No OneTemporary
Actions

Size

39 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/data/templates/openvpn/server.conf.tmpl b/data/templates/openvpn/server.conf.tmpl
	index d9f01310e..9b07a9ba2 100644
	--- a/data/templates/openvpn/server.conf.tmpl
	+++ b/data/templates/openvpn/server.conf.tmpl
	@@ -1,232 +1,233 @@
	### Autogenerated by interfaces-openvpn.py ###
	#
	# See https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
	# for individual keyword definition
	#
	# {{ description if description is defined and description is not none }}
	#

	verb 3
	user {{ daemon_user }}
	group {{ daemon_group }}
	dev-type {{ device_type }}
	dev {{ ifname }}
	persist-key
	{% if protocol == 'tcp-active' %}
	proto tcp-client
	{% elif protocol == 'tcp-passive' %}
	proto tcp-server
	{% else %}
	proto udp
	{% endif %}
	{% if local_host is defined and local_host is not none %}
	local {{ local_host }}
	{% endif %}
	{% if mode is defined and mode == 'server' and protocol == 'udp' and local_host is not defined %}
	multihome
	{% endif %}
	{% if local_port is defined and local_port is not none %}
	lport {{ local_port }}
	{% endif %}
	{% if remote_port is defined and remote_port is not none %}
	rport {{ remote_port }}
	{% endif %}
	{% if remote_host is defined and remote_host is not none %}
	{% for remote in remote_host %}
	remote {{ remote }}
	{% endfor %}
	{% endif %}
	{% if shared_secret_key is defined and shared_secret_key is not none %}
	secret /run/openvpn/{{ ifname }}_shared.key
	{% endif %}
	{% if persistent_tunnel is defined %}
	persist-tun
	{% endif %}
	{% if replace_default_route is defined and replace_default_route.local is defined %}
	push "redirect-gateway local def1"
	{% elif replace_default_route is defined %}
	push "redirect-gateway def1"
	{% endif %}
	{% if use_lzo_compression is defined %}
	compress lzo
	{% endif %}

	{% if mode == 'client' %}
	#
	# OpenVPN Client mode
	#
	client
	nobind

	{% elif mode == 'server' %}
	#
	# OpenVPN Server mode
	#
	mode server
	tls-server
	{% if server is defined and server is not none %}
	{% if server.subnet is defined and server.subnet is not none %}
	{% if server.topology is defined and server.topology == 'point-to-point' %}
	topology p2p
	{% elif server.topology is defined and server.topology is not none %}
	topology {{ server.topology }}
	{% endif %}
	{% for subnet in server.subnet %}
	{% if subnet \| is_ipv4 %}
	server {{ subnet \| address_from_cidr }} {{ subnet \| netmask_from_cidr }} nopool
	+{# First ip address is used as gateway. It's allows to use metrics #}
	+{% if server.push_route is defined and server.push_route is not none %}
	+{% for route, route_config in server.push_route.items() %}
	+{% if route \| is_ipv4 %}
	+push "route {{ route \| address_from_cidr }} {{ route \| netmask_from_cidr }} {{ subnet \| first_host_address }} {{ route_config.metric if route_config.metric is defined else "0" }}"
	+{% elif route \| is_ipv6 %}
	+push "route-ipv6 {{ route }}"
	+{% endif %}
	+{% endfor %}
	+{% endif %}
	{# OpenVPN assigns the first IP address to its local interface so the pool used #}
	{# in net30 topology - where each client receives a /30 must start from the second subnet #}
	{% if server.topology is defined and server.topology == 'net30' %}
	ifconfig-pool {{ subnet \| inc_ip('4') }} {{ subnet \| last_host_address \| dec_ip('1') }} {{ subnet \| netmask_from_cidr if device_type == 'tap' else '' }}
	{% else %}
	{# OpenVPN assigns the first IP address to its local interface so the pool must #}
	{# start from the second address and end on the last address #}
	ifconfig-pool {{ subnet \| first_host_address \| inc_ip('1') }} {{ subnet \| last_host_address \| dec_ip('1') }} {{ subnet \| netmask_from_cidr if device_type == 'tun' else '' }}
	{% endif %}
	{% elif subnet \| is_ipv6 %}
	server-ipv6 {{ subnet }}
	{% endif %}
	{% endfor %}
	{% endif %}

