wangjia/sing-box
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactor OpenVPN and OpenConnect endpoints

Browse Source
This commit is contained in:
世界
2026-07-18 09:40:17 +08:00
parent 60f3012444
commit a4367df680
25 changed files with 758 additions and 182 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/configuration/endpoint/openconnect.md
+7
View File
@@ -13,6 +13,9 @@
"system": false,
"name": "",
... // UDP NAT Fields
"server": "vpn.example.com",
"flavor": "anyconnect",
"username": "",
@@ -378,6 +381,10 @@ Ask for the matching authentication field interactively instead of supplying an
Conflict with `form_entries.value`.
## UDP NAT Fields
See [UDP NAT Fields](/configuration/shared/udp-nat/) for details.
## Dial Fields
See [Dial Fields](/configuration/shared/dial/) for details.
docs/configuration/endpoint/openconnect.zh.md
+7
View File
@@ -13,6 +13,9 @@
"system": false,
"name": "",
... // UDP NAT 字段
"server": "vpn.example.com",
"flavor": "anyconnect",
"username": "",
@@ -378,6 +381,10 @@ MCA 证书和私钥必须同时设置或同时为空。
与 `form_entries.value` 冲突。
## UDP NAT 字段
参阅 [UDP NAT 字段](/zh/configuration/shared/udp-nat/)。
## 拨号字段
参阅[拨号字段](/zh/configuration/shared/dial/)了解详情。
docs/configuration/endpoint/openvpn-client.md
+27 -21
View File
@@ -69,14 +69,15 @@
"route_metric": 0,
"redirect_gateway": false,
"redirect_gateway_flags": [],
"keepalive_interval": "",
"keepalive_timeout": "",
"ping_interval": "",
"ping_restart": "",
"renegotiate_interval": "",
"explicit_exit_notify": 0,
"system": false,
"name": "",
"mtu": 1500,
"udp_timeout": "",
... // UDP NAT Fields
... // Dial Fields
}
@@ -342,7 +343,8 @@ Maximum OpenVPN UDP packet size used to clamp the MSS of TCP connections sent th
This prevents TCP packets from exceeding the path MTU after OpenVPN encapsulation.
Disabled when `0`.
When empty, the upstream OpenVPN default is used: `fragment` when configured,
otherwise `1492` for the default tunnel MTU or the configured tunnel MTU.
### fragment
@@ -378,9 +380,10 @@ Conflict with non-stub compression enabled by `compression` or `compression_lzo`
### route_no_pull
Ignore routes, route gateways, and redirect-gateway options pushed by the server.
Ignore routes, DNS and DHCP settings, route metrics, `redirect-gateway`,
`redirect-private`, `block-ipv6`, and `block-outside-dns` pushed by the server.
Other pushed options are still accepted, and locally configured `routes` are still used.
Interface configuration, topology, tunnel MTU, `route-gateway`, and locally configured routes are still used.
Disabled by default.
@@ -388,7 +391,7 @@ Disabled by default.
Ordered filters for options pushed by the server.
The first filter whose `text` is a case-insensitive prefix of the complete pushed option is applied. Options that match no filter are accepted.
The first filter whose `text` is a case-sensitive prefix of the complete pushed option is applied. Options that match no filter are accepted.
### pull_filters.action
@@ -402,7 +405,7 @@ Filter action, one of `accept`, `ignore`, or `reject`.
==Required==
Case-insensitive prefix to match against the pushed option name and value.
Case-sensitive prefix to match against the pushed option name and value.
For example, `route ` matches pushed IPv4 route options without matching `route-gateway`.
@@ -438,33 +441,38 @@ OpenVPN `redirect-gateway` flags.
Empty by default.
### keepalive_interval
### ping_interval
Interval for sending OpenVPN keepalive ping packets.
Interval after which the client sends a data-channel ping when no packet has been sent to the server.
Locally configured values take precedence over server-pushed keepalive values.
A server-pushed OpenVPN `ping` value overrides this value.
The value must use whole seconds.
Disabled by default.
### keepalive_timeout
### ping_restart
Time without receiving OpenVPN traffic before the connection is restarted.
Time without receiving a packet after which the client reconnects to the server.
Locally configured values take precedence over server-pushed keepalive values.
A server-pushed OpenVPN `ping-restart` value overrides this value.
Disabled by default.
The value must use whole seconds.
When empty, `120s` is used for UDP connections with pull enabled until the
server pushes another value. No default receive timeout is used for TCP.
