Changes

6,133 bytes removed ,  09:10, 18 December 2018
Line 160: Line 160:  
The figure above is an example of a configured OpenVPN Server instance that uses the UDP protocol and TLS authentication. As you can see, the configuration is similar to OpenVPN Client but with a few key differences. Comprehensible explanations on each field are presented in the table below:
 
The figure above is an example of a configured OpenVPN Server instance that uses the UDP protocol and TLS authentication. As you can see, the configuration is similar to OpenVPN Client but with a few key differences. Comprehensible explanations on each field are presented in the table below:
   −
{| class="wikitable"
+
<table class="nd-mantable">
|+
+
    <tr>
! style="width: 250px; border: 1px solid white; border-bottom: 2px solid #0054A6; background: white; color: #0054A6; text-align: left;" | FIELD NAME
+
        <th>field name</th>
! style="width: 250px; border: 1px solid white; border-bottom: 2px solid #0054A6; background: white; color: #0054A6; text-align: left;" | VALUE
+
      <th>value</th>
! style="width: 579px; border: 1px solid white; border-bottom: 2px solid #0054A6; background: white; color: #0054A6; text-align: left;" | DESCRIPTION
+
      <th>description</th>
|-
+
    </tr>
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Enable
+
    <tr>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | yes {{!}} no; Default: '''no''
+
      <td>Enable</td>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Enables the OpenVPN instance
+
      <td>yes {{!}} no; Default: '''no'''</td>
|-
+
      <td>Enables the OpenVPN instance</td>
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | TUN/TAP
+
    </tr>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | TUN (tunnel) {{!}} TAP (bridged); Default: '''TUN (tunnel)'''
+
    <tr>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | OpenVPN interface type. '''TUN''' is most often in typical VPN connections, however, '''TAP''' is required in some Ethernet bridging configurations
+
      <td>TUN/TAP</td>
|-
+
      <td>TUN (tunnel) {{!}} TAP (bridged); Default: '''TUN (tunnel)'''</td>
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Protocol
+
      <td>OpenVPN interface type. '''TUN''' is most often in typical VPN connections, however, '''TAP''' is required in some Ethernet bridging configurations</td>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | UDP {{!}} TCP; Default: '''UDP'''
+
    </tr>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | The transfer protocol used by the OpenVPN connection. '''TCP''' is connection oriented – once a connection is established, data can be sent bidirectionally. '''UDP''' is a simpler, connectionless Internet protocol. '''UDP''' is usually faster but '''TCP''' has more security features. Choose the connection protocol according to your needs.
+
    <tr>
|-
+
    <td>Protocol</td>
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Port
+
