wiretastix

Configuring Global Defaults

How to review and set the global configuration parameters that govern new tunnels, users, and OIDC behavior.

Once you can connect with the CLI (see Creating an API Token and Connecting with the CLI), the next thing worth doing is reviewing the global defaults that apply to every new tunnel and user unless a group overrides them. These live in the config command group.

List Current Settings

wiretastix-cli
> config list

+----------------------------+-----------------+
| PARAM                      | VALUE           |
+----------------------------+-----------------+
| additional_ports           |                 |
| auto_disable_on_auth_error | 1               |
| default_allowed_ips        | 192.168.1.0/24  |
| default_dns                | 1.1.1.1,8.8.8.8 |
| default_endpoint           | 192.168.0.1:51820 |
| default_group              | fallback        |
| default_keepalive_seconds  | 25              |
| default_mtu                | 1280            |
| default_search             | localdomain     |
| max_devices                | 100             |
| new_devices_enabled        | 1               |
| new_users_enabled          | 1               |
| reauthenticate_every       | 30m             |
+----------------------------+-----------------+

This is the complete set – there are no other global parameters beyond these thirteen. These are the values seeded into a brand-new install, not placeholder examples – notably, default_endpoint (192.168.0.1:51820) and default_group (fallback, which doesn’t correspond to an actual group until you create one) are non-functional placeholders you’re expected to change, not usable defaults. See Default Configuration Settings for what happens with each parameter if you don’t.

Set a Value

> config set default_mtu 1420
> config set default_endpoint vpn.example.com:51820

Delete a Value

> config delete default_search

Deleting a parameter removes it entirely rather than restoring the value it was seeded with – for most parameters (like default_search above) that lands on an equivalent or safely-more-restrictive fallback, but not always. default_allowed_ips and default_endpoint have no fallback at all if deleted (peers get an empty allowed-IPs list, and generating any client config fails outright, respectively), and default_group deleted behaves the same as its seeded-but-not-yet-real fallback value: no group gets assigned to a user with no matching claims, and their tunnel creation fails. See the per-parameter notes in Default Configuration Settings before deleting any of those three – use config set to a deliberate value instead.

What Each Parameter Controls

Rather than repeat it here, see Default Configuration Settings for a full description of every parameter above, its built-in default, and how it behaves. A couple worth calling out before you start changing things:

  • default_group only applies when a user’s OIDC group claims don’t match any configured group – see Manage Groups. It must name a group that actually exists and is enabled – the seeded value (fallback) is just a placeholder string, not an auto-created group. If it’s left unset, or points at a group that doesn’t exist/isn’t enabled, a user who doesn’t match any real group cannot get one assigned at all, and their self-service tunnel creation fails outright rather than just skipping group-level settings.
  • default_endpoint has the same kind of hard failure mode: the seeded value (192.168.0.1:51820) is a non-functional placeholder, and if it’s ever unset, generating any peer’s client config fails outright rather than falling back to something usable. Set both this and default_group to real values before onboarding users, and avoid config delete-ing either.
  • auto_disable_on_auth_error automatically disables a user (and takes down their tunnels, per Manage Users) if their OIDC token refresh fails with what looks like a genuine authorization problem. It deliberately does not trigger on what looks like an IdP outage, so a temporary network blip between Wiretastix and your IdP won’t lock everyone out.
  • Several of these (max_devices, default_allowed_ips, default_dns, default_search) can be overridden per-group – a matching group’s value wins over the global default for its members.

Next Steps

With global defaults reviewed, move on to Manage Groups to set up per-group overrides and policy, or Managing Peers if you need machine-to-machine tunnels.