347.Sq cuaa0 3348or 3349.Sq USR 3350may make the log file more readable. 3351.It save 3352This option is not (yet) implemented. 3353.It set Ns Xo 3354.No Op up 3355.Ar var value 3356.Xc 3357This option allows the setting of any of the following variables: 3358.Bl -tag -width XX 3359.It set accmap Ar hex-value 3360ACCMap stands for Asynchronous Control Character Map. This is always 3361negotiated with the peer, and defaults to a value of 00000000 in hex. 3362This protocol is required to defeat hardware that depends on passing 3363certain characters from end to end (such as XON/XOFF etc). 3364.Pp 3365For the XON/XOFF scenario, use 3366.Dq set accmap 000a0000 . 3367.It set Op auth Ns Xo 3368.No key Ar value 3369.Xc 3370This sets the authentication key (or password) used in client mode 3371PAP or CHAP negotiation to the given value. It also specifies the 3372password to be used in the dial or login scripts in place of the 3373.Sq \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\P 3374sequence, preventing the actual password from being logged. If 3375.Ar command 3376or 3377.Ar chat 3378logging is in effect, 3379.Ar value 3380is logged as 3381.Sq ******** 3382for security reasons. 3383.Pp 3384If the first character of 3385.Ar value 3386is an exclaimation mark 3387.Pq Dq \&! , 3388.Nm 3389treats the remainder of the string as a program that must be executed 3390to determine the 3391.Dq authname 3392and 3393.Dq authkey 3394values. 3395.Pp 3396Ignoring the 3397.Dq \&! , 3398.Ar value 3399is parsed as a program to execute in the same was as the 3400.Dq !bg 3401command above, substituting special names in the same manner. Once executed, 3402.Nm 3403will feed the program three lines of input, each terminated by a newline 3404character: 3405.Bl -bullet 3406.It 3407The host name as sent in the CHAP challenge. 3408.It 3409The challenge string as sent in the CHAP challenge. 3410.It 3411The locally defined 3412.Dq authname . 3413.El 3414.Pp 3415Two lines of output are expected: 3416.Bl -bullet 3417.It 3418The 3419.Dq authname 3420to be sent with the CHAP response. 3421.It 3422The 3423.Dq authkey , 3424which is encrypted with the challenge and request id, the answer being sent 3425in the CHAP response packet. 3426.El 3427.Pp 3428When configuring 3429.Nm 3430in this manner, it's expected that the host challenge is a series of ASCII 3431digits or characters. An encryption device or Secure ID card is usually 3432required to calculate the secret appropriate for the given challenge. 3433.It set authname Ar id 3434This sets the authentication id used in client mode PAP or CHAP negotiation. 3435.Pp 3436If used in 3437.Fl direct 3438mode with CHAP enabled, 3439.Ar id 3440is used in the initial authentication challenge and should normally be set to 3441the local machine name. 3442.It set autoload Xo 3443.Ar min-percent max-percent period 3444.Xc 3445These settings apply only in multi-link mode and default to zero, zero and 3446five respectively. 3447When more than one 3448.Ar demand-dial 3449.Pq also known as Fl auto 3450mode link is available, only the first link is made active when 3451.Nm 3452first reads data from the tun device. The next 3453.Ar demand-dial 3454link will be opened only when the current bundle throughput is at least 3455.Ar max-percent 3456percent of the total bundle bandwidth for 3457.Ar period 3458seconds. When the current bundle throughput decreases to 3459.Ar min-percent 3460percent or less of the total bundle bandwidth for 3461.Ar period 3462seconds, a 3463.Ar demand-dial 3464link will be brought down as long as it's not the last active 3465.Ar demand-dial 3466link. 3467.Pp 3468The default values cause 3469.Ar demand-dial 3470links to simply come up one at a time. 3471.Pp 3472Certain devices cannot determine their physical bandwidth, so it 3473is sometimes necessary to use the 3474.Dq set bandwidth 3475command (described below) to make 3476.Dq set autoload 3477work correctly. 3478.It set bandwidth Ar value 3479This command sets the connection bandwidth in bits per second. 3480.Ar value 3481must be greater than zero. It is currently only used by the 3482.Dq set autoload 3483command above. 3484.It set callback Ar option Ns No ... 3485If no arguments are given, callback is disabled, otherwise, 3486.Nm 3487will request (or in 3488.Fl direct 3489mode, will accept) one of the given 3490.Ar option Ns No s . 3491In client mode, if an 3492.Ar option 3493is NAK'd 3494.Nm 3495will request a different 3496.Ar option , 3497until no options remain at which point 3498.Nm 3499will terminate negotiations (unless 3500.Dq none 3501is one of the specified 3502.Ar option Ns No ). 3503In server mode, 3504.Nm 3505will accept any of the given protocols - but the client 3506.Em must 3507request one of them. If you wish callback to be optional, you must include 3508.Ar none 3509as an option. 3510.Pp 3511The 3512.Ar option Ns No s 3513are as follows (in this order of preference): 3514.Pp 3515.Bl -tag 3516.It auth 3517The callee is expected to decide the callback number based on 3518authentication. If 3519.Nm 3520is the callee, the number should be specified as the fifth field of 3521the peers entry in 3522.Pa /etc/ppp/ppp.secret . 3523.It cbcp 3524Microsofts callback control protocol is used. See 3525.Dq set cbcp 3526below. 3527.Pp 3528If you wish to negotiate 3529.Ar cbcp 3530in client mode but also wish to allow the server to request no callback at 3531CBCP negotiation time, you must specify both 3532.Ar cbcp 3533and 3534.Ar none 3535as callback options. 3536.It E.164 *| Ns Xo 3537.Ar number Ns Op , Ns Ar number Ns 3538.No ... 3539.Xc 3540The caller specifies the 3541.Ar number . 