Strongswan swanctl

`services.strongswan-swanctl.enable`

Whether to enable strongswan-swanctl service. Type: boolean

Default

false

Example

true

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.includes`

Extra configuration files to include in the swanctl configuration. This can be used to provide secret values from outside the nix store.

Type: list of path

Default

[ ]

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

The certificates may use a relative path from the swanctl x509ca directory or an absolute path.

Configure one of {option}cacert, {option}file, or {option}handle per section.

Type: null or string

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

Optional PKCS#11 module name.

Type: null or string

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.authorities.<name>.ocsp_uris`

List of OCSP URIs.

Enables Aggressive Mode instead of Main Mode with Identity Protection. Aggressive Mode is considered less secure, because the ID and HASH payloads are exchanged unprotected. This allows a passive attacker to snoop peer identities, and even worse, start dictionary attacks on the Preshared Key.

StrongSwan default: false

Type: null or boolean

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.childless`

Use childless IKE_SA initiation (allow, prefer, force or never).

Use childless IKE_SA initiation (RFC 6023) for IKEv2, with the first CHILD_SA created with a separate CREATE_CHILD_SA exchange (e.g. to use an independent DH exchange for all CHILD_SAs). Acceptable values are allow (the default), prefer, force and never. If set to allow, responders will accept childless IKE_SAs (as indicated via notify in the IKE_SA_INIT response) while initiators continue to create regular IKE_SAs with the first CHILD_SA created during IKE_AUTH, unless the IKE_SA is initiated explicitly without any children (which will fail if the responder does not support or has disabled this extension). The effect of prefer is the same as allow on responders, but as initiator a childless IKE_SA is initiated if the responder supports it. If set to force, only childless initiation is accepted in either role. Finally, setting the option to never disables support for childless IKE_SAs as responder.

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.close_action`

Action to perform after a CHILD_SA gets closed by the peer.

The default of none does not take any action,
trap installs a trap policy for the CHILD_SA.
start tries to re-create the CHILD_SA.

ESP proposals to offer for the CHILD_SA. A proposal is a set of algorithms. For ESP non-AEAD proposals, this includes an integrity algorithm, an encryption algorithm, an optional Diffie-Hellman group and an optional Extended Sequence Number Mode indicator. For AEAD proposals, a combined mode algorithm is used instead of the separate encryption/integrity algorithms.

If a DH group is specified, CHILD_SA/Quick Mode rekeying and initial negotiation use a separate Diffie-Hellman exchange using the specified group. However, for IKEv2, the keys of the CHILD_SA created implicitly with the IKE_SA will always be derived from the IKE_SA's key material. So any DH group specified here will only apply when the CHILD_SA is later rekeyed or is created with a separate CREATE_CHILD_SA exchange. A proposal mismatch might, therefore, not immediately be noticed when the SA is established, but may later cause rekeying to fail.

Extended Sequence Number support may be indicated with the esn and noesn values, both may be included to indicate support for both modes. If omitted, noesn is assumed.

In IKEv2, multiple algorithms of the same kind can be specified in a single proposal, from which one gets selected. In IKEv1, only one algorithm per kind is allowed per proposal, more algorithms get implicitly stripped. Use multiple proposals to offer different algorithms combinations in IKEv1.

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.life_packets`

Maximum number of packets processed before CHILD_SA gets closed. Usually this hard packets limit is never reached, because the CHILD_SA gets rekeyed before. If that fails for whatever reason, this limit closes the CHILD_SA.

The default is 10% more than {option}rekey_bytes.

Type: null or signed integer

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.life_time`

Maximum lifetime before CHILD_SA gets closed. Usually this hard lifetime is never reached, because the CHILD_SA gets rekeyed before. If that fails for whatever reason, this limit closes the CHILD_SA. The default is 10% more than the {option}rekey_time.

Type: null or string

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.local_ts`

List of local traffic selectors to include in CHILD_SA. Each selector is a CIDR subnet definition, followed by an optional proto/port selector. The special value dynamic may be used instead of a subnet definition, which gets replaced by the tunnel outer address or the virtual IP, if negotiated. This is the default.

A protocol/port selector is surrounded by opening and closing square brackets. Between these brackets, a numeric or getservent(3) protocol name may be specified. After the optional protocol restriction, an optional port restriction may be specified, separated by a slash. The port restriction may be numeric, a getservent(3) service name, or the special value opaque for RFC 4301 OPAQUE selectors. Port ranges may be specified as well, none of the kernel backends currently support port ranges, though.

