package openvpn ################################################# # Sample to include a custom config file. # ################################################# config openvpn custom_config # Set to 1 to enable this instance: option enabled 0 # Credentials to login #option username 'login' #option password 'password' # Password for client certificate #option cert_password 'cert_password' # Include OpenVPN configuration option config /etc/openvpn/my-vpn.conf ################################################# # Sample OpenVPN 2.0 uci config for # # multi-client server. # ################################################# config openvpn sample_server # Set to 1 to enable this instance: option enabled 0 # Which local IP address should OpenVPN # listen on? (optional) # option local 0.0.0.0 # Which TCP/UDP port should OpenVPN listen on? # If you want to run multiple OpenVPN instances # on the same machine, use a different port # number for each one. You will need to # open up this port on your firewall. option port 1194 # TCP or UDP server? # option proto tcp option proto udp # "dev tun" will create a routed IP tunnel, # "dev tap" will create an ethernet tunnel. # Use "dev tap0" if you are ethernet bridging # and have precreated a tap0 virtual interface # and bridged it with your ethernet interface. # If you want to control access policies # over the VPN, you must create firewall # rules for the the TUN/TAP interface. # On non-Windows systems, you can give # an explicit unit number, such as tun0. # On Windows, use "dev-node" for this. # On most systems, the VPN will not function # unless you partially or fully disable # the firewall for the TUN/TAP interface. # option dev tap option dev tun # SSL/TLS root certificate (ca), certificate # (cert), and private key (key). Each client # and the server must have their own cert and # key file. The server and all clients will # use the same ca file. # # See the "easy-rsa" directory for a series # of scripts for generating RSA certificates # and private keys. Remember to use # a unique Common Name for the server # and each of the client certificates. # # Any X509 key management system can be used. # OpenVPN can also use a PKCS #12 formatted key file # (see "pkcs12" directive in man page). option ca /etc/openvpn/ca.crt option cert /etc/openvpn/server.crt # This file should be kept secret: option key /etc/openvpn/server.key # Diffie hellman parameters. # Generate your own with: # openssl dhparam -out dh2048.pem 2048 # Substitute 2048 for 1024 if you are using # 1024 bit keys. option dh /etc/openvpn/dh2048.pem # Configure server mode and supply a VPN subnet # for OpenVPN to draw client addresses from. # The server will take 10.8.0.1 for itself, # the rest will be made available to clients. # Each client will be able to reach the server # on 10.8.0.1. Comment this line out if you are # ethernet bridging. See the man page for more info. option server "10.8.0.0 255.255.255.0" # Maintain a record of client <-> virtual IP address # associations in this file. If OpenVPN goes down or # is restarted, reconnecting clients can be assigned # the same virtual IP address from the pool that was # previously assigned. option ifconfig_pool_persist /tmp/ipp.txt # Configure server mode for ethernet bridging. # You must first use your OS's bridging capability # to bridge the TAP interface with the ethernet # NIC interface. Then you must manually set the # IP/netmask on the bridge interface, here we # assume 10.8.0.4/255.255.255.0. Finally we # must set aside an IP range in this subnet # (start=10.8.0.50 end=10.8.0.100) to allocate # to connecting clients. Leave this line commented # out unless you are ethernet bridging. # option server_bridge "10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100" # Push routes to the client to allow it # to reach other private subnets behind # the server. Remember that these # private subnets will also need # to know to route the OpenVPN client # address pool (10.8.0.0/255.255.255.0) # back to the OpenVPN server. # list push "route 192.168.10.0 255.255.255.0" # list push "route 192.168.20.0 255.255.255.0" # To assign specific IP addresses to specific # clients or if a connecting client has a private # subnet behind it that should also have VPN access, # use the subdirectory "ccd" for client-specific # configuration files (see man page for more info). # EXAMPLE: Suppose the client # having the certificate common name "Thelonious" # also has a small subnet behind his connecting # machine, such as 192.168.40.128/255.255.255.248. # First, uncomment out these lines: # option client_config_dir /etc/openvpn/ccd # list route "192.168.40.128 255.255.255.248" # Then create a file ccd/Thelonious with this line: # iroute 192.168.40.128 255.255.255.248 # This will allow Thelonious' private subnet to # access the VPN. This example will only work # if you are routing, not bridging, i.e. you are # using "dev tun" and "server" directives. # EXAMPLE: Suppose you want to give # Thelonious a fixed VPN IP address of 10.9.0.1. # First uncomment out these lines: # option client_config_dir /etc/openvpn/ccd # list route "10.9.0.0 255.255.255.252" # list route "192.168.100.0 255.255.255.0" # Then add this line to ccd/Thelonious: # ifconfig-push "10.9.0.1 10.9.0.2" # Suppose that you want to enable different # firewall access policies for different groups # of clients. There are two methods: # (1) Run multiple OpenVPN daemons, one for each # group, and firewall the TUN/TAP interface # for each group/daemon appropriately. # (2) (Advanced) Create a script to dynamically # modify the firewall in response to access # from different clients. See man # page for more info on learn-address script. # option learn_address /etc/openvpn/script # If enabled, this directive will configure # all clients to redirect their default # network gateway through the VPN, causing # all IP traffic such as web browsing and # and DNS lookups to go through the VPN # (The OpenVPN server machine may need to NAT # the TUN/TAP interface to the internet in # order for this to work properly). # CAVEAT: May break client's network config if # client's local DHCP server packets get routed # through the tunnel. Solution: make sure # client's local DHCP server is reachable via # a more specific route than the default route # of 0.0.0.0/0.0.0.0. # list push "redirect-gateway" # Certain Windows-specific network settings # can be pushed to clients, such as DNS # or WINS server addresses. CAVEAT: # http://openvpn.net/faq.html#dhcpcaveats # list push "dhcp-option DNS 10.8.0.1" # list push "dhcp-option WINS 10.8.0.1" # Uncomment this directive to allow different # clients to be able to "see" each other. # By default, clients will only see the server. # To force clients to only see the server, you # will also need to appropriately firewall the # server's TUN/TAP interface. # option client_to_client 1 # Uncomment this directive if multiple clients # might connect with the same certificate/key # files or common names. This is recommended # only for testing purposes. For production use, # each client should have its own certificate/key # pair. # # IF YOU HAVE NOT GENERATED INDIVIDUAL # CERTIFICATE/KEY PAIRS FOR EACH CLIENT, # EACH HAVING ITS OWN UNIQUE "COMMON NAME", # UNCOMMENT THIS LINE OUT. # option duplicate_cn 1 # The keepalive directive causes ping-like # messages to be sent back and forth over # the link so that each side knows when # the other side has gone down. # Ping every 10 seconds, assume that remote # peer is down if no ping received during # a 120 second time period. option keepalive "10 120" # For extra security beyond that provided # by SSL/TLS, create an "HMAC firewall" # to help block DoS attacks and UDP port flooding. # # Generate with: # openvpn --genkey --secret ta.key # # The server and each client must have # a copy of this key. # The second parameter should be '0' # on the server and '1' on the clients. # This file is secret: # option tls_auth "/etc/openvpn/ta.key 0" # For additional privacy, a shared secret key # can be used for both authentication (as in tls_auth) # and encryption of the TLS control channel. # # Generate a shared secret with: # openvpn --genkey --secret ta.key # # The server and each client must have # a copy of this key. # # tls_auth and tls_crypt should NOT # be combined, as tls_crypt implies tls_auth. # Use EITHER tls_crypt, tls_auth, or neither option. # option tls_crypt "/etc/openvpn/ta.key" # Set the minimum required TLS protocol version # for all connections. # # Require at least TLS 1.1 # option tls_version_min "1.1" # Require at least TLS 1.2 # option tls_version_min "1.2" # Require TLS 1.2, or the highest version supported # on the system # option tls_version_min "1.2 'or-highest'" # List the preferred ciphers to use for the data channel. # Run openvpn --show-ciphers to see all supported ciphers. # list data_ciphers 'AES-256-GCM' # list data_ciphers 'AES-128-GCM' # list data_ciphers 'CHACHA20-POLY1305' # Set a fallback cipher in order to be compatible with # peers that do not support cipher negotiation. # # Use AES-256-CBC as fallback # option data_ciphers_fallback 'AES-128-CBC' # Use AES-128-CBC as fallback # option data_ciphers_fallback 'AES-256-CBC' # Use Triple-DES as fallback # option data_ciphers_fallback 'DES-EDE3-CBC' # Use BF-CBC as fallback # option data_ciphers_fallback 'BF-CBC' # OpenVPN versions 2.4 and later will attempt to # automatically negotiate the most secure cipher # between the client and server, regardless of a # configured "option cipher" (see below). # Automatic negotiation is recommended. # # Uncomment this option to disable this behavior, # and force all OpenVPN peers to use the configured # cipher option instead (not recommended). # option ncp_disable # Enable compression on the VPN link. # If you enable it here, you must also # enable it in the client config file. # # Compression is not recommended, as compression and # encryption in combination can weaken the security # of the connection. # # LZ4 requires OpenVPN 2.4+ client and server # option compress lz4 # LZO is available by default only in openvpn-openssl variant # LZO is compatible with most OpenVPN versions # option compress lzo # Control how OpenVPN handles peers using compression # # Do not allow any connections using compression # option allow_compression 'no' # Allow incoming compressed packets, but do not send compressed packets to other peers # This can be useful when migrating old configurations with compression activated # option allow_compression 'asym' # Both incoming and outgoing packets may be compressed # option allow_compression 'yes' # The maximum number of concurrently connected # clients we want to allow. # option max_clients 100 # The persist options