	{% if server.client_ip_pool is defined and server.client_ip_pool is not none and server.client_ip_pool.disable is not defined %}
	ifconfig-pool {{ server.client_ip_pool.start }} {{ server.client_ip_pool.stop }}{{ server.client_ip_pool.subnet_mask if server.client_ip_pool.subnet_mask is defined and server.client_ip_pool.subnet_mask is not none }}
	{% endif %}
	{% if server.max_connections is defined and server.max_connections is not none %}
	max-clients {{ server.max_connections }}
	{% endif %}
	{% if server.client is defined and server.client is not none %}
	client-config-dir /run/openvpn/ccd/{{ ifname }}
	{% endif %}
	{% endif %}
	keepalive {{ keep_alive.interval }} {{ keep_alive.interval\|int * keep_alive.failure_count\|int }}
	management /run/openvpn/openvpn-mgmt-intf unix
	{% if server is defined and server is not none %}
	{% if server.reject_unconfigured_clients is defined %}
	ccd-exclusive
	{% endif %}

	-{% if server.push_route is defined and server.push_route is not none %}
	-{% for route in server.push_route %}
	-{% if route \| is_ipv4 %}
	-push "route {{ route \| address_from_cidr }} {{ route \| netmask_from_cidr }}"
	-{% elif route \| is_ipv6 %}
	-push "route-ipv6 {{ route }}"
	-{% endif %}
	-{% endfor %}
	-{% endif %}
	{% if server.name_server is defined and server.name_server is not none %}
	{% for nameserver in server.name_server %}
	{% if nameserver \| is_ipv4 %}
	push "dhcp-option DNS {{ nameserver }}"
	{% elif nameserver \| is_ipv6 %}
	push "dhcp-option DNS6 {{ nameserver }}"
	{% endif %}
	{% endfor %}
	{% endif %}
	{% if server.domain_name is defined and server.domain_name is not none %}
	push "dhcp-option DOMAIN {{ server.domain_name }}"
	{% endif %}
	{% endif %}
	{% else %}
	#
	# OpenVPN site-2-site mode
	#
	ping {{ keep_alive.interval }}
	ping-restart {{ keep_alive.failure_count }}

	{% if device_type == 'tap' %}
	{% for laddr, laddr_conf in local_address.items() if laddr \| is_ipv4 %}
	{% if laddr_conf is defined and laddr_conf.subnet_mask is defined and laddr_conf.subnet_mask is not none %}
	ifconfig {{ laddr }} {{ laddr_conf.subnet_mask }}
	{% endif %}
	{% endfor %}
	{% else %}
	{% for laddr in local_address if laddr \| is_ipv4 %}
	{% for raddr in remote_address if raddr \| is_ipv4 %}
	ifconfig {{ laddr }} {{ raddr }}
	{% endfor %}
	{% endfor %}
	{% for laddr in local_address if laddr \| is_ipv6 %}
	{% for raddr in remote_address if raddr \| is_ipv6 %}
	ifconfig-ipv6 {{ laddr }} {{ raddr }}
	{% endfor %}
	{% endfor %}
	{% endif %}
	{% endif %}

	{% if tls is defined and tls is not none %}
	# TLS options
	{% if tls.ca_certificate is defined and tls.ca_certificate is not none %}
	ca /run/openvpn/{{ ifname }}_ca.pem
	{% endif %}
	{% if tls.certificate is defined and tls.certificate is not none %}
	cert /run/openvpn/{{ ifname }}_cert.pem
	{% endif %}
	{% if tls.private_key is defined %}
	key /run/openvpn/{{ ifname }}_cert.key
	{% endif %}
	{% if tls.crypt_key is defined and tls.crypt_key is not none %}
	tls-crypt /run/openvpn/{{ ifname }}_crypt.key
	{% endif %}
	{% if tls.crl is defined %}
	crl-verify /run/openvpn/{{ ifname }}_crl.pem
	{% endif %}
	{% if tls.tls_version_min is defined and tls.tls_version_min is not none %}
	tls-version-min {{ tls.tls_version_min }}
	{% endif %}
	{% if tls.dh_params is defined and tls.dh_params is not none %}
	dh /run/openvpn/{{ ifname }}_dh.pem
	{% endif %}
	{% if tls.auth_key is defined and tls.auth_key is not none %}
	{% if mode == 'client' %}
	tls-auth /run/openvpn/{{ ifname }}_auth.key 1
	{% elif mode == 'server' %}
	tls-auth /run/openvpn/{{ ifname }}_auth.key 0
	{% endif %}
	{% endif %}
	{% if tls.role is defined and tls.role is not none %}
	{% if tls.role == 'active' %}
	tls-client
	{% elif tls.role == 'passive' %}
	tls-server
	{% endif %}
	{% endif %}
	{% endif %}