### renegotiate_interval
OpenVPN TLS renegotiation interval.
If empty or set to `0s`, the OpenVPN default `1h` is used.
When empty, the OpenVPN default `1h` is used.
### explicit_exit_notify
Number of OpenVPN exit notifications sent when closing a UDP connection.
Disabled when `0`. At most `10` notifications are sent.
Notifications are sent one second apart. Disabled when `0`.
### system
@@ -486,11 +494,9 @@ OpenVPN interface MTU.
When empty, `1500` is used until a server-pushed MTU is received.
### udp_timeout
## UDP NAT Fields
UDP NAT expiration time.
`5m` is used by default.
See [UDP NAT Fields](/configuration/shared/udp-nat/) for details.
## Dial Fields
docs/configuration/endpoint/openvpn-client.zh.md
+25 -21
View File
@@ -69,14 +69,15 @@
"route_metric": 0,
"redirect_gateway": false,
"redirect_gateway_flags": [],
"keepalive_interval": "",
"keepalive_timeout": "",
"ping_interval": "",
"ping_restart": "",
"renegotiate_interval": "",
"explicit_exit_notify": 0,
"system": false,
"name": "",
"mtu": 1500,
"udp_timeout": "",
... // UDP NAT 字段
... // 拨号字段
}
@@ -342,7 +343,7 @@ OpenVPN UDP packet 的最大大小，用于限制通过隧道发送的 TCP 连
这可以避免 TCP packet 在 OpenVPN 封装后超过 path MTU。
设为 `0` 时禁用。
为空时使用上游 OpenVPN 默认值：配置了 `fragment` 时使用其值；否则默认 tunnel MTU 使用 `1492`，自定义 tunnel MTU 使用该 MTU。
### fragment
@@ -378,9 +379,10 @@ Compression 可能削弱流量机密性。仅在服务器要求时启用。
### route_no_pull
忽略服务器推送的 route、route gateway 和 redirect-gateway 选项。
忽略服务器推送的 route、DNS 和 DHCP 设置、route metric、`redirect-gateway`、
`redirect-private`、`block-ipv6` 和 `block-outside-dns`。
仍会接受其他推送选项，并继续使用本地配置的 `routes`。
仍会使用接口配置、topology、tunnel MTU、`route-gateway` 和本地配置的 route。
默认禁用。
@@ -388,7 +390,7 @@ Compression 可能削弱流量机密性。仅在服务器要求时启用。
服务器推送选项的有序 pull filter 列表。
应用第一个 `text` 为完整推送选项大小写不敏感前缀的 filter。未匹配任何 filter 的选项会被接受。
应用第一个 `text` 为完整推送选项大小写敏感前缀的 filter。未匹配任何 filter 的选项会被接受。
### pull_filters.action
@@ -402,7 +404,7 @@ Filter action，可选值为 `accept`、`ignore` 或 `reject`。
==必填==
用于匹配推送选项名称和值的大小写不敏感前缀。
用于匹配推送选项名称和值的大小写敏感前缀。
例如，`route ` 会匹配推送的 IPv4 route 选项，但不会匹配 `route-gateway`。
@@ -438,33 +440,37 @@ OpenVPN `redirect-gateway` flag。
默认为空。
### keepalive_interval
### ping_interval
发送 OpenVPN keepalive ping packet 的间隔。
客户端未向服务器发送任何 packet 时，发送 data channel ping 的间隔。
本地配置值优先于服务器推送的 keepalive 值。
服务器推送的 OpenVPN `ping` 值优先于该值。
该值必须使用整秒。
默认禁用。
### keepalive_timeout
### ping_restart
未接收 OpenVPN 流量后重新启动连接的时间。
客户端未收到任何 packet 后重新连接服务器的时间。
本地配置值优先于服务器推送的 keepalive 值。
服务器推送的 OpenVPN `ping-restart` 值优先于该值。
默认禁用。
该值必须使用整秒。
为空时，启用了 pull 的 UDP 连接会使用 `120s`，直到服务器推送其他值。TCP 不使用默认接收超时。
### renegotiate_interval
OpenVPN TLS 重新协商间隔。
如果为空或设为 `0s`，使用 OpenVPN 默认值 `1h`。
为空时使用 OpenVPN 默认值 `1h`。
### explicit_exit_notify
关闭 UDP 连接时发送的 OpenVPN exit notification 数量。
设为 `0` 时禁用。最多发送 `10` 个 notification。
Notification 之间间隔一秒。设为 `0` 时禁用。
### system
@@ -486,11 +492,9 @@ OpenVPN 接口 MTU。
为空时使用服务器推送的 MTU；收到服务器配置前使用 `1500`。
### udp_timeout
## UDP NAT 字段
UDP NAT 过期时间。
默认使用 `5m`。
参阅 [UDP NAT 字段](/zh/configuration/shared/udp-nat/)。
## 拨号字段
docs/configuration/endpoint/openvpn-server.md
+73 -14
View File
@@ -18,6 +18,7 @@
"max_clients": 1024,
"address": [],
"topology": "subnet",
"duplicate_cn": false,
"users": [
{
"username": "",
@@ -36,7 +37,8 @@
"type": "tls_crypt",
"key": [],
"key_path": "",
"direction": ""
"direction": "",
"force_cookie": false
}
},
"data_ciphers": [],
@@ -47,12 +49,16 @@
"dns": [],
"redirect_gateway": false,
"redirect_gateway_flags": [],
"block_outside_dns": false
