I checked this option and it seems to be very important. So I wonder why it is not used by default.
Features of TLS-auth:
DoS attacks or port flooding on the OpenVPN UDP port.
Port scanning to determine which server UDP ports are in a listening state.
Buffer overflow vulnerabilities in the SSL/TLS implementation.
SSL/TLS handshake initiations from unauthorized machines (while such handshakes would ultimately fail to authenticate, tls-auth can cut them off at a much earlier point).
https://openvpn.net/community-resources/how-to/
n the server configuration, add:
tls-auth ta.key 0
In the client configuration, add:
tls-auth ta.key 1
What happens if I change key direction? Server = 1 and client 0. Is it still save or does the client get the key from server ?