3542If 3543.Nm 3544is the callee, 3545.Ar number 3546should be either a comma separated list of allowable numbers or a 3547.Dq \&* , 3548meaning any number is permitted. If 3549.Nm 3550is the caller, only a single number should be specified. 3551.Pp 3552Note, this option is very unsafe when used with a 3553.Dq \&* 3554as a malicious caller can tell 3555.Nm 3556to call any (possibly international) number without first authenticating 3557themselves. 3558.It none 3559If the peer does not wish to do callback at all, 3560.Nm 3561will accept the fact and continue without callback rather than terminating 3562the connection. This is required (in addition to one or more other callback 3563options) if you wish callback to be optional. 3564.El 3565.Pp 3566.It set cbcp Oo Xo 3567.No *| Ns Ar number Ns No 3568.Oo 3569.No , Ns Ar number Ns 3570.Oc 3571.No ... 3572.Op Ar delay Op Ar retry 3573.Oc 3574.Xc 3575If no arguments are given, CBCP (Microsofts CallBack Control Protocol) 3576is disabled - ie, configuring CBCP in the 3577.Dq set callback 3578command will result in 3579.Nm 3580requesting no callback in the CBCP phase. 3581Otherwise, 3582.Nm 3583attempts to use the given phone 3584.Ar number Ns No (s). 3585.Pp 3586In server mode 3587.Pq Fl direct , 3588.Nm 3589will insist that the client uses one of these numbers, unless 3590.Dq \&* 3591is used in which case the client is expected to specify the number. 3592.Pp 3593In client mode, 3594.Nm 3595will attempt to use one of the given numbers (whichever it finds to 3596be agreeable with the peer), or if 3597.Dq \&* 3598is specified, 3599.Nm 3600will expect the peer to specify the number. 3601.It "set cd off|" Ns Ar seconds Ns Op \&! 3602Normally, 3603.Nm 3604checks for the existence of carrier one second after the login script is 3605complete. If it's not set, 3606.Nm 3607assumes that this is because the device doesn't support carrier (which 3608is true for most 3609.Dq laplink 3610NULL-modem cables), logs the fact and stops checking 3611for carrier. However, some modems take some time to assert the carrier 3612signal, resulting in 3613.Nm ppp Ns No s 3614inability to detect when the link is dropped. 3615.Ar seconds 3616specifies the number of seconds that 3617.Nm 3618should wait after the dial script has finished before deciding if 3619carrier is available or not. 3620.Pp 3621If 3622.Dq off 3623is specified, 3624.Nm 3625will not check for carrier on the device, otherwise 3626.Nm 3627will not proceed to the login script until either carrier is detected 3628or until 3629.Ar seconds 3630has elapsed. 3631.Pp 3632If 3633.Ar seconds 3634is followed immediately by an exclaimation mark 3635.Pq Dq \&! , 3636.Nm 3637will 3638.Em require 3639carrier. If carrier is not detected after 3640.Ar seconds 3641seconds, the link will be disconnected. 3642.Pp 3643For ISDN devices, 3644.Nm 3645will always insist on carrier (the value 3646.Dq off 3647is invalid). Carrier is raised by the i4brbchX device driver only after 3648the call has connected. It is therefore wise to set a reasonable value 3649such as 3650.Ar 6 3651seconds. 3652.Pp 3653Carrier 3654.Em require Ns No ment 3655is ignored for all other device types - as if set to 3656.Dq off . 3657.It set choked Op Ar timeout 3658This sets the number of seconds that 3659.Nm 3660will keep a choked output queue before dropping all pending output packets. 3661If 3662.Ar timeout 3663is less than or equal to zero or if 3664.Ar timeout 3665isn't specified, it is set to the default value of 3666.Em 120 seconds . 3667.Pp 3668A choked output queue occurs when 3669.Nm 3670has read a certain number of packets from the local network for transmission, 3671but cannot send the data due to link failure (the peer is busy etc.). 3672.Nm 3673will not read packets indefinitely. Instead, it reads up to 3674.Em 30 3675packets (or 3676.Em 30 No + 3677.Em nlinks No * 3678.Em 2 3679packets in multi-link mode), then stops reading the network interface 3680until either 3681.Ar timeout 3682seconds have passed or at least one packet has been sent. 3683.Pp 3684If 3685.Ar timeout 3686seconds pass, all pending output packets are dropped. 3687.It set ctsrts|crtscts on|off 3688This sets hardware flow control. Hardware flow control is 3689.Ar on 3690by default. 3691.It set deflate Ar out-winsize Op Ar in-winsize 3692This sets the DEFLATE algorithms default outgoing and incoming window 3693sizes. Both 3694.Ar out-winsize 3695and 3696.Ar in-winsize 3697must be values between 3698.Em 8 3699and 3700.Em 15 . 3701If 3702.Ar in-winsize 3703is specified, 3704.Nm 3705will insist that this window size is used and will not accept any other 3706values from the peer. 3707.It set dns Op Ar primary Op Ar secondary 3708This command specifies DNS overrides for the 3709.Dq accept dns 3710command. Refer to the 3711.Dq accept 3712command description above for details. This command does not affect the 3713IP numbers requested using 3714.Dq enable dns . 3715.It set device|line Xo 3716.Ar value Ns No ... 3717.Xc 3718This sets the device(s) to which 3719.Nm 3720will talk to the given 3721.Dq value . 3722.Pp 3723All ISDN and serial device names are expected to begin with 3724.Pa /dev/ . 3725ISDN devices are usually called 3726.Pa i4brbchX 3727and serial devices are usually called 3728.Pa cuaaX . 3729.Pp 3730If 3731.Dq value 3732does not begin with 3733.Pa /dev/ , 3734it must either begin with an exclamation mark 3735.Pq Dq \&! , 3736be of the format 3737.No PPPoE: Ns Ar iface Ns Xo 3738.Op \&: Ns Ar provider Ns 3739.Xc 3740or be of the format 3741.Ar host Ns No : Ns Ar port Ns Oo 3742.No /tcp|udp 3743.Oc . 3744.Pp 3745If it begins with an exclamation mark, the rest of the device name is 3746treated as a program name, and that program is executed when the device 3747is opened. Standard input, output and error are fed back to 3748.Nm 3749and are read and written as if they were a regular device. 