	# Encryption options
	{% if encryption is defined and encryption is not none %}
	{% if encryption.cipher is defined and encryption.cipher is not none %}
	cipher {{ encryption.cipher \| openvpn_cipher }}
	{% if encryption.cipher == 'bf128' %}
	keysize 128
	{% elif encryption.cipher == 'bf256' %}
	keysize 256
	{% endif %}
	{% endif %}
	{% if encryption.ncp_ciphers is defined and encryption.ncp_ciphers is not none %}
	data-ciphers {{ encryption.ncp_ciphers \| openvpn_ncp_ciphers }}
	{% endif %}
	{% endif %}

	{% if hash is defined and hash is not none %}
	auth {{ hash }}
	{% endif %}

	{% if authentication is defined and authentication is not none %}
	auth-user-pass {{ auth_user_pass_file }}
	auth-retry nointeract
	{% endif %}

	{% if openvpn_option is defined and openvpn_option is not none %}
	#
	# Custom options added by user (not validated)
	#
	{% for option in openvpn_option %}
	{% for argument in option.split('--') %}
	{% if argument is defined and argument != '' %}
	--{{ argument }}
	{% endif %}
	{% endfor %}
	{% endfor %}
	{% endif %}
	diff --git a/interface-definitions/interfaces-openvpn.xml.in b/interface-definitions/interfaces-openvpn.xml.in
	index 7ff08ac86..286b10f9a 100644
	--- a/interface-definitions/interfaces-openvpn.xml.in
	+++ b/interface-definitions/interfaces-openvpn.xml.in
	@@ -1,734 +1,748 @@
	<?xml version="1.0"?>
	<interfaceDefinition>
	<node name="interfaces">
	<children>
	<tagNode name="openvpn" owner="${vyos_conf_scripts_dir}/interfaces-openvpn.py">
	<properties>
	<help>OpenVPN Tunnel Interface</help>
	<priority>460</priority>
	<constraint>
	<regex>^vtun[0-9]+$</regex>
	</constraint>
	<constraintErrorMessage>OpenVPN tunnel interface must be named vtunN</constraintErrorMessage>
	<valueHelp>
	<format>vtunN</format>
	<description>OpenVPN interface name</description>
	</valueHelp>
	</properties>
	<children>
	<node name="authentication">
	<properties>
	<help>Authentication options</help>
	</properties>
	<children>
	<leafNode name="password">
	<properties>
	<help>OpenVPN password used for authentication</help>
	</properties>
	</leafNode>
	<leafNode name="username">
	<properties>
	<help>OpenVPN username used for authentication</help>
	</properties>
	</leafNode>
	</children>
	</node>
	#include <include/interface/interface-description.xml.i>
	<leafNode name="device-type">
	<properties>
	<help>OpenVPN interface device-type (default: tun)</help>
	<completionHelp>
	<list>tun tap</list>
	</completionHelp>
	<valueHelp>
	<format>tun</format>
	<description>TUN device, required for OSI layer 3</description>
	</valueHelp>
	<valueHelp>
	<format>tap</format>
	<description>TAP device, required for OSI layer 2</description>
	</valueHelp>
	<constraint>
	<regex>^(tun\|tap)$</regex>
	</constraint>
	</properties>
	<defaultValue>tun</defaultValue>
	</leafNode>
	#include <include/interface/interface-disable.xml.i>
	<node name="encryption">
	<properties>
	<help>Data Encryption settings</help>
	</properties>
	<children>
	<leafNode name="cipher">
	<properties>
	<help>Standard Data Encryption Algorithm</help>
	<completionHelp>
	<list>none des 3des bf128 bf256 aes128 aes128gcm aes192 aes192gcm aes256 aes256gcm</list>
	</completionHelp>
	<valueHelp>
	<format>none</format>
	<description>Disable encryption</description>
	</valueHelp>
	<valueHelp>
	<format>des</format>
	<description>DES algorithm</description>
	</valueHelp>
	<valueHelp>
	<format>3des</format>
	<description>DES algorithm with triple encryption</description>
	</valueHelp>
