fastd - Man Page

Fast and Secure Tunnelling Daemon

Examples (TL;DR)

Start fastd with a specific configuration file: fastd --config path/to/fastd.conf
Start a Layer 3 VPN with an MTU of 1400, loading the rest of the configuration parameters from a file: fastd --mode tap --mtu 1400 --config path/to/fastd.conf
Validate a configuration file: fastd --verify-config --config path/to/fastd.conf
Generate a new keypair: fastd --generate-key
Show the public key to a private key in a configuration file: fastd --show-key --config path/to/fastd.conf
Show the current version: fastd -v

fastd is a very small VPN daemon which tunnels IP packets and Ethernet frames over UDP. It supports various modern encryption and authentication schemes and can be used in many different network topologies (1:1, 1:n, meshed).

Options

--help, -h

Shows a help text.

--version, -v

Shows the fastd version.

--daemon, -d

Runs fastd in the background.

--pid-file <filename>

Writes fastd's PID to the specified file.

--status-socket <socket>

Configure a socket to get fastd's status.

--config, -c <filename>

Loads a config file. - can be specified to read a config file from stdin. More than one config file can be loaded.

--config-peer <filename>

Loads a config file for a single peer. The filename will be used as the peer name.

--config-peer-dir <dir>

Loads all files from a directory as peer configs. On SIGHUP fastd will reload peer directories.

--user <user>

Sets the user to run fastd as.

--group <group>

Sets the group to run fastd as.

Sets the stderr log level; default is info if no alternative log destination is configured.

Sets the log level for syslog output; default is not to use syslog.

--syslog-ident <ident>

Sets the syslog identification; default is fastd.

--hide-ip-addresses

Hides IP addresses in log output.

--hide-mac-addresses

Hides MAC addresses in log output.

--mode, -m tap|multitap|tun

Sets the mode of the interface; default is TAP mode.

--interface, -i <name>

Sets the name of the TUN/TAP interface to use. If not specified, default names specified by the system will be used.

--mtu, -M <mtu>

Sets the MTU; must be at least 576.

--bind, -b <address>[:<port>]

Sets the bind address. Address can be an IPv4 address or an IPv6 address, or the keyword any. IPv6 addresses must be put in square brackets.

By default fastd will to bind to a random port for both IPv4 and IPv6. It is currently not possible to specify an IPv6 link-local address on the command line.

--protocol, -p <protocol>

Sets the handshake protocol. Currently the only protocol available is ec25519-fhmqvc, which provides a secure authentication of peers based on public/secret keys.

--method <method>