3750.Pp 3751If a 3752.No PPPoE: Ns Ar iface Ns Xo 3753.Op \&: Ns Ar provider Ns 3754.Xc 3755specification is given, 3756.Nm 3757will attempt to create a 3758.Em PPP 3759over Ethernet connection using the given 3760.Ar iface 3761interface. If a 3762.Ar provider 3763is given, 3764.Nm 3765will attempt to make a connection to that provider only. Refer to 3766.Xr netgraph 4 3767and 3768.Xr ng_pppoe 8 3769for further details. 3770.Pp 3771If a 3772.Ar host Ns No : Ns Ar port Ns Oo 3773.No /tcp|udp 3774.Oc 3775specification is given, 3776.Nm 3777will attempt to connect to the given 3778.Ar host 3779on the given 3780.Ar port . 3781If a 3782.Dq /tcp 3783or 3784.Dq /udp 3785suffix is not provided, the default is 3786.Dq /tcp . 3787Refer to the section on 3788.Em PPP OVER TCP and UDP 3789above for further details. 3790.Pp 3791If multiple 3792.Dq values 3793are specified, 3794.Nm 3795will attempt to open each one in turn until it succeeds or runs out of 3796devices. 3797.It set dial Ar chat-script 3798This specifies the chat script that will be used to dial the other 3799side. See also the 3800.Dq set login 3801command below. Refer to 3802.Xr chat 8 3803and to the example configuration files for details of the chat script 3804format. 3805It is possible to specify some special 3806.Sq values 3807in your chat script as follows: 3808.Bd -unfilled -offset indent 3809.It Li \\\\\\\\\\\\\\\\c 3810When used as the last character in a 3811.Sq send 3812string, this indicates that a newline should not be appended. 3813.It Li \\\\\\\\\\\\\\\\d 3814When the chat script encounters this sequence, it delays two seconds. 3815.It Li \\\\\\\\\\\\\\\\p 3816When the chat script encounters this sequence, it delays for one quarter of 3817a second. 3818.It Li \\\\\\\\\\\\\\\\n 3819This is replaced with a newline character. 3820.It Li \\\\\\\\\\\\\\\\r 3821This is replaced with a carriage return character. 3822.It Li \\\\\\\\\\\\\\\\s 3823This is replaced with a space character. 3824.It Li \\\\\\\\\\\\\\\\t 3825This is replaced with a tab character. 3826.It Li \\\\\\\\\\\\\\\\T 3827This is replaced by the current phone number (see 3828.Dq set phone 3829below). 3830.It Li \\\\\\\\\\\\\\\\P 3831This is replaced by the current 3832.Ar authkey 3833value (see 3834.Dq set authkey 3835above). 3836.It Li \\\\\\\\\\\\\\\\U 3837This is replaced by the current 3838.Ar authname 3839value (see 3840.Dq set authname 3841above). 3842.Ed 3843.Pp 3844Note that two parsers will examine these escape sequences, so in order to 3845have the 3846.Sq chat parser 3847see the escape character, it is necessary to escape it from the 3848.Sq command parser . 3849This means that in practice you should use two escapes, for example: 3850.Bd -literal -offset indent 3851set dial "... ATDT\\\\T CONNECT" 3852.Ed 3853.Pp 3854It is also possible to execute external commands from the chat script. 3855To do this, the first character of the expect or send string is an 3856exclamation mark 3857.Pq Dq \&! . 3858When the command is executed, standard input and standard output are 3859directed to the open device (see the 3860.Dq set device 3861command), and standard error is read by 3862.Nm 3863and substituted as the expect or send string. If 3864.Nm 3865is running in interactive mode, file descriptor 3 is attached to 3866.Pa /dev/tty . 3867.Pp 3868For example (wrapped for readability); 3869.Bd -literal -offset indent 3870set login "TIMEOUT 5 \\"\\" \\"\\" login:--login: ppp \e 3871word: ppp \\"!sh \\\\\\\\-c \\\\\\"echo \\\\\\\\-n label: >&2\\\\\\"\\" \e 3872\\"!/bin/echo in\\" HELLO" 3873.Ed 3874.Pp 3875would result in the following chat sequence (output using the 3876.Sq set log local chat 3877command before dialing): 3878.Bd -literal -offset indent 3879Dial attempt 1 of 1 3880dial OK! 3881Chat: Expecting: 3882Chat: Sending: 3883Chat: Expecting: login:--login: 3884Chat: Wait for (5): login: 3885Chat: Sending: ppp 3886Chat: Expecting: word: 3887Chat: Wait for (5): word: 3888Chat: Sending: ppp 3889Chat: Expecting: !sh \\-c "echo \\-n label: >&2" 3890Chat: Exec: sh -c "echo -n label: >&2" 3891Chat: Wait for (5): !sh \\-c "echo \\-n label: >&2" --> label: 3892Chat: Exec: /bin/echo in 3893Chat: Sending: 3894Chat: Expecting: HELLO 3895Chat: Wait for (5): HELLO 3896login OK! 3897.Ed 3898.Pp 3899Note (again) the use of the escape character, allowing many levels of 3900nesting. Here, there are four parsers at work. The first parses the 3901original line, reading it as three arguments. The second parses the 3902third argument, reading it as 11 arguments. At this point, it is 3903important that the 3904.Dq \&- 3905signs are escaped, otherwise this parser will see them as constituting 3906an expect-send-expect sequence. When the 3907.Dq \&! 3908character is seen, the execution parser reads the first command as three 3909arguments, and then 3910.Xr sh 1 3911itself expands the argument after the 3912.Fl c . 3913As we wish to send the output back to the modem, in the first example 3914we redirect our output to file descriptor 2 (stderr) so that 3915.Nm 3916itself sends and logs it, and in the second example, we just output to stdout, 3917which is attached directly to the modem. 3918.Pp 3919This, of course means that it is possible to execute an entirely external 3920.Dq chat 3921command rather than using the internal one. See 3922.Xr chat 8 3923for a good alternative. 3924.Pp 3925The external command that is executed is subjected to the same special 3926word expansions as the 3927.Dq !bg 3928command. 