high-availability {
    vrrp {
        group eth0 {
            advertise-interval 1
            authentication {
                password ****************
                type plaintext-password
            }
            interface eth0
            no-preempt
            priority 200
            rfc3768-compatibility
            virtual-address <SECONDARY FLOATING WAN IP>
            vrid 10
        }
        group eth1 {
            advertise-interval 1
            authentication {
                password ****************
                type plaintext-password
            }
            interface eth1
            no-preempt
            priority 200
            rfc3768-compatibility
            virtual-address <INTERNAL IP>
            vrid 11
        }
        sync-group MAIN {
            member eth0
            member eth1
            transition-script {
                backup /config/scripts/vrrp_backup.sh
                master /config/scripts/vrrp_master.sh
            }
        }
    }
}
interfaces {
    ethernet eth0 {
        address <PRIMARY WAN IP>
        description WAN
    }
    ethernet eth1 {
        address <INTERNAL LAN IP>
        description LAN
    }
    loopback lo {
    }
    openvpn vtun10 {
        encryption {
            cipher aes256gcm
        }
        hash sha512
        keep-alive {
            failure-count 120
            interval 10
        }
        local-host <SECONDARY FLOATING WAN IP>
        local-port 1194
        mode server
        openvpn-option "--tls-crypt-v2 /config/auth/tls-crypt-v2-server.key"
        persistent-tunnel
        protocol udp
        server {
            domain-name <DOMAIN NAME>
            max-connections 5
            name-server 8.8.8.8
            push-route <INTERNAL ROUTE> {
            }
            push-route <INTERNAL ROUTE> {
            }
            subnet <INTERNAL SUBNET>
            topology subnet
        }
        tls {
            ca-cert-file /config/auth/ca.crt
            cert-file /config/auth/router-cluster.crt
            dh-file /config/auth/dh.pem
            key-file /config/auth/router-cluster.key
        }
        use-lzo-compression
    }
}