	<valueHelp>
	<format>bf128</format>
	<description>Blowfish algorithm with 128-bit key</description>
	</valueHelp>
	<valueHelp>
	<format>bf256</format>
	<description>Blowfish algorithm with 256-bit key</description>
	</valueHelp>
	<valueHelp>
	<format>aes128</format>
	<description>AES algorithm with 128-bit key CBC</description>
	</valueHelp>
	<valueHelp>
	<format>aes128gcm</format>
	<description>AES algorithm with 128-bit key GCM</description>
	</valueHelp>
	<valueHelp>
	<format>aes192</format>
	<description>AES algorithm with 192-bit key CBC</description>
	</valueHelp>
	<valueHelp>
	<format>aes192gcm</format>
	<description>AES algorithm with 192-bit key GCM</description>
	</valueHelp>
	<valueHelp>
	<format>aes256</format>
	<description>AES algorithm with 256-bit key CBC</description>
	</valueHelp>
	<valueHelp>
	<format>aes256gcm</format>
	<description>AES algorithm with 256-bit key GCM</description>
	</valueHelp>
	<constraint>
	<regex>^(none\|des\|3des\|bf128\|bf256\|aes128\|aes128gcm\|aes192\|aes192gcm\|aes256\|aes256gcm)$</regex>
	</constraint>
	</properties>
	</leafNode>
	<leafNode name="ncp-ciphers">
	<properties>
	<help>Cipher negotiation list for use in server or client mode</help>
	<completionHelp>
	<list>none des 3des aes128 aes128gcm aes192 aes192gcm aes256 aes256gcm</list>
	</completionHelp>
	<valueHelp>
	<format>none</format>
	<description>Disable encryption</description>
	</valueHelp>
	<valueHelp>
	<format>des</format>
	<description>DES algorithm</description>
	</valueHelp>
	<valueHelp>
	<format>3des</format>
	<description>DES algorithm with triple encryption</description>
	</valueHelp>
	<valueHelp>
	<format>aes128</format>
	<description>AES algorithm with 128-bit key CBC</description>
	</valueHelp>
	<valueHelp>
	<format>aes128gcm</format>
	<description>AES algorithm with 128-bit key GCM</description>
	</valueHelp>
	<valueHelp>
	<format>aes192</format>
	<description>AES algorithm with 192-bit key CBC</description>
	</valueHelp>
	<valueHelp>
	<format>aes192gcm</format>
	<description>AES algorithm with 192-bit key GCM</description>
	</valueHelp>
	<valueHelp>
	<format>aes256</format>
	<description>AES algorithm with 256-bit key CBC</description>
	</valueHelp>
	<valueHelp>
	<format>aes256gcm</format>
	<description>AES algorithm with 256-bit key GCM</description>
	</valueHelp>
	<constraint>
	<regex>^(none\|des\|3des\|aes128\|aes128gcm\|aes192\|aes192gcm\|aes256\|aes256gcm)$</regex>
	</constraint>
	<multi/>
	</properties>
	</leafNode>
	</children>
	</node>
	#include <include/interface/interface-ipv6-options.xml.i>
	<leafNode name="hash">
	<properties>
	<help>Hashing Algorithm</help>
	<completionHelp>
	<list>md5 sha1 sha256 sha384 sha512</list>
	</completionHelp>
	<valueHelp>
	<format>md5</format>
	<description>MD5 algorithm</description>
	</valueHelp>
	<valueHelp>
	<format>sha1</format>
	<description>SHA-1 algorithm</description>
	</valueHelp>
	<valueHelp>
	<format>sha256</format>
	<description>SHA-256 algorithm</description>
	</valueHelp>
	<valueHelp>
	<format>sha384</format>
	<description>SHA-384 algorithm</description>
	</valueHelp>
	<valueHelp>
	<format>sha512</format>
	<description>SHA-512 algorithm</description>
	</valueHelp>
	<constraint>
	<regex>^(md5\|sha1\|sha256\|sha384\|sha512)$</regex>
	</constraint>
	</properties>
	</leafNode>
	<node name="keep-alive">
	<properties>
	<help>Keepalive helper options</help>
	</properties>
	<children>
	<leafNode name="failure-count">
	<properties>