3929.It set enddisc Op label|IP|MAC|magic|psn value 3930This command sets our local endpoint discriminator. If set prior to 3931LCP negotiation, and if no 3932.Dq disable enddisc 3933command has been used, 3934.Nm 3935will send the information to the peer using the LCP endpoint discriminator 3936option. The following discriminators may be set: 3937.Bd -unfilled -offset indent 3938.It Li label 3939The current label is used. 3940.It Li IP 3941Our local IP number is used. As LCP is negotiated prior to IPCP, it is 3942possible that the IPCP layer will subsequently change this value. If 3943it does, the endpoint discriminator stays at the old value unless manually 3944reset. 3945.It Li MAC 3946This is similar to the 3947.Ar IP 3948option above, except that the MAC address associated with the local IP 3949number is used. If the local IP number is not resident on any Ethernet 3950interface, the command will fail. 3951.Pp 3952As the local IP number defaults to whatever the machine host name is, 3953.Dq set enddisc mac 3954is usually done prior to any 3955.Dq set ifaddr 3956commands. 3957.It Li magic 3958A 20 digit random number is used. Care should be taken when using magic 3959numbers as restarting 3960.Nm 3961or creating a link using a different 3962.Nm 3963invocation will also use a different magic number and will therefore not 3964be recognised by the peer as belonging to the same bundle. This makes it 3965unsuitable for 3966.Fl direct 3967connections. 3968.It Li psn Ar value 3969The given 3970.Ar value 3971is used. 3972.Ar Value 3973should be set to an absolute public switched network number with the 3974country code first. 3975.Ed 3976.Pp 3977If no arguments are given, the endpoint discriminator is reset. 3978.It set escape Ar value... 3979This option is similar to the 3980.Dq set accmap 3981option above. It allows the user to specify a set of characters that 3982will be 3983.Sq escaped 3984as they travel across the link. 3985.It set filter dial|alive|in|out Ar rule-no Xo 3986.No permit|deny|clear| Ns Ar rule-no 3987.Op \&! 3988.Oo Op host 3989.Ar src_addr Ns Op / Ns Ar width 3990.Op Ar dst_addr Ns Op / Ns Ar width 3991.Oc Oo tcp|udp|ospf|igmp|icmp Op src lt|eq|gt Ar port 3992.Op dst lt|eq|gt Ar port 3993.Op estab 3994.Op syn 3995.Op finrst 3996.Oc 3997.Xc 3998.Nm 3999supports four filter sets. The 4000.Em alive 4001filter specifies packets that keep the connection alive - resetting the 4002idle timer. The 4003.Em dial 4004filter specifies packets that cause 4005.Nm 4006to dial when in 4007.Fl auto 4008mode. The 4009.Em in 4010filter specifies packets that are allowed to travel 4011into the machine and the 4012.Em out 4013filter specifies packets that are allowed out of the machine. 4014.Pp 4015Filtering is done prior to any IP alterations that might be done by the 4016NAT engine on outgoing packets and after any IP alterations that might 4017be done by the NAT engine on incoming packets. By default all filter 4018sets allow all packets to pass. Rules are processed in order according to 4019.Ar rule-no 4020(unless skipped by specifying a rule number as the 4021.Ar action ) . 4022Up to 40 rules may be given for each set. If a packet doesn't match 4023any of the rules in a given set, it is discarded. In the case of 4024.Em in 4025and 4026.Em out 4027filters, this means that the packet is dropped. In the case of 4028.Em alive 4029filters it means that the packet will not reset the idle timer and in 4030the case of 4031.Em dial 4032filters it means that the packet will not trigger a dial. A packet failing 4033to trigger a dial will be dropped rather than queued. Refer to the 4034section on 4035.Sx PACKET FILTERING 4036above for further details. 4037.It set hangup Ar chat-script 4038This specifies the chat script that will be used to reset the device 4039before it is closed. It should not normally be necessary, but can 4040be used for devices that fail to reset themselves properly on close. 4041.It set help|? Op Ar command 4042This command gives a summary of available set commands, or if 4043.Ar command 4044is specified, the command usage is shown. 4045.It set ifaddr Oo Ar myaddr Ns 4046.Op / Ns Ar \&nn 4047.Oo Ar hisaddr Ns Op / Ns Ar \&nn 4048.Oo Ar netmask 4049.Op Ar triggeraddr 4050.Oc Oc 4051.Oc 4052This command specifies the IP addresses that will be used during 4053IPCP negotiation. Addresses are specified using the format 4054.Pp 4055.Dl a.b.c.d/nn 4056.Pp 4057Where 4058.Dq a.b.c.d 4059is the preferred IP, but 4060.Ar nn 4061specifies how many bits of the address we will insist on. If 4062.No / Ns Ar nn 4063is omitted, it defaults to 4064.Dq /32 4065unless the IP address is 0.0.0.0 in which case it defaults to 4066.Dq /0 . 4067.Pp 4068If you wish to assign a dynamic IP number to the peer, 4069.Ar hisaddr 4070may also be specified as a range of IP numbers in the format 4071.Bd -literal -offset indent 4072.Ar \&IP Ns Oo \&- Ns Ar \&IP Ns Xo 4073.Oc Oo , Ns Ar \&IP Ns 4074.Op \&- Ns Ar \&IP Ns 4075.Oc No ... 4076.Xc 4077.Ed 4078.Pp 4079for example: 4080.Pp 4081.Dl set ifaddr 10.0.0.1 10.0.1.2-10.0.1.10,10.0.1.20 4082.Pp 4083will only negotiate 4084.Dq 10.0.0.1 4085as the local IP number, but may assign any of the given 10 IP 4086numbers to the peer. If the peer requests one of these numbers, 4087and that number is not already in use, 4088.Nm 4089will grant the peers request. This is useful if the peer wants 4090to re-establish a link using the same IP number as was previously 4091allocated (thus maintaining any existing tcp or udp connections). 4092.Pp 4093If the peer requests an IP number that's either outside 4094of this range or is already in use, 4095.Nm 4096will suggest a random unused IP number from the range. 4097.Pp 4098If 4099.Ar triggeraddr 4100is specified, it is used in place of 4101.Ar myaddr 4102in the initial IPCP negotiation. However, only an address in the 4103.Ar myaddr 4104range will be accepted. This is useful when negotiating with some 4105.Dv PPP 4106implementations that will not assign an IP number unless their peer 4107requests 4108.Dq 0.0.0.0 . 