dtctl vpn create
Usage
dtctl vpn create [flags]
Aliases
c
Description
Create a site-to-site VPN connection on a router. Reference existing IKE/IPSEC policies and endpoint groups by ID, or create them inline with the corresponding parameter flags. The router must already have a VPN service (see create-service).
Example
# Create a VPN using existing policies and inline endpoint subnets/CIDRs
dtctl vpn create --router-id <router-id> \
--vpn name=to-hq,peer_address=203.0.113.10,psk=<psk>,peer_id=203.0.113.10,initiator=bi-directional \
--ike-policy-id <ike-id> --ipsec-policy-id <ipsec-id> \
--local-endpoint-name local --local-endpoint-subnets <subnet-id> \
--remote-endpoint-name remote --remote-endpoint-subnets 192.168.100.0/24
Flags
| Option | Description |
|---|---|
--ike-policy, -k | Create an IKE policy inline as key=value: name, lifetime, auth_algorithm, encryption_algorithm, ike_version, pfs |
--ike-policy-id, -i | ID of an existing IKE policy (provide this or --ike-policy) |
--ipsec-policy, -t | Create an IPSEC policy inline as key=value: name, lifetime, auth_algorithm, encryption_algorithm, pfs |
--ipsec-policy-id, -s | ID of an existing IPSEC policy (provide this or --ipsec-policy) |
--local-endpoint-id, -l | ID of an existing local endpoint group (provide this or --local-endpoint-name + --local-endpoint-subnets) |
--local-endpoint-name, -n | Name for a new local endpoint group |
--local-endpoint-subnets, -d | Comma-separated local subnet IDs for a new local endpoint group |
--remote-endpoint-id, -m | ID of an existing remote endpoint group (provide this or --remote-endpoint-name + --remote-endpoint-subnets) |
--remote-endpoint-name, -w | Name for a new remote endpoint group |
--remote-endpoint-subnets, -z | Comma-separated remote CIDRs for a new remote endpoint group, e.g. 192.168.100.0/24,192.168.101.0/24 |
--router-id, -r | ID of the router to create the VPN on (required) |
--vpn, -p | Connection parameters as key=value: name, peer_address, psk, peer_id, local_id, initiator (bi-directional|response-only), dpd_action, dpd_interval, dpd_timeout (required) |
Related Commands
| Command | Description |
|---|---|
| dtctl vpn list | List VPN connections |
| dtctl vpn show | Show a VPN connection |
| dtctl vpn update | Update a VPN connection |
| dtctl vpn delete | Delete a VPN connection |
| dtctl vpn endpoints | Show a VPN's endpoints |
| dtctl vpn policies | Show a VPN's policies |
| dtctl vpn restart | Restart a VPN connection |
Global Flags
| Option | Description |
|---|---|
--api-url | Send this command to a different API endpoint, e.g. a test environment (default "https://console.dt.net.tr/api/v1") |
--config, -c | Specify a custom config file Default: ~/.config/dtctl/config.yaml |
--no-headers | Omit the column headers, for scripting Default: false |
--output, -o | Output format: text, wide, vertical, json. text fits the terminal, wide never truncates, vertical prints one field per line Default: text |