When IKEv1 is used only the first selector is interpreted, except if the Cisco Unity extension plugin is used. This is due to a limitation of the IKEv1 protocol, which only allows a single pair of selectors per CHILD_SA. So to tunnel traffic matched by several pairs of selectors when using IKEv1 several children (CHILD_SAs) have to be defined that cover the selectors. The IKE daemon uses traffic selector narrowing for IKEv1, the same way it is standardized and implemented for IKEv2. However, this may lead to problems with other implementations. To avoid that, configure identical selectors in such scenarios.

StrongSwan default: ["dynamic"]

Type: null or (list of string)

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.mark_in`

Netfilter mark and mask for input traffic. On Linux, Netfilter may require marks on each packet to match an SA/policy having that option set. This allows installing duplicate policies and enables Netfilter rules to select specific SAs/policies for incoming traffic. Note that inbound marks are only set on policies, by default, unless {option}mark_in_sa is enabled. The special value %unique sets a unique mark on each CHILD_SA instance, beyond that the value %unique-dir assigns a different unique mark for each

An additional mask may be appended to the mark, separated by /. The default mask if omitted is 0xffffffff.

StrongSwan default: "0/0x00000000"

Type: null or string

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.mark_in_sa`

Time to schedule CHILD_SA rekeying. CHILD_SA rekeying refreshes key material, optionally using a Diffie-Hellman exchange if a group is specified in the proposal. To avoid rekey collisions initiated by both ends simultaneously, a value in the range of {option}rand_time gets subtracted to form the effective soft lifetime.

Netfilter mark applied to packets after the inbound IPsec SA processed them. This way it's not necessary to mark packets via Netfilter before decryption or right afterwards to match policies or process them differently (e.g. via policy routing).

An additional mask may be appended to the mark, separated by /. The default mask if omitted is 0xffffffff. The special value %same uses the value (but not the mask) from {option}mark_in as mark value, which can be fixed, %unique or %unique-dir.

Setting marks in XFRM input requires Linux 4.19 or higher.

StrongSwan default: "0/0x00000000"

Type: null or string

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.set_mark_out`

Netfilter mark applied to packets after the outbound IPsec SA processed them. This allows processing ESP packets differently than the original traffic (e.g. via policy routing).

An additional mask may be appended to the mark, separated by /. The default mask if omitted is 0xffffffff. The special value %same uses the value (but not the mask) from {option}mark_out as mark value, which can be fixed, %unique_ or %unique-dir.

Setting marks in XFRM output is supported since Linux 4.14. Setting a mask requires at least Linux 4.19.

StrongSwan default: "0/0x00000000"

Type: null or string

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.sha256_96`

HMAC-SHA-256 is used with 128-bit truncation with IPsec. For compatibility with implementations that incorrectly use 96-bit truncation this option may be enabled to configure the shorter truncation length in the kernel. This is not negotiated, so this only works with peers that use the incorrect truncation length (or have this option enabled).

StrongSwan default: false

Type: null or boolean

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.start_action`

Action to perform after loading the configuration.

The default of none loads the connection only, which then can be manually initiated or used as a responder configuration.
The value trap installs a trap policy, which triggers the tunnel as soon as matching traffic has been detected.
The value start initiates the connection actively.

When unloading or replacing a CHILD_SA configuration having a {option}start_action different from none, the inverse action is performed. Configurations with start get closed, while such with trap get uninstalled.

StrongSwan default: "none"

Type: null or one of "none", "trap", "start"

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.children.<name>.tfc_padding`

Pads ESP packets with additional data to have a consistent ESP packet size for improved Traffic Flow Confidentiality. The padding defines the minimum size of all ESP packets sent. The default value of 0 disables TFC padding, the special value mtu adds TFC padding to create a packet size equal to the Path Maximum Transfer Unit.

StrongSwan default: 0

Type: null or signed integer or value "mtu" (singular enum)

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

To enforce UDP encapsulation of ESP packets, the IKE daemon can fake the NAT detection payloads. This makes the peer believe that NAT takes place on the path, forcing it to encapsulate ESP packets in UDP.

Usually this is not required, but it can help to work around connectivity issues with too restrictive intermediary firewalls.

StrongSwan default: false

Type: null or boolean

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.fragmentation`

Use IKE fragmentation (proprietary IKEv1 extension or RFC 7383 IKEv2 fragmentation). Acceptable values are yes (the default since 5.5.1), accept (since versions:5.5.3), force and no.

If set to yes, and the peer supports it, oversized IKE messages will be sent in fragments.
If set to accept, support for fragmentation is announced to the peer but the daemon does not send its own messages in fragments.
If set to force (only supported for IKEv1) the initial IKE message will already be fragmented if required.
Finally, setting the option to no will disable announcing support for this feature.

