complete -c easytier-core -s w -l config-server -d 'config server address, allow format: full url: --config-server udp://127.0.0.1:22020/admin, \'udp\' can be replaced with tcp, ws, wss (when config server ws is proxied to wss) only user name: --config-server admin, will use official server ' -r
complete -c easytier-core -l machine-id -d 'the machine id to identify this machine, used for config recovery after disconnection, must be unique and fixed. by default it is loaded from persisted local state; on first start it may be migrated from system information or generated, then remains fixed. ' -r
complete -c easytier-core -s c -l config-file -d 'path to the config file, NOTE: the options set by cmdline args will override options in config file' -r -F
complete -c easytier-core -l config-dir -d 'Load all .toml files in the directory to start network instances, and store the received configurations in this directory.' -r -F
complete -c easytier-core -l network-name -d 'network name to identify this vpn network' -r
complete -c easytier-core -l network-secret -d 'network secret to verify this node belongs to the vpn network' -r
complete -c easytier-core -s i -l ipv4 -d 'ipv4 address of this vpn node, if empty, this node will only forward packets and no TUN device will be created' -r
complete -c easytier-core -l ipv6 -d 'ipv6 address of this vpn node, can be used together with ipv4 for dual-stack operation' -r
complete -c easytier-core -l ipv6-public-addr-provider -d 'share this node\'s public IPv6 subnet with other peers so they can obtain public IPv6 addresses (Linux only)' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l ipv6-public-addr-auto -d 'auto-obtain a public IPv6 address from a peer that shares its IPv6 subnet' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l ipv6-public-addr-prefix -d 'manually specify the public IPv6 subnet to share, instead of auto-detecting from system routes' -r
complete -c easytier-core -s d -l dhcp -d 'automatically determine and set IP address by Easytier, and the IP address starts from 10.0.0.1 by default. Warning, if there is an IP conflict in the network when using DHCP, the IP will be automatically changed.' -r -f -a "true\t''
false\t''"
complete -c easytier-core -s p -l peers -d 'peers to connect initially' -r
complete -c easytier-core -s e -l external-node -d 'use a public shared node to discover peers' -r
complete -c easytier-core -s n -l proxy-networks -d 'export local networks to other peers in the vpn,  e.g.: 10.0.0.0/24. also support mapping proxy network to other cidr, e.g.: 10.0.0.0/24->192.168.0.0/24 other peers can access 10.0.0.1 with ip 192.168.0.1 ' -r
complete -c easytier-core -s l -l listeners -d 'listeners to accept connections, allow format: port number: <11010>. means tcp/udp will listen on 11010, ws/wss will listen on 11010 and 11011, wg will listen on 11011 url: <tcp://0.0.0.0:11010>. tcp can be tcp, udp, ring, wg, ws, wss, quic, faketcp\\n proto & port pair: <proto:port>. wg:11011, means listen on 11011 with wireguard protocol url and proto:port can occur multiple times. ' -r
complete -c easytier-core -l mapped-listeners -d 'manually specify the public address of the listener, other nodes can use this address to connect to this node. e.g.: tcp://123.123.123.123:11223, can specify multiple.' -r
complete -c easytier-core -l hostname -d 'host name to identify this device' -r
complete -c easytier-core -s m -l instance-name -d 'instance name to identify this vpn node in same machine' -r
complete -c easytier-core -l vpn-portal -d 'url that defines the vpn portal, allow other vpn clients to connect. example: wg://0.0.0.0:11010/10.14.14.0/24, means the vpn portal is a wireguard server listening on vpn.example.com:11010, and the vpn client is in network of 10.14.14.0/24' -r
complete -c easytier-core -l default-protocol -d 'default protocol to use when connecting to peers' -r
complete -c easytier-core -s u -l disable-encryption -d 'disable encryption for peers communication, default is false, must be same with peers' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l encryption-algorithm -d 'encryption algorithm to use, supported: \'\', \'xor\', \'chacha20\', \'aes-gcm\', \'aes-gcm-256\', \'openssl-aes128-gcm\', \'openssl-aes256-gcm\', \'openssl-chacha20\'. Empty string means default (aes-gcm)' -r -f -a "xor\t''
aes-gcm\t''
aes-256-gcm\t''
chacha20\t''"
complete -c easytier-core -l multi-thread -d 'use multi-thread runtime, default is single-thread' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l multi-thread-count -d 'the number of threads to use, default is 2, only effective when multi-thread is enabled, must be greater than 2' -r
complete -c easytier-core -l disable-ipv6 -d 'do not use ipv6' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l dev-name -d 'optional tun interface name' -r
