Freedom

Sends each connection straight to its destination, over TCP and UDP. Built by core, not a module. It takes tag, transport and protocol only; destinations' names are resolved by the resolver.

Structure

{
  "tag": "direct",
  "transport": [
    {
      "type": "tcp",
      "settings": { "keep_alive": "15s", "dial_timeout": "10s" }
    },
    { "type": "fragment" }
  ],
  "protocol": {
    "type": "freedom",
    "settings": {
      "nat": {
        "mapping": "endpoint-independent",
        "filtering": "address-and-port-dependent",
        "max_datagram_size": 8192,
        "idle_timeout": "5m"
      }
    }
  }
}

Fields

transport

list of transportsDefault: [{ "type": "tcp" }]

How TCP connections reach each destination: tcp, then only transports that need nothing on the far side, such as fragment. tls or ws would reach the destination as garbage, so check refuses them.

udp

object

udp transport settings for the UDP sockets. None exist yet.

nat

object

How UDP behaves as a NAT, in RFC 4787 terms.

nat.mapping

stringDefault: endpoint-independent

When a UDP session gets a new socket: endpoint-independent (one for every destination), address-dependent (one per IP) or address-and-port-dependent (one per IP and port).

nat.filtering

stringDefault: address-and-port-dependent

Who may reply: address-and-port-dependent (only the exact address sent to), address-dependent (any port of that IP) or endpoint-independent (anyone).

WARNING

endpoint-independent lets an off-path sender inject packets into a session.

nat.max_datagram_size

integer, bytesDefault: 8192

The largest reply passed on; a larger one is dropped and counted. Match the inbound's udp_max_datagram_size.

nat.idle_timeout

durationDefault: 5m

Closes a UDP socket silent for this long.