"block_outside_dns": false,
"ping_interval": "",
"ping_restart": ""
},
"keepalive_interval": "",
"keepalive_timeout": "",
"ping_interval": "",
"ping_restart": "",
"renegotiate_interval": "",
"udp_timeout": ""
"handshake_window": "1m",
... // UDP NAT Fields
}
```
@@ -62,7 +68,7 @@
## Listen Fields
See [Listen Fields](/configuration/shared/listen/) for details.
See [Listen Fields](/configuration/shared/listen/) for details. `udp_timeout` is part of the [UDP NAT Fields](#udp-nat-fields) below.
## Fields
@@ -120,6 +126,14 @@ OpenVPN topology pushed to clients, one of `subnet`, `p2p` or `net30`.
`subnet` will be used by default.
### duplicate_cn
Allow multiple active clients with the same authenticated certificate common name or username.
When disabled, a newly authenticated session replaces the existing session with the same identity and reuses its tunnel address when available.
Disabled by default.
### users
List of OpenVPN username/password users.
@@ -242,6 +256,15 @@ Only available when `tls.control_wrap.type` is `tls_auth`.
If empty, the key is used bidirectionally, matching an omitted `key-direction` on both peers.
### tls.control_wrap.force_cookie
Require `tls-crypt-v2` clients over UDP to support stateless session cookies.
Only available when `tls.control_wrap.type` is `tls_crypt_v2`. When disabled,
clients without cookie support are accepted using the upstream `allow-noncookie` behavior.
Disabled by default.
### data_ciphers
Allowed OpenVPN data channel ciphers.
@@ -294,15 +317,45 @@ Only available when `push.redirect_gateway` is enabled.
Push `block-outside-dns` to clients, which blocks DNS queries outside the VPN on Windows clients.
### keepalive_interval
### push.ping_interval
OpenVPN keepalive ping interval to push to clients.
OpenVPN `ping` interval pushed to clients.
After the interval passes without sending a packet, the client sends a data-channel ping to the server.
The value must use whole seconds.
Disabled by default.
### keepalive_timeout
### push.ping_restart
OpenVPN keepalive ping timeout to push to clients.
OpenVPN `ping-restart` timeout pushed to clients.
After the timeout passes without receiving a packet, the client reconnects to the server.
The value must use whole seconds.
Disabled by default.
### ping_interval
Interval after which the server sends a data-channel ping when no packet has been sent to a client.
This value applies to the server. Use `push.ping_interval` to configure clients.
The value must use whole seconds.
Disabled by default.
### ping_restart
Time without receiving a packet after which the server closes the client session.
This value applies to the server. Use `push.ping_restart` to configure clients.
The server timeout should be longer than the client timeout so the client can reconnect before the server discards its session.
The value must use whole seconds.
Disabled by default.
@@ -310,10 +363,16 @@ Disabled by default.
OpenVPN TLS renegotiation interval.
If empty or set to `0s`, the OpenVPN default `1h` is used.
When empty, the OpenVPN default `1h` is used.
### udp_timeout
### handshake_window
UDP NAT expiration time for traffic through the OpenVPN interface.
Maximum time allowed for the initial TLS handshake and each TLS renegotiation.
`5m` will be used by default.
`1m` is used by default.
## UDP NAT Fields
These fields configure UDP sessions for traffic through the OpenVPN interface.