	<help>Maximum number of keepalive packet failures (default: 60)</help>
	<valueHelp>
	<format>0-1000</format>
	<description>Maximum number of keepalive packet failures</description>
	</valueHelp>
	<constraint>
	<validator name="numeric" argument="--range 0-1000"/>
	</constraint>
	</properties>
	<defaultValue>60</defaultValue>
	</leafNode>
	<leafNode name="interval">
	<properties>
	<help>Keepalive packet interval in seconds (default: 10)</help>
	<valueHelp>
	<format>0-600</format>
	<description>Keepalive packet interval (seconds)</description>
	</valueHelp>
	<constraint>
	<validator name="numeric" argument="--range 0-600"/>
	</constraint>
	</properties>
	<defaultValue>10</defaultValue>
	</leafNode>
	</children>
	</node>
	<tagNode name="local-address">
	<properties>
	<help>Local IP address of tunnel (IPv4 or IPv6)</help>
	<constraint>
	<validator name="ip-address"/>
	</constraint>
	</properties>
	<children>
	<leafNode name="subnet-mask">
	<properties>
	<help>Subnet-mask for local IP address of tunnel (IPv4 only)</help>
	<constraint>
	<validator name="ipv4-address"/>
	</constraint>
	</properties>
	</leafNode>
	</children>
	</tagNode>
	<leafNode name="local-host">
	<properties>
	<help>Local IP address to accept connections (all if not set)</help>
	<valueHelp>
	<format>ipv4</format>
	<description>Local IPv4 address</description>
	</valueHelp>
	<valueHelp>
	<format>ipv6</format>
	<description>Local IPv6 address</description>
	</valueHelp>
	<constraint>
	<validator name="ip-address"/>
	</constraint>
	</properties>
	</leafNode>
	<leafNode name="local-port">
	<properties>
	<help>Local port number to accept connections</help>
	<valueHelp>
	<format>1-65535</format>
	<description>Numeric IP port</description>
	</valueHelp>
	<constraint>
	<validator name="numeric" argument="--range 1-65535"/>
	</constraint>
	</properties>
	</leafNode>
	<leafNode name="mode">
	<properties>
	<help>OpenVPN mode of operation</help>
	<completionHelp>
	<list>site-to-site client server</list>
	</completionHelp>
	<valueHelp>
	<format>site-to-site</format>
	<description>Site-to-site mode</description>
	</valueHelp>
	<valueHelp>
	<format>client</format>
	<description>Client in client-server mode</description>
	</valueHelp>
	<valueHelp>
	<format>server</format>
	<description>Server in client-server mode</description>
	</valueHelp>
	<constraint>
	<regex>^(site-to-site\|client\|server)$</regex>
	</constraint>
	</properties>
	</leafNode>
	<leafNode name="openvpn-option">
	<properties>
	<help>Additional OpenVPN options. You must
	use the syntax of openvpn.conf in this text-field. Using this
	without proper knowledge may result in a crashed OpenVPN server.
	Check system log to look for errors.</help>
	<multi/>
	</properties>
	</leafNode>
	<leafNode name="persistent-tunnel">
	<properties>
	<help>Do not close and reopen interface (TUN/TAP device) on client restarts</help>
	<valueless/>
	</properties>
	</leafNode>
	<leafNode name="protocol">
	<properties>
	<help>OpenVPN communication protocol</help>
	<completionHelp>
	<list>udp tcp-passive tcp-active</list>
	</completionHelp>
	<valueHelp>
	<format>udp</format>
	<description>UDP</description>
	</valueHelp>
	<valueHelp>
	<format>tcp-passive</format>
	<description>TCP and accepts connections passively</description>
	</valueHelp>
	<valueHelp>
	<format>tcp-active</format>
	<description>TCP and initiates connections actively</description>
	</valueHelp>
	<constraint>
	<regex>^(udp\|tcp-passive\|tcp-active)$</regex>
	</constraint>
	</properties>
