abort_on_error
Call abort() when a fatal error is encountered. This will create a core file which allows further
troubleshooting. Disabled by default.
noabort_on_error
Exit normally on fatal error with an error code which indicates failure.
aclNpermit|denysourceip4[mask]
Adds an entry to access list N, where N is a number from 0 to 9. The source and mask addresses are
in the usual dotted quad notation. If mask is omitted, it defaults to 255.255.255.255.
aclNpermit|denysourceip6[/length]
If the source address contains the character ':', the address is interpreted as IPv6. Unlike IPv4
access entries, a length is used to indicate the mask. If length is omitted, it defaults to 128.
aclNpermit|denycountryNN
If the source address is the special word "country", a two-letter country code can be used to
restrict access to the load balancer. For this to work, pen must be built with geoip support.
noaclN
Deletes all entries from access list N. The resulting access list permits all traffic.
ascii Communication dumps in ascii format (cf option -a).
noascii
Communication dumps in hex format.
blacklist
Return current blacklist time in seconds.
blacklistT
Set the blacklist time in seconds.
block Do not make sockets nonblocking. This is obsolete as of 0.26.0 and does nothing.
noblock
Make sockets nonblocking.
client_aclN
Check connecting clients against access list N (default 0).
clients_max[N]
With argument, increase the maximum number of known clients. Returns max number of clients.
closeN
Close connection N
connectionN
Display some basic information about connection N.
conn_max[N]
With argument, increase the max number of simultaneous connections. Returns max number.
control
Return address and port where pen listens for control connections.
control_aclN
Check accesses to the control port against access list N (default 0).
debug Return current debug level.
debugN
Set debug level to N.
delayed_forward
Always wait for the next round of the main loop before forwarding data. Normally pen tries to do
that immediately. This is obsolete as of 0.26.0 and does nothing.
nodelayed_forward
Try to forward data immediately, to avoid the overhead of copying it to a temporary buffer and
waiting for the next main loop round.
dsr_ifIF
Use IF as the interface for Direct Server Return.
dummy Act as a dummy web server with very limited functionality but high performance. Only useful for
testing. Disabled by default.
nodummy
Do not act as a dummy web server.
epoll Use epoll for event management (Linux). This is the default on Linux.
exit Exit. Only available if pen was started with the -X option.
hash Use a hash on the client IP address for initial server selection.
nohash
Do not use a hash.
http Add X-Forwarded-For headers to http requests.
nohttp
Do not add X-Forwarded-For headers.
idle_timeoutN
Close connections that have been inactive for N seconds. Default 0 = never close.
idlers[N]
Create N reliable idle connections to the backend servers. Without argument, display the
current/requested number of reliable idlers.
includeFILE
Read commands from file.
kqueue Use kqueue for event management (FreeBSD, NetBSD, OpenBSD). This is the default on the systems
that have it.
listen Return local address and port pen listens to for incoming client connections.
listen[address:]:port
Close the listening socket and reopen using specified address (optional) and port.
log Show where pen is logging, if anywhere.
logFILE
Log to FILE.
mode Write a summary of the current mode of operation. The listed modes are block, delayed_forward,
hash, roundrobin, stubborn.
nolog Turn off logging.
pending_maxN
Max allowed number of pending nonblocking connections. Default 100, minimum 1.
pid Return the process id of the running daemon.
poll Use poll for event management.
prio Use the priority based algorithm.
noprio
Do not use the priority based algorithm.
recent[N]
Shows which clients have connected in the last N seconds (default 300).
roundrobin
Use round-robin server selection without client tracking
noroundrobinselect Use select for event management.
serverN[aclA|addressA|portP|maxM|hardH|blacklistT|weightW|prioP]
Change acl, address, port, weight, priority and/or max connections for server N, or blacklist it
for T seconds.
servers
List address, port, weight, priority and max number of simultaneous connections for each remote
server.
socketN
Show to which connection socket N belongs.
sourceIP
Set the local address to IP for upstream connections, i.e. where Pen connects to backend servers.
ssl_ciphersCIPHERS
Choose list of available SSL ciphers, specified in the format described in
https://www.openssl.org/docs/apps/ciphers.html.
ssl_client_renegotiation_intervalS
Allowing the client to request renegotiation is a potential denial of service vector. This command
specifies the minimum number of seconds the client has to wait between requests for renegotiation
requests. Default 3600 = effectively disabled.
ssl_ocsp_responseFILENAME
Specifies the location of a file containing a pre-fetched OCSP response. The file must be
refreshed regularly by a cron job or similar and the ssl_ocsp_response command repeated to make
Pen re-read the file..
ssl_optionOPTION
Manipulate SSL options. The available options are no_sslv2, no_sslv3, no_tlsv1, no_tlsv1.1,
no_tlsv1.2, cipher_server_preference. Use the command multiple times to specify multiple options.
ssl_sni_pathPATH
This command enables the Server Name Indication TLS extension by specifying a directory where
domain.key, domain.crt and domain.ca files can be found.
status Print status information in html format.
stubborn
If the initial server selection is unavailable, close the client connection without trying another
nostubborntarpit_acl[N]
Used in DSR mode. If N is an existing access list, Pen will reply to ARP requests for IP addresses
that match the access list, and reply with SYN+ACK to TCP SYN requests to these addresses. The
result is that someone trying to scan a network will be slowed down by a large number of false
positives.
tcp_fastcloseup|down|both|off
Close both sockets to upstream and downstream if one of them closes theirs. Default = off.
tcp_nodelay
Set TCP_NODELAY on sockets, effectively turning off the Nagle algorithm.
notcp_nodelay
Do not set TCP_NODELAY on sockets. This is the default.
timeout
Return current connect timeout in seconds.
timeoutN
Set connect timeout to N seconds.
trackingN
Set tracking time, i.e. how long clients will be remembered. The default 0 will never expire
clients based on time.
transparent
On compatible platforms, use the client's address as source address in the connection to the
backend server.
notransparent
Use Pen's address as source address in the connection to the backend server.
web_stats
Return file name of html status reports, if any.
web_statsFILE
Set the name of html status reports.
noweb_stats
Do not generate html status reports.
weight Use weight for server selection.
noweight
Do not use weight for server selection.
write[FILE]
Write the current configuration into a file which can be used to start pen. If FILE is omitted,
the configuration is written into pen's original configuration file.
Install Now
PNG Icons