Note that fragmented IKE messages sent by a peer are always processed irrespective of the value of this option (even when set to no).

StrongSwan default: "yes"

Type: null or one of "yes", "accept", "force", "no"

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.if_id_in`

XFRM interface ID set on inbound policies/SA, can be overridden by child config, see there for details.

The special value %unique allocates a unique interface ID per IKE_SA, which is inherited by all its CHILD_SAs (unless overridden there), beyond that the value %unique-dir assigns a different unique interface ID for each direction (in/out).

StrongSwan default: "0"

Type: null or string

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.if_id_out`

XFRM interface ID set on outbound policies/SA, can be overridden by child config, see there for details.

Authentication to perform locally.

The default pubkey uses public key authentication using a private key associated to a usable certificate.
psk uses pre-shared key authentication.
The IKEv1 specific xauth is used for XAuth or Hybrid authentication,
while the IKEv2 specific eap keyword defines EAP authentication.
For xauth, a specific backend name may be appended, separated by a dash. The appropriate xauth backend is selected to perform the XAuth exchange. For traditional XAuth, the xauth method is usually defined in the second authentication round following an initial pubkey (or psk) round. Using xauth in the first round performs Hybrid Mode client authentication.
For eap, a specific EAP method name may be appended, separated by a dash. An EAP module implementing the appropriate method is selected to perform the EAP conversation.
Since 5.4.0, if both peers support RFC 7427 ("Signature Authentication in IKEv2") specific hash algorithms to be used during IKEv2 authentication may be configured. To do so use ike: followed by a trust chain signature scheme constraint (see description of the {option}remote section's {option}auth keyword). For example, with ike:pubkey-sha384-sha256 a public key signature scheme with either SHA-384 or SHA-256 would get used for authentication, in that order and depending on the hash algorithms supported by the peer. If no specific hash algorithms are configured, the default is to prefer an algorithm that matches or exceeds the strength of the signature key. If no constraints with ike: prefix are configured any signature scheme constraint (without ike: prefix) will also apply to IKEv2 authentication, unless this is disabled in strongswan.conf. To use RSASSA-PSS signatures use rsa/pss instead of pubkey or rsa as in e.g. ike:rsa/pss-sha256. If pubkey or rsa constraints are configured RSASSA-PSS signatures will only be used if enabled in strongswan.conf(5).

StrongSwan default: "pubkey"

Type: null or string

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

List of certificate candidates to use for authentication. The certificates may use a relative path from the swanctl x509 directory or an absolute path.

The certificate used for authentication is selected based on the received certificate request payloads. If no appropriate CA can be located, the first certificate is used.

List of raw public key candidates to use for authentication. The public keys may use a relative path from the swanctl pubkey directory or an absolute path.

Even though multiple local public keys could be defined in principle, only the first public key in the list is used for authentication.

StrongSwan default: []

Type: null or (list of string)

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.round`

Optional numeric identifier by which authentication rounds are sorted. If not specified rounds are ordered by their position in the config file/vici message.

StrongSwan default: 0

Type: null or signed integer

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.local.<name>.xauth_id`

Client XAuth username used in the XAuth exchange.

Type: null or string

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.local_addrs`

Local address(es) to use for IKE communication. Takes single IPv4/IPv6 addresses, DNS names, CIDR subnets or IP address ranges.

As initiator, the first non-range/non-subnet is used to initiate the connection from. As responder, the local destination address must match at least to one of the specified addresses, subnets or ranges.

If FQDNs are assigned they are resolved every time a configuration lookup is done. If DNS resolution times out, the lookup is delayed for that time.

StrongSwan default: []

Type: null or (list of string)

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.local_port`

Local UDP port for IKE communication. By default the port of the socket backend is used, which is usually 500. If port 500 is used, automatic IKE port floating to port 4500 is used to work around NAT issues.

Using a non-default local IKE port requires support from the socket backend in use (socket-dynamic).

StrongSwan default: 500

Type: null or signed integer

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.mediated_by`

The name of the connection to mediate this connection through. If given, the connection will be mediated through the named mediation connection. The mediation connection must have mediation enabled.

Type: null or string

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.mediation`

Whether this connection is a mediation connection, that is, whether this connection is used to mediate other connections using the IKEv2 Mediation Extension. Mediation connections create no CHILD_SA.

StrongSwan default: false

Type: null or boolean

Default

null

List of named IP pools to allocate virtual IP addresses and other configuration attributes from. Each name references a pool by name from either the pools section or an external pool.

StrongSwan default: []

Type: null or (list of string)

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.ppk_id`

String identifying the Postquantum Preshared Key (PPK) to be used.