4109.Pp 4110It should be noted that in 4111.Fl auto 4112mode, 4113.Nm 4114will configure the interface immediately upon reading the 4115.Dq set ifaddr 4116line in the config file. In any other mode, these values are just 4117used for IPCP negotiations, and the interface isn't configured 4118until the IPCP layer is up. 4119.Pp 4120Note that the 4121.Ar HISADDR 4122argument may be overridden by the third field in the 4123.Pa ppp.secret 4124file once the client has authenticated itself 4125.Pq if PAP or CHAP are Dq enabled . 4126Refer to the 4127.Sx AUTHENTICATING INCOMING CONNECTIONS 4128section for details. 4129.Pp 4130In all cases, if the interface is already configured, 4131.Nm 4132will try to maintain the interface IP numbers so that any existing 4133bound sockets will remain valid. 4134.It set ccpretry|ccpretries Oo Ar timeout 4135.Op Ar reqtries Op Ar trmtries 4136.Oc 4137.It set chapretry|chapretries Oo Ar timeout 4138.Op Ar reqtries 4139.Oc 4140.It set ipcpretry|ipcpretries Oo Ar timeout 4141.Op Ar reqtries Op Ar trmtries 4142.Oc 4143.It set lcpretry|lcpretries Oo Ar timeout 4144.Op Ar reqtries Op Ar trmtries 4145.Oc 4146.It set papretry|papretries Oo Ar timeout 4147.Op Ar reqtries 4148.Oc 4149These commands set the number of seconds that 4150.Nm 4151will wait before resending Finite State Machine (FSM) Request packets. 4152The default 4153.Ar timeout 4154for all FSMs is 3 seconds (which should suffice in most cases). 4155.Pp 4156If 4157.Ar reqtries 4158is specified, it tells 4159.Nm 4160how many configuration request attempts it should make while receiving 4161no reply from the peer before giving up. The default is 5 attempts for 4162CCP, LCP and IPCP and 3 attempts for PAP and CHAP. 4163.Pp 4164If 4165.Ar trmtries 4166is specified, it tells 4167.Nm 4168how many terminate requests should be sent before giving up waiting for the 4169peers response. The default is 3 attempts. Authentication protocols are 4170not terminated and it is therefore invalid to specify 4171.Ar trmtries 4172for PAP or CHAP. 4173.Pp 4174In order to avoid negotiations with the peer that will never converge, 4175.Nm 4176will only send at most 3 times the configured number of 4177.Ar reqtries 4178in any given negotiation session before giving up and closing that layer. 4179.It set log Xo 4180.Op local 4181.Op +|- Ns 4182.Ar value Ns No ... 4183.Xc 4184This command allows the adjustment of the current log level. Refer 4185to the Logging Facility section for further details. 4186.It set login Ar chat-script 4187This 4188.Ar chat-script 4189compliments the dial-script. If both are specified, the login 4190script will be executed after the dial script. Escape sequences 4191available in the dial script are also available here. 4192.It set logout Ar chat-script 4193This specifies the chat script that will be used to logout 4194before the hangup script is called. It should not normally be necessary. 4195.It set lqrperiod Ar frequency 4196This command sets the 4197.Ar frequency 4198in seconds at which 4199.Em LQR 4200or 4201.Em ECHO LQR 4202packets are sent. The default is 30 seconds. You must also use the 4203.Dq enable lqr 4204command if you wish to send LQR requests to the peer. 4205.It set mode Ar interactive|auto|ddial|background 4206This command allows you to change the 4207.Sq mode 4208of the specified link. This is normally only useful in multi-link mode, 4209but may also be used in uni-link mode. 4210.Pp 4211It is not possible to change a link that is 4212.Sq direct 4213or 4214.Sq dedicated . 4215.Pp 4216Note: If you issue the command 4217.Dq set mode auto , 4218and have network address translation enabled, it may be useful to 4219.Dq enable iface-alias 4220afterwards. This will allow 4221.Nm 4222to do the necessary address translations to enable the process that 4223triggers the connection to connect once the link is up despite the 4224peer assigning us a new (dynamic) IP address. 4225.It set mrru Op Ar value 4226Setting this option enables Multi-link PPP negotiations, also known as 4227Multi-link Protocol or MP. There is no default MRRU (Maximum 4228Reconstructed Receive Unit) value. If no argument is given, multi-link 4229mode is disabled. 4230.It set mru Op Ar value 4231The default MRU (Maximum Receive Unit) is 1500. If it is increased, the 4232other side *may* increase its mtu. There is no point in decreasing the 4233MRU to below the default as the 4234.Em PPP 4235protocol *must* be able to accept packets of at least 1500 octets. If 4236no argument is given, 1500 is assumed. 4237.It set mtu Op Ar value 4238The default MTU is 1500. At negotiation time, 4239.Nm 4240will accept whatever MRU or MRRU that the peer wants (assuming it's 4241not less than 296 bytes). If the MTU is set, 4242.Nm 4243will not accept MRU/MRRU values less than 4244.Ar value . 4245When negotiations are complete, the MTU is assigned to the interface, even 4246if the peer requested a higher value MRU/MRRU. This can be useful for 4247limiting your packet size (giving better bandwidth sharing at the expense 4248of more header data). 4249.Pp 4250If no 4251.Ar value 4252is given, 1500, or whatever the peer asks for is used. 4253.It set nbns Op Ar x.x.x.x Op Ar y.y.y.y 4254This option allows the setting of the Microsoft NetBIOS name server 4255values to be returned at the peers request. If no values are given, 4256.Nm 4257will reject any such requests. 4258.It set openmode active|passive Op Ar delay 4259By default, 4260.Ar openmode 4261is always 4262.Ar active 4263with a one second 4264.Ar delay . 