VPNs & Tailscale
[l3vpns]
This section defines Layer 3 VPN interfaces. The key for each entry is a user-defined name for the interface.
Common Fields
| Key | Type | Description | Required |
|---|---|---|---|
type | String | Active types include wireguard, amneziawg, and experimental tailscale. openvpn is accepted by the schema but should not be treated as an implemented OpenVPN client. | Yes |
nickname | String | A user-friendly name for the interface. | No |
enabled | Boolean | Whether the interface is enabled. Defaults to true. | No |
WireGuard Specific Fields (When type=wireguard)
| Key | Type | Description | Required |
|---|---|---|---|
private-key | String | The private key for the interface. | Yes |
address | CIDR | The internal IP address and subnet for the interface. | Yes |
Tailscale fields (type:tailscale, experimental, Pro)
| Key | Meaning |
|---|---|
login-server | HTTPS control server URL, normally https://controlplane.tailscale.com; no embedded credentials, query, or fragment. |
auth-key | Optional bootstrap enrollment key. Prefer browser login or a one-time key submission to avoid saving secrets in the profile. |
exit-node-ip | Optional preferred exit-node IPv4 address, without a CIDR or port. Applied on VPN restart and explicit login. The node must be available and advertise exit capability; otherwise inspect Tailscale status. Omit to use the device's saved preference. |
drive-dns | Default false. Derive peer IPv4 DNS records through MintFlow DNS; this does not enable the Tailscale OS MagicDNS resolver. Requires Pro and the MintFlow DNS path. |
enabled | Default true. Only one active Tailscale interface per profile. |
[l3vpns]
tailnet=type:tailscale,login-server:https://controlplane.tailscale.com,enabled:true
[routing]
CIDR,100.64.0.0/10,L3VPN,tailnet
DEFAULT,DIRECT
DNS-FALLBACK,DIRECT
Use with [dns] app-routing-enabled=true and suitable direct-dns upstreams. See the complete login and routing guide. Machine identity and Accept Routes remain device-local. The optional exit-node-ip saves a preferred exit node in the profile and syncs with it; live overrides do not change the profile. Without this field, each device keeps its own exit-node preference. Losing Pro access excludes the interface during compilation and changes routes targeting it to REJECT.
AmneziaWG Specific Fields (When type=amneziawg)
MintFlow 1.9.0 supports AmneziaWG 1.5 and 2.0 interface parameters. Peer fields are configured separately in [amneziawg-peers].
| Key | Type | Description | Required |
|---|---|---|---|
private-key | String | The private key for the interface. | Yes |
address | CIDR | The internal IP address and subnet for the interface. | Yes |
jc | Integer | Junk packet count parameter. | No |
jmin | Integer | Minimum junk packet size. | No |
jmax | Integer | Maximum junk packet size. | No |
s1 | Integer | AmneziaWG S1 parameter. | No |
s2 | Integer | AmneziaWG S2 parameter. | No |
s3 | Integer | AmneziaWG S3 parameter. | No |
s4 | Integer | AmneziaWG S4 parameter. | No |
h1 | Integer or range | H1 packet header value, for example 1 or 843739526-1233562642. | No |
h2 | Integer or range | H2 packet header value, for example 2 or 1383464517-1389039856. | No |
h3 | Integer or range | H3 packet header value, for example 3 or 1558777559-1611162592. | No |
h4 | Integer or range | H4 packet header value, for example 4 or 1797613837-1977519157. | No |
i1 ... i5 | String | AmneziaWG 2.0 CPS instruction strings. Each field is limited to 255 UTF-8 bytes. Supported tags are <b>, <r>, <rd>, <rc>, and <t>. | No |
Example:
[l3vpns]
my-wireguard=type:wireguard,nickname:My WG,private-key:...,address:10.0.0.1/32
my-awg=type:amneziawg,nickname:My AWG,private-key:...,address:10.8.9.2/32,jc:4,jmin:40,jmax:70,s1:0,s2:0,s3:0,s4:0,h1:1,h2:2,h3:3,h4:4,i1:<r 33>
[wireguard-peers]
This section defines peers for WireGuard interfaces. The key for each entry is a user-defined name for the peer.
| Key | Type | Description | Required |
|---|---|---|---|
interface | String | The name of the l3vpns interface this peer belongs to. | Yes |
public-key | String | The public key of the peer. | Yes |
preshared-key | String | An optional pre-shared key. | No |
endpoint | String | The public endpoint of the peer (e.g., 1.2.3.4:51820). | Yes |
allowed-ips | List of CIDRs | A list of IP addresses/ranges to be routed through this peer. | Yes |
Example:
[wireguard-peers]
my-peer=interface:my-wireguard,public-key:...,endpoint:1.2.3.4:51820,allowed-ips:0.0.0.0/0
[amneziawg-peers]
This section defines peers for AmneziaWG interfaces. The key for each entry is a user-defined peer name. The fields match WireGuard peers, but interface must reference an [l3vpns] entry whose type is amneziawg.
| Key | Type | Description | Required |
|---|---|---|---|
interface | String | The name of the amneziawg interface this peer belongs to. | Yes |
public-key | String | The public key of the peer. | Yes |
preshared-key | String | An optional pre-shared key. | No |
endpoint | String | The public endpoint of the peer, for example 1.2.3.4:51820. | Yes |
allowed-ips | List of CIDRs | A list of IP addresses/ranges to be routed through this peer. | Yes |
Example:
[amneziawg-peers]
my-awg-peer=interface:my-awg,public-key:...,endpoint:1.2.3.4:51820,allowed-ips:0.0.0.0/0,::/0