# Which local IP address should OpenVPN listen on? (optional) local
#a.b.c.d
# "dev tun" will create a routed IP tunnel, "dev tap" will create an
# ethernet tunnel. Use "dev tap0" if you are ethernet bridging and have
# precreated a tap0 virtual interface and bridged it with your ethernet
# interface. If you want to control access policies over the VPN, you
# must create firewall rules for the the TUN/TAP interface. On
# non-Windows systems, you can give an explicit unit number, such as
# tun0. On Windows, use "dev-node" for this. On most systems, the VPN
# will not function unless you partially or fully disable the firewall
# for the TUN/TAP interface.
dev tap0
#dev tun
# TCP or UDP server? proto tcp
proto udp
# Which TCP/UDP port should OpenVPN listen on? If you want to run
# multiple OpenVPN instances on the same machine, use a different port
# number for each one. You will need to open up this port on your
# firewall.
port 1184
# SSL/TLS root certificate (ca), certificate (cert), and private key
# (key). Each client and the server must have their own cert and key
# file. The server and all clients will use the same ca file.
#
# See the "easy-rsa" directory for a series of scripts for generating
# RSA certificates and private keys. Remember to use a unique Common
# Name for the server and each of the client certificates.
#
# Any X509 key management system can be used. OpenVPN can also use a
# PKCS #12 formatted key file (see "pkcs12" directive in man page).
ca /etc/openvpn/easy-rsa/pki/ca.crt cert
/etc/openvpn/easy-rsa/pki/issued/server_eGLiTsUs0KGP4amf.crt key
/etc/openvpn/easy-rsa/pki/private/server_eGLiTsUs0KGP4amf.key
# Diffie hellman parameters. Generate your own with:
# openssl dhparam -out dh2048.pem 2048
dh /etc/openvpn/easy-rsa/pki/dh4096.pem
# Network topology Should be subnet (addressing via IP) unless Windows
# clients v2.0.9 and lower have to be supported (then net30, i.e. a /30
# per client) Defaults to net30 (not recommended)
topology subnet
# Configure server mode for ethernet bridging. You must first use your
#OS's bridging capability to bridge the TAP interface with the ethernet
#NIC interface. Then you must manually set the IP/netmask on the bridge
#interface, here we assume 10.8.0.4/255.255.255.0. Finally we must set
#aside an IP range in this subnet (start=10.8.0.50 end=10.8.0.100) to
#allocate to connecting clients. Leave this line commented out unless
#you are ethernet bridging. server-bridge 10.8.0.4 255.255.255.0
#10.8.0.50 10.8.0.100 COMMENT OUT FOR BRIDGE - server 10.8.0.0
#255.255.255.0
server-bridge 192.168.1.1 255.255.255.0 192.168.1.210 192.168.1.240
# Configure server mode for ethernet bridging using a DHCP-proxy, where
#clients talk to the OpenVPN server-side DHCP server to receive their IP
#address allocation and DNS server addresses. You must first use your
#OS's bridging capability to bridge the TAP interface with the ethernet
#NIC interface. Note: this mode only works on clients (such as Windows),
#where the client-side TAP adapter is bound to a DHCP client.
#server-bridge
# Maintain a record of client <-> virtual IP address associations in
# this file. If OpenVPN goes down or is restarted, reconnecting clients
# can be assigned the same virtual IP address from the pool that was
# previously assigned.
ifconfig-pool-persist ipp.txt
# Push routes to the client to allow it to reach other private subnets
#behind the server. Remember that these private subnets will also need
#to know to route the OpenVPN client address pool
#(10.8.0.0/255.255.255.0) back to the OpenVPN server. server and remote
#endpoints ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server push "route
#10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OPenVPN Subnet push "route
#10.8.0.0 255.255.255.0"
# your local subnet
push "route 0.0.0.0 "
# Certain Windows-specific network settings can be pushed to clients,
# such as DNS or WINS server addresses. CAVEAT:
#
http://openvpn.net/faq.html#dhcpcaveats The addresses below refer to
# the public DNS servers provided by opendns.com.
#;push "dhcp-option DNS 208.67.222.222"
#;push "dhcp-option DNS 208.67.220.220"
#Set your primary domain name server address for clients
push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4"
# To assign specific IP addresses to specific clients or if a connecting
# client has a private subnet behind it that should also have VPN
# access, use the subdirectory "ccd" for client-specific configuration
# files (see man page for more info). EXAMPLE: Suppose the client having
# the certificate common name "Thelonious" also has a small subnet
# behind his connecting machine, such as 192.168.40.128/255.255.255.248.
# First, uncomment out these lines:
;client-config-dir ccd ;route 192.168.40.128 255.255.255.248
# Then create a file ccd/Thelonious with this line:
# iroute 192.168.40.128 255.255.255.248 This will allow Thelonious'
# private subnet to access the VPN. This example will only work if you
# are routing, not bridging, i.e. you are using "dev tun" and "server"
# directives. EXAMPLE: Suppose you want to give Thelonious a fixed VPN
# IP address of 10.9.0.1. First uncomment out these lines:
;client-config-dir ccd ;route 10.9.0.0 255.255.255.252
# Then add this line to ccd/Thelonious:
# ifconfig-push 10.9.0.1 10.9.0.2 Suppose that you want to enable
# different firewall access policies for different groups of clients.
# There are two methods: (1) Run multiple OpenVPN daemons, one for each
# group, and firewall the TUN/TAP interface for each group/daemon
# appropriately. (2) (Advanced) Create a script to dynamically
# modify the firewall in response to access from different clients.
# See man page for more info on learn-address script.
;learn-address ./script
# If enabled, this directive will configure all clients to redirect
# their default network gateway through the VPN, causing all IP traffic
# such as web browsing and and DNS lookups to go through the VPN (The
# OpenVPN server machine may need to NAT or bridge the TUN/TAP interface
# to the internet in order for this to work properly).
;push "redirect-gateway def1 bypass-dhcp"
# Override the Client default gateway by using 0.0.0.0/1 and 128.0.0.0/1
# rather than 0.0.0.0/0. This has the benefit of overriding but not
# wiping out the original default gateway.
push "redirect-gateway def1"
# Uncomment this directive to allow different clients to be able to
# "see" each other. By default, clients will only see the server. To
# force clients to only see the server, you will also need to
# appropriately firewall the server's TUN/TAP interface.
client-to-client
# The keepalive directive causes ping-like messages to be sent back and
# forth over the link so that each side knows when the other side has
# gone down. Ping every 10 seconds, assume that remote peer is down if
# no ping received during a 120 second time period.
keepalive 10 120 remote-cert-tls client tls-version-min 1.2
# For extra security beyond that provided by SSL/TLS, create an "HMAC
# firewall" to help block DoS attacks and UDP port flooding.
#
# Generate with:
# openvpn --genkey --secret ta.key
#
# The server and each client must have a copy of this key. The second
# parameter should be '0' on the server and '1' on the clients.
tls-auth /etc/openvpn/easy-rsa/pki/ta.key 0
# Select a cryptographic cipher. This config item must be copied to the
# client config file as well. Note that v2.4 client/server will
# automatically negotiate AES-256-GCM in TLS mode. See also the
# ncp-cipher option in the manpage
cipher AES-256-CBC auth SHA256 comp-lzo user nobody group nogroup
persist-key persist-tun crl-verify /etc/openvpn/crl.pem status
/var/log/openvpn-status.log 20 status-version 3 log /var/log/openvpn.log
verb 1
# Notify the client that when the server restarts so it can
# automatically reconnect.
explicit-exit-notify 1
# Generated for use by PiVPN.io