complete -c easytier-core -l mtu -d 'mtu of the TUN device, default is 1380 for non-encryption, 1360 for encryption' -r
complete -c easytier-core -l latency-first -d 'latency first mode, will try to relay traffic with lowest latency path, default is using shortest path' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l exit-nodes -d 'exit nodes to forward all traffic to, a virtual ipv4 address, priority is determined by the order of the list' -r
complete -c easytier-core -l enable-exit-node -d 'allow this node to be an exit node' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l proxy-forward-by-system -d 'forward packet to proxy networks via system kernel, disable internal nat for network proxy' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l no-tun -d 'do not create TUN device, can use subnet proxy to access node' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l use-smoltcp -d 'enable smoltcp stack for subnet proxy and kcp proxy' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l manual-routes -d 'assign routes cidr manually, will disable subnet proxy and wireguard routes propagated from peers. e.g.: 192.168.0.0/16' -r
complete -c easytier-core -l relay-network-whitelist -d 'only forward traffic from the whitelist networks, supporting wildcard strings, multiple network names can be separated by spaces. if local network (assigned with network_name) is not in the whitelist, the traffic can still be forwarded if no other route path is available. if this parameter is empty, forwarding is disabled. by default, all networks are allowed. e.g.: \'*\' (all networks), \'def*\' (networks with the prefix \'def\'), \'net1 net2\' (only allow net1 and net2)" ' -r
complete -c easytier-core -l p2p-only -d 'only communicate with peers that already establish p2p connection' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l lazy-p2p -d 'only try to establish p2p when traffic actually needs the peer; peers marked as need-p2p are still connected proactively' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l disable-p2p -d 'disable ordinary automatic p2p; still establish p2p with peers marked as need-p2p, and other peers should not proactively connect to this node' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l disable-udp-hole-punching -d 'disable udp hole punching' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l disable-tcp-hole-punching -d 'disable tcp hole punching' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l disable-sym-hole-punching -d 'if true, disable udp nat hole punching for symmetric nat (NAT4), which is based on birthday attack and may be blocked by ISP.' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l disable-upnp -d 'disable runtime UPnP/NAT-PMP port mapping for eligible listeners; automatic port mapping is enabled by default' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l enable-udp-broadcast-relay -d 'Windows only: capture local UDP broadcast packets from physical interfaces and forward them to EasyTier peers. Helps games to find rooms in local network. Requires administrator privileges.' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l relay-all-peer-rpc -d 'relay all peer rpc packets, even if the peer is not in the relay network whitelist. this can help peers not in relay network whitelist to establish p2p connection.' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l need-p2p -d 'announce that other peers should proactively establish p2p connections to this node even when they enable lazy-p2p' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l socks5 -d 'enable socks5 server, allow socks5 client to access virtual network. format: <port>, e.g.: 1080' -r
complete -c easytier-core -l compression -d 'compression algorithm to use, support none, zstd. default is none' -r
complete -c easytier-core -l bind-device -d 'bind the connector socket to physical devices to avoid routing issues. e.g.: subnet proxy segment conflicts with a node\'s segment, after binding the physical device, it can communicate with the node normally.' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l enable-kcp-proxy -d 'proxy tcp streams with kcp, improving the latency and throughput on the network with udp packet loss.' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l disable-kcp-input -d 'do not allow other nodes to use kcp to proxy tcp streams to this node. when a node with kcp proxy enabled accesses this node, the original tcp connection is preserved.' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l enable-quic-proxy -d 'proxy tcp streams with QUIC, improving the latency and throughput on the network with udp packet loss.' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l disable-quic-input -d 'do not allow other nodes to use QUIC to proxy tcp streams to this node. when a node with QUIC proxy enabled accesses this node, the original tcp connection is preserved.' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l port-forward -d 'forward local port to remote port in virtual network. e.g.: udp://0.0.0.0:12345/10.126.126.1:23456, means forward local udp port 12345 to 10.126.126.1:23456 in the virtual network. can specify multiple.' -r