	<defaultValue>udp</defaultValue>
	</leafNode>
	<leafNode name="remote-address">
	<properties>
	<help>IP address of remote end of tunnel</help>
	<valueHelp>
	<format>ipv4</format>
	<description>Remote end IPv4 address</description>
	</valueHelp>
	<valueHelp>
	<format>ipv6</format>
	<description>Remote end IPv6 address</description>
	</valueHelp>
	<constraint>
	<validator name="ipv4-address"/>
	<validator name="ipv6-address"/>
	</constraint>
	<multi/>
	</properties>
	</leafNode>
	<leafNode name="remote-host">
	<properties>
	<help>Remote host to connect to (dynamic if not set)</help>
	<valueHelp>
	<format>ipv4</format>
	<description>IPv4 address of remote host</description>
	</valueHelp>
	<valueHelp>
	<format>ipv6</format>
	<description>IPv6 address of remote host</description>
	</valueHelp>
	<valueHelp>
	<format>txt</format>
	<description>Hostname of remote host</description>
	</valueHelp>
	<multi/>
	</properties>
	</leafNode>
	<leafNode name="remote-port">
	<properties>
	<help>Remote port number to connect to</help>
	<valueHelp>
	<format>1-65535</format>
	<description>Numeric IP port</description>
	</valueHelp>
	<constraint>
	<validator name="numeric" argument="--range 1-65535"/>
	</constraint>
	</properties>
	</leafNode>
	<node name="replace-default-route">
	<properties>
	<help>OpenVPN tunnel to be used as the default route</help>
	</properties>
	<children>
	<leafNode name="local">
	<properties>
	<help>Tunnel endpoints are on the same subnet</help>
	</properties>
	</leafNode>
	</children>
	</node>
	<node name="server">
	<properties>
	<help>Server-mode options</help>
	</properties>
	<children>
	<tagNode name="client">
	<properties>
	<help>Client-specific settings</help>
	<valueHelp>
	<format>name</format>
	<description>Client common-name in the certificate</description>
	</valueHelp>
	</properties>
	<children>
	#include <include/generic-disable-node.xml.i>
	<leafNode name="ip">
	<properties>
	<help>IP address of the client</help>
	<valueHelp>
	<format>ipv4</format>
	<description>Client IPv4 address</description>
	</valueHelp>
	<valueHelp>
	<format>ipv6</format>
	<description>Client IPv6 address</description>
	</valueHelp>
	<constraint>
	<validator name="ip-address"/>
	</constraint>
	<multi/>
	</properties>
	</leafNode>
	<leafNode name="push-route">
	<properties>
	<help>Route to be pushed to the client</help>
	<valueHelp>
	<format>ipv4net</format>
	<description>IPv4 network and prefix length</description>
	</valueHelp>
	<valueHelp>
	<format>ipv6net</format>
	<description>IPv6 network and prefix length</description>
	</valueHelp>
	<constraint>
	<validator name="ip-prefix"/>
	</constraint>
	<multi/>
	</properties>
	</leafNode>
	<leafNode name="subnet">
	<properties>
	<help>Subnet belonging to the client (iroute)</help>
	<valueHelp>
	<format>ipv4net</format>
	<description>IPv4 network and prefix length belonging to the client</description>
	</valueHelp>
	<valueHelp>
	<format>ipv6net</format>
	<description>IPv6 network and prefix length belonging to the client</description>
	</valueHelp>
	<constraint>
	<validator name="ip-prefix"/>
	</constraint>
	<multi/>
	</properties>
	</leafNode>
	</children>
	</tagNode>
	<node name="client-ip-pool">
	<properties>
	<help>Pool of client IPv4 addresses</help>
	</properties>
	<children>
	#include <include/generic-disable-node.xml.i>
	<leafNode name="start">
	<properties>
	<help>First IP address in the pool</help>
	<constraint>
	<validator name="ipv4-address"/>
	</constraint>
	<valueHelp>