4265That is, 4266.Nm 4267will always initiate LCP/IPCP/CCP negotiation one second after the line 4268comes up. If you want to wait for the peer to initiate negotiations, you 4269can use the value 4270.Ar passive . 4271If you want to initiate negotiations immediately or after more than one 4272second, the appropriate 4273.Ar delay 4274may be specified here in seconds. 4275.It set parity odd|even|none|mark 4276This allows the line parity to be set. The default value is 4277.Ar none . 4278.It set phone Ar telno Ns Xo 4279.Oo \&| Ns Ar backupnumber 4280.Oc Ns ... Ns Oo : Ns Ar nextnumber 4281.Oc Ns ... 4282.Xc 4283This allows the specification of the phone number to be used in 4284place of the \\\\T string in the dial and login chat scripts. 4285Multiple phone numbers may be given separated either by a pipe 4286.Pq Dq \&| 4287or a colon 4288.Pq Dq \&: . 4289.Pp 4290Numbers after the pipe are only dialed if the dial or login 4291script for the previous number failed. 4292.Pp 4293Numbers after the colon are tried sequentially, irrespective of 4294the reason the line was dropped. 4295.Pp 4296If multiple numbers are given, 4297.Nm 4298will dial them according to these rules until a connection is made, retrying 4299the maximum number of times specified by 4300.Dq set redial 4301below. In 4302.Fl background 4303mode, each number is attempted at most once. 4304.It set Op proc Ns Xo 4305.No title Op Ar value 4306.Xc 4307The current process title as displayed by 4308.Xr ps 1 4309is changed according to 4310.Ar value . 4311If 4312.Ar value 4313is not specified, the original process title is restored. All the 4314word replacements done by the shell commands (see the 4315.Dq bg 4316command above) are done here too. 4317.Pp 4318Note, if USER is required in the process title, the 4319.Dq set proctitle 4320command must appear in 4321.Pa ppp.linkup , 4322as it is not known when the commands in 4323.Pa ppp.conf 4324are executed. 4325.It set radius Op Ar config-file 4326This command enables RADIUS support (if it's compiled in). 4327.Ar config-file 4328refers to the radius client configuration file as described in 4329.Xr radius.conf 5 . 4330If PAP or CHAP are 4331.Dq enable Ns No d , 4332.Nm 4333behaves as a 4334.Em \&N Ns No etwork 4335.Em \&A Ns No ccess 4336.Em \&S Ns No erver 4337and uses the configured RADIUS server to authenticate rather than 4338authenticating from the 4339.Pa ppp.secret 4340file or from the passwd database. 4341.Pp 4342If neither PAP or CHAP are enabled, 4343.Dq set radius 4344will do nothing. 4345.Pp 4346.Nm 4347uses the following attributes from the RADIUS reply: 4348.Bl -tag -width XXX -offset XXX 4349.It RAD_FRAMED_IP_ADDRESS 4350The peer IP address is set to the given value. 4351.It RAD_FRAMED_IP_NETMASK 4352The tun interface netmask is set to the given value. 4353.It RAD_FRAMED_MTU 4354If the given MTU is less than the peers MRU as agreed during LCP 4355negotiation, *and* it is less that any configured MTU (see the 4356.Dq set mru 4357command), the tun interface MTU is set to the given value. 4358.It RAD_FRAMED_COMPRESSION 4359If the received compression type is 4360.Dq 1 , 4361.Nm 4362will request VJ compression during IPCP negotiations despite any 4363.Dq disable vj 4364configuration command. 4365.It RAD_FRAMED_ROUTE 4366The received string is expected to be in the format 4367.Ar dest Ns Op / Ns Ar bits 4368.Ar gw 4369.Op Ar metrics . 4370Any specified metrics are ignored. 4371.Dv MYADDR 4372and 4373.Dv HISADDR 4374are understood as valid values for 4375.Ar dest 4376and 4377.Ar gw , 4378.Dq default 4379can be used for 4380.Ar dest 4381to sepcify the default route, and 4382.Dq 0.0.0.0 4383is understood to be the same as 4384.Dq default 4385for 4386.Ar dest 4387and 4388.Dv HISADDR 4389for 4390.Ar gw . 4391.Pp 4392For example, a returned value of 4393.Dq 1.2.3.4/24 0.0.0.0 1 2 -1 3 400 4394would result in a routing table entry to the 1.2.3.0/24 network via 4395.Dv HISADDR 4396and a returned value of 4397.Dq 0.0.0.0 0.0.0.0 4398or 4399.Dq default HISADDR 4400would result in a default route to 4401.Dv HISADDR . 4402.Pp 4403All RADIUS routes are applied after any sticky routes are applied, making 4404RADIUS routes override configured routes. This also applies for RADIUS 4405routes that don't include the 4406.Dv MYADDR 4407or 4408.Dv HISADDR 4409keywords. 4410.Pp 4411.El 4412Values received from the RADIUS server may be viewed using 4413.Dq show bundle . 4414.It set reconnect Ar timeout ntries 4415Should the line drop unexpectedly (due to loss of CD or LQR 4416failure), a connection will be re-established after the given 4417.Ar timeout . 4418The line will be re-connected at most 4419.Ar ntries 4420times. 4421.Ar Ntries 4422defaults to zero. A value of 4423.Ar random 4424for 4425.Ar timeout 4426will result in a variable pause, somewhere between 1 and 30 seconds. 4427.It set recvpipe Op Ar value 4428This sets the routing table RECVPIPE value. The optimum value is 4429just over twice the MTU value. If 4430.Ar value 4431is unspecified or zero, the default kernel controlled value is used. 4432.It set redial Ar secs Ns Xo 4433.Oo + Ns Ar inc Ns 4434.Op - Ns Ar max Ns 4435.Oc Op . Ns Ar next 4436.Op Ar attempts 4437.Xc 4438.Nm 4439can be instructed to attempt to redial 4440.Ar attempts 4441times. If more than one phone number is specified (see 4442.Dq set phone 4443above), a pause of 4444.Ar next 4445is taken before dialing each number. A pause of 4446.Ar secs 4447is taken before starting at the first number again. A literal value of 4448.Dq Li random 4449may be used here in place of 4450.Ar secs 4451and 4452.Ar next , 4453causing a random delay of between 1 and 30 seconds. 4454.Pp 4455If 4456.Ar inc 4457is specified, its value is added onto 4458.Ar secs 4459each time 4460.Nm 4461tries a new number. 