See [UDP NAT Fields](/configuration/shared/udp-nat/) for details.
docs/configuration/endpoint/openvpn-server.zh.md
+72 -14
View File
@@ -18,6 +18,7 @@
"max_clients": 1024,
"address": [],
"topology": "subnet",
"duplicate_cn": false,
"users": [
{
"username": "",
@@ -36,7 +37,8 @@
"type": "tls_crypt",
"key": [],
"key_path": "",
"direction": ""
"direction": "",
"force_cookie": false
}
},
"data_ciphers": [],
@@ -47,12 +49,16 @@
"dns": [],
"redirect_gateway": false,
"redirect_gateway_flags": [],
"block_outside_dns": false
"block_outside_dns": false,
"ping_interval": "",
"ping_restart": ""
},
"keepalive_interval": "",
"keepalive_timeout": "",
"ping_interval": "",
"ping_restart": "",
"renegotiate_interval": "",
"udp_timeout": ""
"handshake_window": "1m",
... // UDP NAT 字段
}
```
@@ -62,7 +68,7 @@
## 监听字段
参阅 [监听字段](/zh/configuration/shared/listen/)。
参阅 [监听字段](/zh/configuration/shared/listen/)。`udp_timeout` 属于下方的 [UDP NAT 字段](#udp-nat-字段)。
## 字段
@@ -120,6 +126,14 @@ OpenVPN 服务器地址前缀列表。
默认使用 `subnet`。
### duplicate_cn
允许具有相同认证证书 common name 或用户名的多个客户端同时在线。
禁用时，新认证的会话会替换具有相同身份的现有会话，并在可用时复用其 tunnel 地址。
默认禁用。
### users
OpenVPN 用户名/密码用户列表。
@@ -242,6 +256,14 @@ OpenVPN `tls-auth` 密钥方向，`server` 或 `client` 之一。
如果为空，密钥被双向使用，与两端均省略 `key-direction` 的行为一致。
### tls.control_wrap.force_cookie
要求 UDP 上的 `tls-crypt-v2` 客户端支持无状态 session cookie。
仅当 `tls.control_wrap.type` 为 `tls_crypt_v2` 时可用。禁用时，不支持 cookie 的客户端会按照上游 `allow-noncookie` 行为被接受。
默认禁用。
### data_ciphers
允许的 OpenVPN 数据信道加密方式。
@@ -294,15 +316,45 @@ IPv4 和 IPv6 前缀可以混用。
向客户端推送 `block-outside-dns`，在 Windows 客户端上阻止 VPN 之外的 DNS 查询。
### keepalive_interval
### push.ping_interval
推送给客户端的 OpenVPN keepalive ping 间隔。
推送给客户端的 OpenVPN `ping` 间隔。
在该间隔内未发送任何 packet 后，客户端会向服务器发送一个 data channel ping。
该值必须使用整秒。
默认禁用。
### keepalive_timeout
### push.ping_restart
推送给客户端的 OpenVPN keepalive ping 超时。
推送给客户端的 OpenVPN `ping-restart` 超时。
在该超时时间内未收到任何 packet 后，客户端会重新连接服务器。
该值必须使用整秒。
默认禁用。
### ping_interval
服务器未向客户端发送任何 packet 时，发送 data channel ping 的间隔。
该值应用于服务器。使用 `push.ping_interval` 配置客户端。
该值必须使用整秒。
默认禁用。
### ping_restart
服务器未收到任何 packet 后关闭客户端会话的时间。
该值应用于服务器。使用 `push.ping_restart` 配置客户端。
服务器超时应长于客户端超时，以便客户端在服务器丢弃其会话前重新连接。
该值必须使用整秒。
默认禁用。
@@ -310,10 +362,16 @@ IPv4 和 IPv6 前缀可以混用。
OpenVPN TLS 重协商间隔。
如果为空或设为 `0s`，使用 OpenVPN 默认值 `1h`。
为空时使用 OpenVPN 默认值 `1h`。
### udp_timeout
### handshake_window
通过 OpenVPN 接口的流量的 UDP NAT 过期时间。
初始 TLS 握手和每次 TLS 重协商允许使用的最长时间。
默认使用 `5m`。
默认使用 `1m`。
## UDP NAT 字段
这些字段配置通过 OpenVPN 接口的流量的 UDP 会话。
参阅 [UDP NAT 字段](/zh/configuration/shared/udp-nat/)。