	<format>ipv4</format>
	<description>IPv4 address</description>
	</valueHelp>
	</properties>
	</leafNode>
	<leafNode name="stop">
	<properties>
	<help>Last IP address in the pool</help>
	<constraint>
	<validator name="ipv4-address"/>
	</constraint>
	<valueHelp>
	<format>ipv4</format>
	<description>IPv4 address</description>
	</valueHelp>
	</properties>
	</leafNode>
	<leafNode name="subnet-mask">
	<properties>
	<help>Subnet mask pushed to dynamic clients.
	If not set the server subnet mask will be used.
	Only used with topology subnet or device type tap.
	Not used with bridged interfaces.</help>
	<constraint>
	<validator name="ipv4-address"/>
	</constraint>
	<valueHelp>
	<format>ipv4</format>
	<description>IPv4 subnet mask</description>
	</valueHelp>
	</properties>
	</leafNode>
	</children>
	</node>
	<node name="client-ipv6-pool">
	<properties>
	<help>Pool of client IPv6 addresses</help>
	</properties>
	<children>
	<leafNode name="base">
	<properties>
	<help>Client IPv6 pool base address with optional prefix length</help>
	<valueHelp>
	<format>ipv6net</format>
	<description>Client IPv6 pool base address with optional prefix length (defaults: base = server subnet + 0x1000, prefix length = server prefix length)</description>
	</valueHelp>
	<constraint>
	<validator name="ipv6"/>
	</constraint>
	</properties>
	</leafNode>
	#include <include/generic-disable-node.xml.i>
	</children>
	</node>
	<leafNode name="domain-name">
	<properties>
	<help>DNS suffix to be pushed to all clients</help>
	<valueHelp>
	<format>txt</format>
	<description>Domain Name Server suffix</description>
	</valueHelp>
	</properties>
	</leafNode>
	<leafNode name="max-connections">
	<properties>
	<help>Number of maximum client connections</help>
	<valueHelp>
	<format>1-4096</format>
	<description>Number of concurrent clients</description>
	</valueHelp>
	<constraint>
	<validator name="numeric" argument="--range 1-4096"/>
	</constraint>
	</properties>
	</leafNode>
	<leafNode name="name-server">
	<properties>
	<help>Domain Name Server (DNS)</help>
	<valueHelp>
	<format>ipv4</format>
	<description>DNS server IPv4 address</description>
	</valueHelp>
	<valueHelp>
	<format>ipv6</format>
	<description>DNS server IPv6 address</description>
	</valueHelp>
	<constraint>
	<validator name="ip-address"/>
	</constraint>
	<multi/>
	</properties>
	</leafNode>
	- <leafNode name="push-route">
	+ <tagNode name="push-route">
	<properties>
	<help>Route to be pushed to all clients</help>
	<valueHelp>
	<format>ipv4net</format>
	<description>IPv4 network and prefix length</description>
	</valueHelp>
	<valueHelp>
	<format>ipv6net</format>
	<description>IPv6 network and prefix length</description>
	</valueHelp>
	<constraint>
	<validator name="ip-prefix"/>
	</constraint>
	- <multi/>
	</properties>
	- </leafNode>
	+ <children>
	+ <leafNode name="metric">
	+ <properties>
	+ <help>Set metric for this route</help>
	+ <valueHelp>
	+ <format>0-4294967295</format>
	+ <description>Metric for this route</description>
	+ </valueHelp>
	+ <constraint>
	+ <validator name="numeric" argument="--range 0-4294967295"/>
	+ </constraint>
	+ </properties>
	+ <defaultValue>0</defaultValue>
	+ </leafNode>
	+ </children>
	+ </tagNode>
	<leafNode name="reject-unconfigured-clients">
	<properties>
	<help>Reject connections from clients that are not explicitly configured</help>
	<valueless/>
	</properties>
	</leafNode>
	<leafNode name="subnet">
	<properties>
	<help>Server-mode subnet (from which client IPs are allocated)</help>