Type: null or string

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.ppk_required`

Whether a Postquantum Preshared Key (PPK) is required for this connection.

StrongSwan default: false

Type: null or boolean

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.proposals`

A proposal is a set of algorithms. For non-AEAD algorithms, this includes for IKE an encryption algorithm, an integrity algorithm, a pseudo random function and a Diffie-Hellman group. For AEAD algorithms, instead of encryption and integrity algorithms, a combined algorithm is used.

In IKEv2, multiple algorithms of the same kind can be specified in a single proposal, from which one gets selected. In IKEv1, only one algorithm per kind is allowed per proposal, more algorithms get implicitly stripped. Use multiple proposals to offer different algorithms combinations in IKEv1.

Algorithm keywords get separated using dashes. Multiple proposals may be specified in a list. The special value default forms a default proposal of supported algorithms considered safe, and is usually a good choice for interoperability.

StrongSwan default: ["default"]

Type: null or (list of string)

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.pull`

If the default of yes is used, Mode Config works in pull mode, where the initiator actively requests a virtual IP. With no, push mode is used, where the responder pushes down a virtual IP to the initiating peer.

Push mode is currently supported for IKEv1, but not in IKEv2. It is used by a few implementations only, pull mode is recommended.

StrongSwan default: true

Type: null or boolean

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

List of CA certificates to accept for authentication. The certificates may use a relative path from the swanctl x509ca directory or an absolute path.

StrongSwan default: []

Type: null or (list of string)

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

List of certificate policy OIDs the peer's certificate must have. OIDs are specified using the numerical dotted representation.

StrongSwan default: []

Type: null or (list of string)

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.certs`

List of certificates to accept for authentication. The certificates may use a relative path from the swanctl x509 directory or an absolute path.

StrongSwan default: []

Type: null or (list of string)

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

Certificate revocation policy for CRL or OCSP revocation.

A strict revocation policy fails if no revocation information is available, i.e. the certificate is not known to be unrevoked.
ifuri fails only if a CRL/OCSP URI is available, but certificate revocation checking fails, i.e. there should be revocation information available, but it could not be obtained.
The default revocation policy relaxed fails only if a certificate is revoked, i.e. it is explicitly known that it is bad.

StrongSwan default: "relaxed"

Type: null or one of "strict", "ifuri", "relaxed"

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.remote.<name>.round`

Optional numeric identifier by which authentication rounds are sorted. If not specified rounds are ordered by their position in the config file/vici message.

StrongSwan default: 0

Type: null or signed integer

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.remote_addrs`

Remote address(es) to use for IKE communication. Takes single IPv4/IPv6 addresses, DNS names, CIDR subnets or IP address ranges.

As initiator, the first non-range/non-subnet is used to initiate the connection to. As responder, the initiator source address must match at least to one of the specified addresses, subnets or ranges.

If FQDNs are assigned they are resolved every time a configuration lookup is done. If DNS resolution times out, the lookup is delayed for that time. To initiate a connection, at least one specific address or DNS name must be specified.

StrongSwan default: []

Type: null or (list of string)

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.remote_port`

Remote UDP port for IKE communication. If the default of port 500 is used, automatic IKE port floating to port 4500 is used to work around NAT issues.

StrongSwan default: 500

Type: null or signed integer

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.send_cert`

Send certificate payloads when using certificate authentication.

With the default of ifasked the daemon sends certificate payloads only if certificate requests have been received.
never disables sending of certificate payloads altogether,
always causes certificate payloads to be sent unconditionally whenever certificate authentication is used.

StrongSwan default: "ifasked"

`services.strongswan-swanctl.swanctl.connections.<name>.version`

IKE major version to use for connection.

1 uses IKEv1 aka ISAKMP,
2 uses IKEv2.
A connection using the default of 0 accepts both IKEv1 and IKEv2 as responder, and initiates the connection actively with IKEv2.

StrongSwan default: 0

Type: null or signed integer

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.connections.<name>.vips`

List of virtual IPs to request in IKEv2 configuration payloads or IKEv1 Mode Config. The wildcard addresses 0.0.0.0 and :: request an arbitrary address, specific addresses may be defined. The responder may return a different address, though, or none at all.

StrongSwan default: []

Type: null or (list of string)

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

`services.strongswan-swanctl.swanctl.pools`

Section defining named pools. Named pools may be referenced by connections with the pools option to assign virtual IPs and other configuration attributes. Each pool must have a unique name (denoted \<name> below).

Type: attribute set of (submodule)

Default

{ }

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix

Type: null or string

Default

null

Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/strongswan-swanctl/module.nix