complete -c easytier-core -l accept-dns -d 'if true, enable magic dns. with magic dns, you can access other nodes with a domain name, e.g.: <hostname>.et.net. magic dns will modify your system dns settings, enable it carefully.' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l tld-dns-zone -d 'specify the top-level domain zone for magic DNS. if not provided, defaults to the value from dns_server module (et.net.). only used when accept_dns is true.' -r
complete -c easytier-core -l private-mode -d 'if true, foreign networks are only allowed when this node can verify they use the same network secret, or when a foreign credential node is already trusted via admin-issued credential propagation; different or missing secrets are otherwise rejected.' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l foreign-relay-bps-limit -d 'the maximum bps limit for foreign network relay, default is no limit. unit: BPS (bytes per second)' -r
complete -c easytier-core -l instance-recv-bps-limit -d 'the maximum total receive bps limit for this instance, default is no limit. unit: BPS (bytes per second)' -r
complete -c easytier-core -l tcp-whitelist -d 'tcp port whitelist. Supports single ports (80) and ranges (8000-9000)' -r
complete -c easytier-core -l udp-whitelist -d 'udp port whitelist. Supports single ports (53) and ranges (5000-6000)' -r
complete -c easytier-core -l disable-relay-kcp -d 'if true, disable relay kcp packets. avoid consuming too many bandwidth. default is false' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l disable-relay-quic -d 'if true, disable relay quic packets. avoid consuming too many bandwidth. default is false' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l enable-relay-foreign-network-kcp -d 'if true, allow relay kcp packets from foreign network. default is false (not forward foreign network kcp packets)' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l enable-relay-foreign-network-quic -d 'if true, allow relay quic packets from foreign network. default is false (not forward foreign network quic packets)' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l stun-servers -d 'Override default STUN servers; If configured but empty, STUN servers are not used' -r
complete -c easytier-core -l stun-servers-v6 -d 'Override default STUN servers, IPv6; If configured but empty, IPv6 STUN servers are not used' -r
complete -c easytier-core -l secure-mode -d 'if true, enable secure mode. default is false' -r -f -a "true\t''
false\t''"
complete -c easytier-core -l local-private-key -d 'local private key for secure mode. if not provided, a random key will be generated' -r
complete -c easytier-core -l local-public-key -d 'local public key for secure mode. if not provided, a random key will be generated, or use local private key to derive public key' -r
complete -c easytier-core -l credential -d 'credential secret (base64-encoded private key) for joining network as a temporary node without network_secret' -r
complete -c easytier-core -l credential-file -d 'path to credential storage file for persisting generated credentials across restarts (admin nodes)' -r -F
complete -c easytier-core -l console-log-level -d 'console log level' -r
complete -c easytier-core -l file-log-level -d 'file log level' -r
complete -c easytier-core -l file-log-dir -d 'directory to store log files' -r
complete -c easytier-core -l file-log-size -d 'per file log size in MB, default is 100MB' -r
complete -c easytier-core -l file-log-count -d 'max file log count, default is 10' -r
complete -c easytier-core -s r -l rpc-portal -d 'rpc portal address to listen for management. 0 means random port, 12345 means listen on 12345 of localhost, 0.0.0.0:12345 means listen on 12345 of all interfaces. default is 0 and will try 15888 first' -r
complete -c easytier-core -l rpc-portal-whitelist -d 'rpc portal whitelist, only allow these addresses to access rpc portal, e.g.: 127.0.0.1,127.0.0.0/8,::1/128' -r
complete -c easytier-core -l gen-autocomplete -d 'generate shell completions' -r -f -a "bash\t''
elvish\t''
fish\t''
powershell\t''
zsh\t''
nu\t''"
complete -c easytier-core -l no-listener -d 'do not listen on any port, only connect to peers'
complete -c easytier-core -l check-config -d 'Check config validity without starting the network'
complete -c easytier-core -l daemon -d 'Run in daemon mode'
complete -c easytier-core -l disable-env-parsing -d 'disable environment variable parsing in config file'
complete -c easytier-core -s h -l help -d 'Print help'
complete -c easytier-core -s V -l version -d 'Print version'
