.\" ***********************************************************************
.\" *  Copyright © 2004-2007 Rémi Denis-Courmont.                         *
.\" *  This program is free software; you can redistribute and/or modify  *
.\" *  it under the terms of the GNU General Public License as published  *
.\" *  by the Free Software Foundation; version 2 of the license.         *
.\" *                                                                     *
.\" *  This program is distributed in the hope that it will be useful,    *
.\" *  but WITHOUT ANY WARRANTY; without even the implied warranty of     *
.\" *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.               *
.\" *  See the GNU General Public License for more details.               *
.\" *                                                                     *
.\" *  You should have received a copy of the GNU General Public License  *
.\" *  along with this program; if not, you can get it from:              *
.\" *  http://www.gnu.org/copyleft/gpl.html                               *
.\" ***********************************************************************
.TH "MIREDO" "8" "February 2008" "miredo" "System Manager's Manual"
.SH NAME
miredo \- Teredo IPv6 tunneling for Unix
.SH SYNOPSIS
.BR "miredo" " [" "-c config_file" "] [" "-f" "] [" "-u user" "] ["
.BR "-t chrootdir" "] [" "server_name" "]"

.SH DESCRIPTON
.B Miredo
is a daemon program providing a Teredo tunnel service compatible
with the "Teredo: Tunneling IPv6 over UDP through NATs" Internet
proposed standard (RFC 4380). It can provide either Teredo client or
Teredo relay functionality.

This is mostly useful to provide IPv6 connectivity to users behind NAT,
most of which do not support IPv6 at all. Many NATs do not even support
.IR "proto-41" " forwarding, so it is not possible to set up a " "6to4"
.RI "or point-to-point " "IPv6-over-IPv4" " tunnel through them."

A Teredo relay is an IPv6 router which forwards IPv6 packets between
the IPv6 Internet and Teredo clients by encapsulating these IPv6
packets over UDP/IPv4.

A Teredo client is an IPv6-enabled host which is located behind an
IPv4-only Network Address Translator (a.k.a. NAT), and encapsulates its
IPv6 traffic inside UDP over IPv4 packets.

A Teredo server is a special Teredo relay which is required for Teredo
clients to setup their IPv6 connectivity through Teredo. A Teredo
server must have to global static subsequent IPv4 addresses. It
receives packets from Teredo clients and Teredo relays on UDP port
3544.

.SH OPTIONS

.TP
.BR "\-c config_file" " or " "\-\-config config_file"
Specify an alternate configuration file for Miredo instead of the
.RI "default, " "/etc/miredo/miredo.conf" "."

.TP
.BR "\-f" " or " "\-\-foreground"
Do not detach from the console. Run the program in the foreground.

.TP
.BR "\-h" " or " "\-\-help"
Display some help and exit.

.TP
.BR "\-t" " or " "\-\-chrootdir"
Specify a directory to use as a root after initialization is completed.
When used as a Teredo client, the hostname resolver library files must
be present in the chroot. The directory can safely be left empty for a
Teredo relay.

.TP
.BR "\-u username" " or " "\-\-user username"
Override the user that the program will run as. By default, it runs as
.BR "nobody" "."

.TP
.BR "\-V" " or " "\-\-version"
Display program version and license and exit.

.TP
.BR "server_name"
This optional command argument specifies a Teredo server to use. It
will override any ServerAddress directive found in the configuration
file. It is ignored if RelayType is not set to "client" (see miredo.conf).

.\".SH DIAGNOSTICS
.\".SH BUGS
.SH SECURITY
.B Miredo
requires
.I root
privileges to create its IPv6 tunneling network interface, and to set
it up properly. Once its initialization is complete, it will
.IR "setgid" ", " "chroot" " into an empty directory and ultimately"
.IR "setuid" " (see option " "-u" "), so as to decrease the system's"
exposure to potential security issues. However, if Miredo runs as a
Teredo client, it needs root privileges when running, in order to
change the tunneling network interface settings automatically. To
.RI "prevent possible root compromise, Miredo implements " "priveleges"
.IR "separation" ". The process that handles data from the network is"
not privileged.

While that is not specific to nor dependant on Miredo, it should be
noted that Teredo connectivity allows anyone behind a NAT to obtain
global public IPv6 connectivity. It might break some corporate policy.
If that is an issue, outgoing UDP packets with destination port 3544
should be blocked at the perimeter firewall.

.SH SIGNALS
.BR "SIGHUP" " Force a reload of the daemon."

.BR "SIGINT" ", " "SIGTERM" " Shutdown the daemon."

.BR "SIGUSR1" ", " "SIGUSR2" " Do nothing, might be used in future "
versions.

.SH FILES
.TP
.I /etc/miredo/miredo.conf
The default configuration file.

.TP
.I /var/run/miredo.pid
The process-id file.

.SH "SEE ALSO"
miredo.conf(5), miredo-server(8), ipv6(7), route(8), ip(8)

.SH AUTHOR
R\[char233]mi Denis-Courmont <remi at remlab dot net>

http://www.remlab.net/miredo/