---
url: /apranik/configuration/outbound/freedom.md
---
# Freedom

Sends each connection straight to its destination, over TCP and UDP. Built by
core, not a module. It takes `tag`, `transport` and `protocol` only; destinations'
names are resolved by the [resolver](../dns/index.md).

## Structure

```json
{
  "tag": "direct",
  "transport": [
    {
      "type": "tcp",
      "settings": { "keep_alive": "15s", "dial_timeout": "10s" }
    },
    { "type": "fragment" }
  ],
  "protocol": {
    "type": "freedom",
    "settings": {
      "nat": {
        "mapping": "endpoint-independent",
        "filtering": "address-and-port-dependent",
        "max_datagram_size": 8192,
        "idle_timeout": "5m"
      }
    }
  }
}
```

## Fields

### `transport`

list of transports
Default: \[{ "type": "tcp" }]

How TCP connections reach each destination: [`tcp`](../transport/tcp.md), then only
transports that need nothing on the far side, such as
[`fragment`](../transport/fragment.md). `tls` or `ws` would reach the destination
as garbage, so `check` refuses them.

### `udp`

object

[`udp` transport](../transport/udp.md) settings for the UDP sockets. None exist yet.

### `nat`

object

How UDP behaves as a NAT, in RFC 4787 terms.

### `nat.mapping`

string
Default: endpoint-independent

When a UDP session gets a new socket: `endpoint-independent` (one for every
destination), `address-dependent` (one per IP) or `address-and-port-dependent`
(one per IP and port).

### `nat.filtering`

string
Default: address-and-port-dependent

Who may reply: `address-and-port-dependent` (only the exact address sent to),
`address-dependent` (any port of that IP) or `endpoint-independent` (anyone).

> \[!WARNING]
> `endpoint-independent` lets an off-path sender inject packets into a session.

### `nat.max_datagram_size`

integer, bytes
Default: 8192

The largest reply passed on; a larger one is dropped and counted. Match the
inbound's [`udp_max_datagram_size`](../inbound/index.md#udp_max_datagram_size).

### `nat.idle_timeout`

duration
Default: 5m

Closes a UDP socket silent for this long.

[![RFC 4787 mapping and filtering in freedom's NAT](../../assets/diagrams/nat-behaviours.excalidraw.svg)](../../assets/diagrams/nat-behaviours.excalidraw.svg)