        <td>UDP {{!}} TCP; Default: '''UDP'''</td>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | integer [0..65535]; Default: '''1194'''
+
        <td>The transfer protocol used by the OpenVPN connection. '''TCP''' is connection oriented – once a connection is established, data can be sent bidirectionally. '''UDP''' is a simpler, connectionless Internet protocol. '''UDP''' is usually faster but '''TCP''' has more security features. Choose the connection protocol according to your needs.</td>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | TCP/UDP Port number for both local and remote endpoints (make sure that the chosen port is allowed by firewall)
+
    </tr>
|-
+
    <tr>
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | LZO
+
    <td>Port</td>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | yes {{!}} no; Default: '''no'''
+
        <td>integer [0..65535]; Default: '''1194'''</td>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | With LZO compression, your VPN connection will generate less network traffic. However, enabling this causes a higher CPU load. Use it carefully with a high traffic rate or low CPU resources
+
        <td>TCP/UDP Port number for both local and remote endpoints (make sure that the chosen port is allowed by firewall)</td>
|-
+
    </tr>
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Encryption
+
    <tr>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | DES-CBC 64 {{!}} RC2-CBC 128 {{!}} DES-EDE-CBC 128 {{!}} DES-EDE3-CBC 192 {{!}} DESX-CBC 192 {{!}} BF-CBC 128 {{!}} RC2-40-CBC 40 {{!}} CAST5-CBC 128 {{!}} RC2-40CBC 40 {{!}} CAST5-CBC 128 {{!}} RC2-64-CBC 64{{!}} AES-128-CBC 128 {{!}} AES-192-CBC 192 {{!}} AES-256-CBC 256 {{!}} none; Default: '''BF-CBC 128'''
+
      <td>LZO</td>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Packet encryption algorithm
+
      <td>yes {{!}} no; Default: '''no'''</td>
|-
+
      <td>With LZO compression, your VPN connection will generate less network traffic. However, enabling this causes a higher CPU load. Use it carefully with a high traffic rate or low CPU resources</td>
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Authentication
+
    </tr>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | TLS'''*''' {{!}} Static Key {{!}} Password {{!}} TLS/Password; Default: '''TLS'''
+
    <tr>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Authentication mode, used to secure data sessions.
+
      <td>Encryption</td>
 +
      <td>DES-CBC 64 {{!}} RC2-CBC 128 {{!}} DES-EDE-CBC 128 {{!}} DES-EDE3-CBC 192 {{!}} DESX-CBC 192 {{!}} BF-CBC 128 {{!}} RC2-40-CBC 40 {{!}} CAST5-CBC 128 {{!}} RC2-40CBC 40 {{!}} CAST5-CBC 128 {{!}} RC2-64-CBC 64{{!}} AES-128-CBC 128 {{!}} AES-192-CBC 192 {{!}} AES-256-CBC 256 {{!}} none; Default: '''BF-CBC 128'''</td>
 +
      <td>Packet encryption algorithm</td>
 +
    </tr>
 +
    <tr>
 +
    <td>Authentication</td>
 +
        <td>TLS'''*''' {{!}} Static Key {{!}} Password {{!}} TLS/Password; Default: '''TLS'''</td>
 +
        <td>Authentication mode, used to secure data sessions.
 