4462.Ar secs 4463will only be incremented at most 4464.Ar max 4465times. 4466.Ar max 4467defaults to 10. 4468.Pp 4469Note, the 4470.Ar secs 4471delay will be effective, even after 4472.Ar attempts 4473has been exceeded, so an immediate manual dial may appear to have 4474done nothing. If an immediate dial is required, a 4475.Dq \&! 4476should immediately follow the 4477.Dq open 4478keyword. See the 4479.Dq open 4480description above for further details. 4481.It set sendpipe Op Ar value 4482This sets the routing table SENDPIPE value. The optimum value is 4483just over twice the MTU value. If 4484.Ar value 4485is unspecified or zero, the default kernel controlled value is used. 4486.It set server|socket Ar TcpPort|LocalName|none password Op Ar mask 4487This command tells 4488.Nm 4489to listen on the given socket or 4490.Sq diagnostic port 4491for incoming command connections. 4492.Pp 4493The word 4494.Ar none 4495instructs 4496.Nm 4497to close any existing socket. 4498.Pp 4499If you wish to specify a local domain socket, 4500.Ar LocalName 4501must be specified as an absolute file name, otherwise it is assumed 4502to be the name or number of a TCP port. You must specify the octal umask 4503that should be used with local domain sockets as a four character octal 4504number beginning with 4505.Sq 0 . 4506Refer to 4507.Xr umask 2 4508for umask details. Refer to 4509.Xr services 5 4510for details of how to translate TCP port names. 4511.Pp 4512You must also specify the password that must be entered by the client 4513(using the 4514.Dq passwd 4515command above) when connecting to this socket. If the password is 4516specified as an empty string, no password is required for connecting clients. 4517.Pp 4518When specifying a local domain socket, the first 4519.Dq %d 4520sequence found in the socket name will be replaced with the current 4521interface unit number. This is useful when you wish to use the same 4522profile for more than one connection. 4523.Pp 4524In a similar manner TCP sockets may be prefixed with the 4525.Dq + 4526character, in which case the current interface unit number is added to 4527the port number. 4528.Pp 4529When using 4530.Nm 4531with a server socket, the 4532.Xr pppctl 8 4533command is the preferred mechanism of communications. Currently, 4534.Xr telnet 1 4535can also be used, but link encryption may be implemented in the future, so 4536.Xr telnet 1 4537should not be relied upon. 4538.It set speed Ar value 4539This sets the speed of the serial device. If speed is specified as 4540.Dq sync , 4541.Nm 4542treats the device as a synchronous device. 4543.Pp 4544Certain device types will know whether they should be specified as 4545synchronous or asynchronous. These devices will override incorrect 4546settings and log a warning to this effect. 4547.It set stopped Op Ar LCPseconds Op Ar CCPseconds 4548If this option is set, 4549.Nm 4550will time out after the given FSM (Finite State Machine) has been in 4551the stopped state for the given number of 4552.Dq seconds . 4553This option may be useful if the peer sends a terminate request, 4554but never actually closes the connection despite our sending a terminate 4555acknowledgement. This is also useful if you wish to 4556.Dq set openmode passive 4557and time out if the peer doesn't send a Configure Request within the 4558given time. Use 4559.Dq set log +lcp +ccp 4560to make 4561.Nm 4562log the appropriate state transitions. 4563.Pp 4564The default value is zero, where 4565.Nm 4566doesn't time out in the stopped state. 4567.Pp 4568This value should not be set to less than the openmode delay (see 4569.Dq set openmode 4570above). 4571.It set timeout Ar idleseconds Op Ar mintimeout 4572This command allows the setting of the idle timer. Refer to the 4573section titled 4574.Sx SETTING THE IDLE TIMER 4575for further details. 4576.Pp 4577If 4578.Ar mintimeout 4579is specified, 4580.Nm 4581will never idle out before the link has been up for at least that number 4582of seconds. 4583.It set urgent Xo 4584.Op tcp|udp 4585.Oo Op +|- Ns 4586.Ar port 4587.Oc No ... 4588.Xc 4589This command controls the ports that 4590.Nm 4591prioritizes when transmitting data. The default priority TCP ports 4592are ports 21 (ftp control), 22 (ssh), 23 (telnet), 513 (login), 514 (shell), 4593543 (klogin) and 544 (kshell). There are no priority UDP ports by default. 4594See 4595.Xr services 5 4596for details. 4597.Pp 4598If neither 4599.Dq tcp 4600or 4601.Dq udp 4602are specified, 4603.Dq tcp 4604is assumed. 4605.Pp 4606If no 4607.Ar port Ns No s 4608are given, the priority port lists are cleared (although if 4609.Dq tcp 4610or 4611.Dq udp 4612is specified, only that list is cleared). If the first 4613.Ar port 4614argument is prefixed with a plus 4615.Pq Dq \&+ 4616or a minus 4617.Pq Dq \&- , 4618the current list is adjusted, otherwise the list is reassigned. 4619.Ar port Ns No s 4620prefixed with a plus or not prefixed at all are added to the list and 4621.Ar port Ns No s 4622prefixed with a minus are removed from the list. 4623.It set vj slotcomp on|off 4624This command tells 4625.Nm 4626whether it should attempt to negotiate VJ slot compression. By default, 4627slot compression is turned 4628.Ar on . 4629.It set vj slots Ar nslots 4630This command sets the initial number of slots that 4631.Nm 4632will try to negotiate with the peer when VJ compression is enabled (see the 4633.Sq enable 4634command above). It defaults to a value of 16. 4635.Ar Nslots 4636must be between 4637.Ar 4 4638and 4639.Ar 16 4640inclusive. 4641.El 4642.Pp 4643.It shell|! Op Ar command 4644If 4645.Ar command 4646is not specified a shell is invoked according to the 4647.Dv SHELL 4648environment variable. Otherwise, the given 4649.Ar command 4650is executed. Word replacement is done in the same way as for the 4651.Dq !bg 4652command as described above. 