	<valueHelp>
	<format>ipv4net</format>
	<description>IPv4 network and prefix length</description>
	</valueHelp>
	<valueHelp>
	<format>ipv6net</format>
	<description>IPv6 network and prefix length</description>
	</valueHelp>
	<constraint>
	<validator name="ip-prefix"/>
	</constraint>
	<multi/>
	</properties>
	</leafNode>
	<leafNode name="topology">
	<properties>
	<help>Topology for clients (default: net30)</help>
	<completionHelp>
	<list>net30 point-to-point subnet</list>
	</completionHelp>
	<valueHelp>
	<format>net30</format>
	<description>net30 topology (default)</description>
	</valueHelp>
	<valueHelp>
	<format>point-to-point</format>
	<description>Point-to-point topology</description>
	</valueHelp>
	<valueHelp>
	<format>subnet</format>
	<description>Subnet topology</description>
	</valueHelp>
	<constraint>
	<regex>^(subnet\|point-to-point\|net30)$</regex>
	</constraint>
	</properties>
	<defaultValue>net30</defaultValue>
	</leafNode>
	</children>
	</node>
	<leafNode name="shared-secret-key">
	<properties>
	<help>Secret key shared with remote end of tunnel</help>
	<completionHelp>
	<path>pki openvpn shared-secret</path>
	</completionHelp>
	</properties>
	</leafNode>
	<node name="tls">
	<properties>
	<help>Transport Layer Security (TLS) options</help>
	</properties>
	<children>
	<leafNode name="auth-key">
	<properties>
	<help>TLS shared secret key for tls-auth</help>
	<completionHelp>
	<path>pki openvpn shared-secret</path>
	</completionHelp>
	</properties>
	</leafNode>
	#include <include/pki/certificate.xml.i>
	#include <include/pki/ca-certificate.xml.i>
	<leafNode name="dh-params">
	<properties>
	<help>Diffie Hellman parameters (server only)</help>
	<completionHelp>
	<path>pki dh</path>
	</completionHelp>
	</properties>
	</leafNode>
	<leafNode name="crypt-key">
	<properties>
	<help>Static key to use to authenticate control channel</help>
	<completionHelp>
	<path>pki openvpn shared-secret</path>
	</completionHelp>
	</properties>
	</leafNode>
	<leafNode name="tls-version-min">
	<properties>
	<help>Specify the minimum required TLS version</help>
	<completionHelp>
	<list>1.0 1.1 1.2</list>
	</completionHelp>
	<valueHelp>
	<format>1.0</format>
	<description>TLS v1.0</description>
	</valueHelp>
	<valueHelp>
	<format>1.1</format>
	<description>TLS v1.1</description>
	</valueHelp>
	<valueHelp>
	<format>1.2</format>
	<description>TLS v1.2</description>
	</valueHelp>
	<constraint>
	<regex>^(1.0\|1.1\|1.2)$</regex>
	</constraint>
	</properties>
	</leafNode>
	<leafNode name="role">
	<properties>
	<help>TLS negotiation role</help>
	<completionHelp>
	<list>active passive</list>
	</completionHelp>
	<valueHelp>
	<format>active</format>
	<description>Initiate TLS negotiation actively</description>
	</valueHelp>
	<valueHelp>
	<format>passive</format>
	<description>Wait for incoming TLS connection</description>
	</valueHelp>
	<constraint>
	<regex>^(active\|passive)$</regex>
	</constraint>
	</properties>
	</leafNode>
	</children>
	</node>
	<leafNode name="use-lzo-compression">
	<properties>
	<help>Use fast LZO compression on this TUN/TAP interface</help>
	<valueless/>
	</properties>
	</leafNode>
	#include <include/interface/interface-vrf.xml.i>
	</children>
	</tagNode>
	</children>
	</node>
	</interfaceDefinition>

File Metadata

Mime Type: text/x-diff
Expires: Sat, Sep 26, 12:53 PM (1 d, 9 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 4283241
Default Alt Text: (39 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions