Hi, I am new to openvpn and finally got my server up and running:
Internet --> Router --> VPN-Server with port forwarding 1194
I attached a server.conf and a client.conf and would appreciate any review of them, so I can be sure my setup is as secure, as possible.
Thank you for your time.
# main configuration #
mode server
port 1194
proto udp
# bridging directive - this is needed to use the br0
dev tap0
# script to attach the tap0 interface to the bridge
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"
persist-key
persist-tun
#certificates and encryption
ca ca.crt
cert me.crt
key me.key # This file should be kept secret
dh dh4096.pem
cipher BF-CBC # Blowfish (default)
comp-lzo # compression
# enable communication between vpn clients
client-to-client
# enable multiple access from the same client certificate
duplicate-cn
# DHCP configuration #
# ipp.txt saves the status of the dhcp leases
ifconfig-pool-persist ipp.txt
# pool of addresses available for VPN leases
# format: <server IP> <netmask> <pool start IP> <pool end IP>
server-bridge 192.168.0.5 255.255.255.0 192.168.0.200 192.168.0.230
# additional option to give to dhcp clients
push "dhcp-option DNS 192.168.0.1"
# maximium number of clients connected at a time
max-clients 10
# log and security #
user nobody
group nogroup
keepalive 10 120
status openvpn-status.log
verb 3
script-security 3 system
And the client.conf
# Specify that this is a client
client
# Bridge device setting
dev tap
# Host name and port for the server (default port is 1194)
# note: replace with the correct values your server set up
remote my.ip.address 1194
# Client does not need to bind to a specific local port
nobind
# Keep trying to resolve the host name of OpenVPN server.
## The windows GUI seems to dislike the following rule.
##You may need to comment it out.
resolv-retry infinite
# Preserve state across restarts
persist-key
persist-tun
# SSL/TLS parameters - files created previously
ca keys/ca.crt
cert keys/user.crt
key keys/user.key
ns-cert-type server
# Specify same cipher as server
cipher BF-CBC
# Use compression
comp-lzo
# Log verbosity (to help if there are problems)
verb 3