will try to avoid # accessing certain resources on restart # that may no longer be accessible because # of the privilege downgrade. option persist_key 1 option persist_tun 1 option user nobody # Output a short status file showing # current connections, truncated # and rewritten every minute. option status /tmp/openvpn-status.log # By default, log messages will go to the syslog (or # on Windows, if running as a service, they will go to # the "\Program Files\OpenVPN\log" directory). # Use log or log-append to override this default. # "log" will truncate the log file on OpenVPN startup, # while "log-append" will append to it. Use one # or the other (but not both). # option log /tmp/openvpn.log # option log_append /tmp/openvpn.log # Set the appropriate level of log # file verbosity. # # 0 is silent, except for fatal errors # 4 is reasonable for general usage # 5 and 6 can help to debug connection problems # 9 is extremely verbose option verb 3 # Silence repeating messages. At most 20 # sequential messages of the same message # category will be output to the log. # option mute 20 ############################################## # Sample client-side OpenVPN 2.0 uci config # # for connecting to multi-client server. # ############################################## config openvpn sample_client # Set to 1 to enable this instance: option enabled 0 # Specify that we are a client and that we # will be pulling certain config file directives # from the server. option client 1 # Use the same setting as you are using on # the server. # On most systems, the VPN will not function # unless you partially or fully disable # the firewall for the TUN/TAP interface. # option dev tap option dev tun # Are we connecting to a TCP or # UDP server? Use the same setting as # on the server. # option proto tcp option proto udp # The hostname/IP and port of the server. # You can have multiple remote entries # to load balance between the servers. list remote "my_server_1 1194" # list remote "my_server_2 1194" # Choose a random host from the remote # list for load_balancing. Otherwise # try hosts in the order specified. # option remote_random 1 # Keep trying indefinitely to resolve the # host name of the OpenVPN server. Very useful # on machines which are not permanently connected # to the internet such as laptops. option resolv_retry infinite # Most clients don't need to bind to # a specific local port number. option nobind 1 # Try to preserve some state across restarts. option persist_key 1 option persist_tun 1 option user nobody # If you are connecting through an # HTTP proxy to reach the actual OpenVPN # server, put the proxy server/IP and # port number here. See the man page # if your proxy server requires # authentication. # retry on connection failures: # option http_proxy_retry 1 # specify http proxy address and port: # option http_proxy "192.168.1.100 8080" # Wireless networks often produce a lot # of duplicate packets. Set this flag # to silence duplicate packet warnings. # option mute_replay_warnings 1 # SSL/TLS parms. # See the server config file for more # description. It's best to use # a separate .crt/.key file pair # for each client. A single ca # file can be used for all clients. option ca /etc/openvpn/ca.crt option cert /etc/openvpn/client.crt option key /etc/openvpn/client.key # Verify server certificate by checking # that the certicate has the key usage # field set to "server". This is an # important precaution to protect against # a potential attack discussed here: # http://openvpn.net/howto.html#mitm # # To use this feature, you will need to generate # your server certificates with the nsCertType # field set to "server". The build_key_server # script in the easy_rsa folder will do this. # option remote_cert_tls server # If a tls_auth key is used on the server # then every client must also have the key. # option tls_auth "/etc/openvpn/ta.key 1" # If a tls_crypt key is used on the server # every client must also have the key. # option tls_crypt "/etc/openvpn/ta.key" # Set the minimum required TLS protocol version # for all connections. # # Require at least TLS 1.1 # option tls_version_min "1.1" # Require at least TLS 1.2 # option tls_version_min "1.2" # Require TLS 1.2, or the highest version supported # on the system # option tls_version_min "1.2 'or-highest'" # List the preferred ciphers for the data channel. # list data_ciphers 'AES-256-GCM' # list data_ciphers 'AES-128-GCM' # list data_ciphers 'CHACHA20-POLY1305' # Set a fallback cipher if you connect to a peer that does # not support cipher negotiation. # Use AES-256-CBC as fallback # option data_ciphers_fallback 'AES-128-CBC' # Use AES-128-CBC as fallback # option data_ciphers_fallback 'AES-256-CBC' # Use Triple-DES as fallback # option data_ciphers_fallback 'DES-EDE3-CBC' # Use BF-CBC as fallback # option data_ciphers_fallback 'BF-CBC' # Enable compression on the VPN link. # Don't enable this unless it is also # enabled in the server config file. # # Compression is not recommended, as compression and # encryption in combination can weaken the security # of the connection. # # LZ4 requires OpenVPN 2.4+ on server and client # option compress lz4 # LZO is available by default only in openvpn-openssl variant # LZO is compatible with most OpenVPN versions # option compress lzo # Set log file verbosity. option verb 3 # Silence repeating messages # option mute 20