'''Static key''' is a secret key used for server–client authentication.
 
'''Static key''' is a secret key used for server–client authentication.
   Line 203: Line 210:  
'''Password''' is a simple username/password based authentication where the owner of the OpenVPN server provides the login data.
 
'''Password''' is a simple username/password based authentication where the owner of the OpenVPN server provides the login data.
   −
'''TLS/Password''' uses both TLS and Password authentication
+
'''TLS/Password''' uses both TLS and Password authentication</td>
|-
+
    </tr>
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | TLS cipher
+
    <tr>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | all {{!}} DHE+RSA {{!}} custom; Default: '''all'''
+
    <td>TLS cipher</td>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Packet encryption algorithm cipher
+
        <td>all {{!}} DHE+RSA {{!}} custom; Default: '''all'''</td>
|-
+
        <td>Packet encryption algorithm cipher</td>
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Client to client
+
    </tr>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | yes {{!}} no; Default: '''no'''
+
    <tr>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Enables client to client communication in the Virtual network. In order for Client to client to work, the TLS Clients section most be utilized
+
      <td>Client to client</td>
|-
+
      <td>yes {{!}} no; Default: '''no'''</td>
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Keep alive
+
      <td>Enables client to client communication in the Virtual network. In order for Client to client to work, the TLS Clients section most be utilized</td>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | integer *space* integer; Default: " "
+
    </tr>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Defines two time intervals: one is used to periodically send ICMP request to the OpenVPN server, the other defines a time window, which is used to restart the OpenVPN service, if no ICMP response is received during the window time slice.
+
    <tr>
'''Example:''' 10 60
+
      <td>Keep alive</td>
|-
+
      <td>integer *space* integer; Default: " "</td>
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Virtual network IP address
+
      <td>efines two time intervals: one is used to periodically send ICMP request to the OpenVPN server, the other defines a time window, which is used to restart the OpenVPN service, if no ICMP response is received during the window time slice.<br>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | ip; Default: " "
+
'''Example:''' 10 60</td>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | IP address of the Virtual network, e.g., '''10.0.8.0'''
+
    </tr>
|-
+
    <tr>
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Virtual network IP netmask
+
    <td>Virtual network IP address</td>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | ip; Default: " "
+
        <td>ip; Default: " "</td>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Subnet mask of the Virtual network
+
        <td>IP address of the Virtual network, e.g., '''10.0.8.0'''</td>
|-
+
    </tr>
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Push option
+
    <tr>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | string; Default: " "
+
    <td>Virtual network IP netmask</td>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Push options are a way to “push” user defined routes to connecting clients’ routing tables. In the example above, the server will push the route of 192.168.1.0 network with the 255.255.255.0 netmask to connecting clients. Therefore, the client will be able to reach devices in the 192.168.1.0 network. This is useful when a client needs to reach devices located in the OpenVPN server’s LAN.  
+
        <td>ip; Default: " "</td>
|-
+
        <td>Subnet mask of the Virtual network</td>
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Allow duplicate certificates
+
    </tr>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | yes {{!}} no; Default: '''no'''
+
    <tr>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | If checked, the server allows clients to connect with identical certificates
+
      <td>Push option</td>
|-
+
      <td>string; Default: " "</td>
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Certificate authority
+
      <td>Push options are a way to “push” user defined routes to connecting clients’ routing tables. In the example above, the server will push the route of 192.168.1.0 network with the 255.255.255.0 netmask to connecting clients. Therefore, the client will be able to reach devices in the 192.168.1.0 network. This is useful when a client needs to reach devices located in the OpenVPN server’s LAN. </td>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | .ca file; Default: " "
+
    </tr>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" |  Certificate authority is an entity that issues digital certificates. A digital certificate certifies the ownership of a public key by the named subject of the certificate  
+
    <tr>
|-
+
      <td>Allow duplicate certificates</td>
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Server certificate
+
      <td>yes {{!}} no; Default: '''no'''</td>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | .crt file; Default: " "
+
      <td>If checked, the server allows clients to connect with identical certificates</td>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Server certificate is a type of digital certificate that is used to identify the OpenVPN server
+
    </tr>
|-
+
    <tr>
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Server key
+
    <td>Certificate authority</td>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | .key file; Default: " "
+
        <td>.ca file; Default: " "</td>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Authenticates clients to the server  
+
        <td>Certificate authority is an entity that issues digital certificates. A digital certificate certifies the ownership of a public key by the named subject of the certificate </td>
|-
+
    </tr>
! style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | Diffie Hellman parameters
+
    <tr>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" | .pem file; Default: " "
+
    <td>Server certificate</td>
| style="border: 1px solid white; border-bottom: 2px solid #E8E8E8; text-align: left; vertical-align: top; background: white;" |  DH parameters define how OpenSSL performs the Diffie-Hellman (DH) key-exchange.  
+
        <td>.crt file; Default: " "</td>
|-
+
        <td>Server certificate is a type of digital certificate that is used to identify the OpenVPN server</td>
|}
+
    </tr>
 +
    <tr>
 +
    <td>Server key</td>
 +
        <td>.key file; Default: " "</td>
 +
        <td>Authenticates clients to the server </td>
 +
    </tr>
 +
    <tr>
 +
    <td>Diffie Hellman parameters</td>
 +
        <td>.pem file; Default: " "</td>
 +
        <td>DH parameters define how OpenSSL performs the Diffie-Hellman (DH) key-exchange. </td>
 +
    </tr>
 +
</table>
    
'''*''' You can find detailed instructions on how to generate your own TLS certificates '''[[How to generate TLS certificates (Windows)?|here]]'''.
 
'''*''' You can find detailed instructions on how to generate your own TLS certificates '''[[How to generate TLS certificates (Windows)?|here]]'''.

Navigation menu