4653.Pp 4654Use of the ! character 4655requires a following space as with any of the other commands. You should 4656note that this command is executed in the foreground - 4657.Nm 4658will not continue running until this process has exited. Use the 4659.Dv bg 4660command if you wish processing to happen in the background. 4661.It show Ar var 4662This command allows the user to examine the following: 4663.Bl -tag -width XX 4664.It show bundle 4665Show the current bundle settings. 4666.It show ccp 4667Show the current CCP compression statistics. 4668.It show compress 4669Show the current VJ compression statistics. 4670.It show escape 4671Show the current escape characters. 4672.It show filter Op Ar name 4673List the current rules for the given filter. If 4674.Ar name 4675is not specified, all filters are shown. 4676.It show hdlc 4677Show the current HDLC statistics. 4678.It show help|? 4679Give a summary of available show commands. 4680.It show iface 4681Show the current interface information 4682.Pq the same \&as Dq iface show . 4683.It show ipcp 4684Show the current IPCP statistics. 4685.It show layers 4686Show the protocol layers currently in use. 4687.It show lcp 4688Show the current LCP statistics. 4689.It show Op data Ns Xo 4690.No link 4691.Xc 4692Show high level link information. 4693.It show links 4694Show a list of available logical links. 4695.It show log 4696Show the current log values. 4697.It show mem 4698Show current memory statistics. 4699.It show physical 4700Show low level link information. 4701.It show mp 4702Show Multi-link information. 4703.It show proto 4704Show current protocol totals. 4705.It show route 4706Show the current routing tables. 4707.It show stopped 4708Show the current stopped timeouts. 4709.It show timer 4710Show the active alarm timers. 4711.It show version 4712Show the current version number of 4713.Nm ppp . 4714.El 4715.Pp 4716.It term 4717Go into terminal mode. Characters typed at the keyboard are sent to 4718the device. Characters read from the device are displayed on the 4719screen. When a remote 4720.Em PPP 4721peer is detected, 4722.Nm 4723automatically enables Packet Mode and goes back into command mode. 4724.El 4725.Pp 4726.Sh MORE DETAILS 4727.Bl -bullet 4728.It 4729Read the example configuration files. They are a good source of information. 4730.It 4731Use 4732.Dq help , 4733.Dq nat ? , 4734.Dq enable ? , 4735.Dq set ? 4736and 4737.Dq show ? 4738to get online information about what's available. 4739.It 4740The following URLs contain useful information: 4741.Bl -bullet -compact 4742.It 4743http://www.FreeBSD.org/FAQ/userppp.html 4744.It 4745http://www.FreeBSD.org/handbook/userppp.html 4746.El 4747.Pp 4748.El 4749.Pp 4750.Sh FILES 4751.Nm 4752refers to four files: 4753.Pa ppp.conf , 4754.Pa ppp.linkup , 4755.Pa ppp.linkdown 4756and 4757.Pa ppp.secret . 4758These files are placed in the 4759.Pa /etc/ppp 4760directory. 4761.Bl -tag -width XX 4762.It Pa /etc/ppp/ppp.conf 4763System default configuration file. 4764.It Pa /etc/ppp/ppp.secret 4765An authorisation file for each system. 4766.It Pa /etc/ppp/ppp.linkup 4767A file to check when 4768.Nm 4769establishes a network level connection. 4770.It Pa /etc/ppp/ppp.linkdown 4771A file to check when 4772.Nm 4773closes a network level connection. 4774.It Pa /var/log/ppp.log 4775Logging and debugging information file. Note, this name is specified in 4776.Pa /etc/syslogd.conf . 4777See 4778.Xr syslog.conf 5 4779for further details. 4780.It Pa /var/spool/lock/LCK..* 4781tty port locking file. Refer to 4782.Xr uucplock 3 4783for further details. 4784.It Pa /var/run/tunN.pid 4785The process id (pid) of the 4786.Nm 4787program connected to the tunN device, where 4788.Sq N 4789is the number of the device. 4790.It Pa /var/run/ttyXX.if 4791The tun interface used by this port. Again, this file is only created in 4792.Fl background , 4793.Fl auto 4794and 4795.Fl ddial 4796modes. 4797.It Pa /etc/services 4798Get port number if port number is using service name. 4799.It Pa /var/run/ppp-authname-class-value 4800In multi-link mode, local domain sockets are created using the peer 4801authentication name 4802.Pq Sq authname , 4803the peer endpoint discriminator class 4804.Pq Sq class 4805and the peer endpoint discriminator value 4806.Pq Sq value . 4807As the endpoint discriminator value may be a binary value, it is turned 4808to HEX to determine the actual file name. 4809.Pp 4810This socket is used to pass links between different instances of 4811.Nm ppp . 4812.El 4813.Pp 4814.Sh SEE ALSO 4815.Xr at 1 , 4816.Xr ftp 1 , 4817.Xr gzip 1 , 4818.Xr hostname 1 , 4819.Xr login 1 , 4820.Xr tcpdump 1 , 4821.Xr telnet 1 , 4822.Xr libalias 3 , 4823.Xr syslog 3 , 4824.Xr uucplock 3 , 4825.Xr netgraph 4 , 4826.Xr crontab 5 , 4827.Xr group 5 , 4828.Xr passwd 5 , 4829.Xr radius.conf 5 , 4830.Xr resolv.conf 5 , 4831.Xr syslog.conf 5 , 4832.Xr adduser 8 , 4833.Xr chat 8 , 4834.Xr getty 8 , 4835.Xr inetd 8 , 4836.Xr init 8 , 4837.Xr isdn 8 , 4838.Xr named 8 , 4839.Xr ng_pppoe 8 , 4840.Xr ping 8 , 4841.Xr pppctl 8 , 4842.Xr pppd 8 , 4843.Xr route 8 , 4844.Xr sshd 8 , 4845.Xr syslogd 8 , 4846.Xr traceroute 8 , 4847.Xr vipw 8 4848.Sh HISTORY 4849This program was originally written by 4850.An Toshiharu OHNO Aq tony-o@iij.ad.jp , 4851and was submitted to 4852.Fx 2.0.5 4853by 4854.An Atsushi Murai Aq amurai@spec.co.jp . 4855.Pp 4856It was substantially modified during 1997 by 4857.An Brian Somers Aq brian@Awfulhak.org , 4858and was ported to 4859.Ox 4860in November that year 4861(just after the 2.2 release). 4862.Pp 4863Most of the code was rewritten by 4864.An Brian Somers 4865in early 1998 when multi-link ppp support was added. 4866