### Autogenerated by interfaces_openvpn.py ### # # See https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage # for individual keyword definition # # {{ description if description is vyos_defined }} # verb 3 dev-type {{ device_type }} dev {{ ifname }} persist-key {% if protocol is vyos_defined('tcp-active') %} proto tcp-client {% elif protocol is vyos_defined('tcp-passive') %} proto tcp-server {% else %} proto udp {% endif %} {% if local_host is vyos_defined %} local {{ local_host }} {% endif %} {% if mode is vyos_defined('server') and protocol is vyos_defined('udp') and local_host is not vyos_defined %} multihome {% endif %} {% if local_port is vyos_defined %} lport {{ local_port }} {% endif %} {% if remote_port is vyos_defined %} rport {{ remote_port }} {% endif %} {% if remote_host is vyos_defined %} {% for remote in remote_host %} remote {{ remote }} {% endfor %} {% endif %} {% if shared_secret_key is vyos_defined %} secret /run/openvpn/{{ ifname }}_shared.key {% endif %} {% if persistent_tunnel is vyos_defined %} persist-tun {% endif %} {% if replace_default_route.local is vyos_defined %} push "redirect-gateway local def1" {% elif replace_default_route is vyos_defined %} push "redirect-gateway def1" {% endif %} {% if use_lzo_compression is vyos_defined %} compress lzo {% endif %} {% if offload.dco is not vyos_defined %} disable-dco {% endif %} {% if mode is vyos_defined('client') %} # # OpenVPN Client mode # client nobind {% elif mode is vyos_defined('server') %} # # OpenVPN Server mode # mode server tls-server {% if server is vyos_defined %} {% if server.subnet is vyos_defined %} {% if server.topology is vyos_defined('point-to-point') %} topology p2p {% elif server.topology is vyos_defined %} topology {{ server.topology }} {% endif %} {% for subnet in server.subnet %} {% if subnet | is_ipv4 %} server {{ subnet | address_from_cidr }} {{ subnet | netmask_from_cidr }} {{ 'nopool' if server.client_ip_pool is vyos_defined and server.client_ip_pool.disable is not vyos_defined else '' }} {# First ip address is used as gateway. It's allows to use metrics #} {% if server.push_route is vyos_defined %} {% for route, route_config in server.push_route.items() %} {% if route | is_ipv4 %} push "route {{ route | address_from_cidr }} {{ route | netmask_from_cidr }} {{ 'vpn_gateway' ~ ' ' ~ route_config.metric if route_config.metric is vyos_defined }}" {% elif route | is_ipv6 %} push "route-ipv6 {{ route }}" {% endif %} {% endfor %} {% endif %} {% elif subnet | is_ipv6 %} server-ipv6 {{ subnet }} {% endif %} {% endfor %} {% endif %} {% if server.bridge is vyos_defined and server.bridge.disable is not vyos_defined %} server-bridge {{ server.bridge.gateway }} {{ server.bridge.subnet_mask }} {{ server.bridge.start }} {{ server.bridge.stop if server.bridge.stop is vyos_defined }} {% endif %} {% if server.client_ip_pool is vyos_defined and server.client_ip_pool.disable is not vyos_defined %} ifconfig-pool {{ server.client_ip_pool.start }} {{ server.client_ip_pool.stop }} {{ server.client_ip_pool.subnet_mask if server.client_ip_pool.subnet_mask is vyos_defined }} {% endif %} {% if server.max_connections is vyos_defined %} max-clients {{ server.max_connections }} {% endif %} {% if server.client is vyos_defined %} client-config-dir /run/openvpn/ccd/{{ ifname }} {% endif %} {% endif %} keepalive {{ keep_alive.interval }} {{ keep_alive.interval | int * keep_alive.failure_count | int }} management /run/openvpn/openvpn-mgmt-intf unix {% if server is vyos_defined %} {% if server.reject_unconfigured_clients is vyos_defined %} ccd-exclusive {% endif %} {% if server.name_server is vyos_defined %} {% for nameserver in server.name_server %} {% if nameserver | is_ipv4 %} push "dhcp-option DNS {{ nameserver }}" {% elif nameserver | is_ipv6 %} push "dhcp-option DNS6 {{ nameserver }}" {% endif %} {% endfor %} {% endif %} {% if server.domain_name is vyos_defined %} push "dhcp-option DOMAIN {{ server.domain_name }}" {% endif %} {% if server.mfa.totp is vyos_defined %} {% set totp_config = server.mfa.totp %} plugin "{{ plugin_dir }}/openvpn-otp.so" "otp_secrets=/config/auth/openvpn/{{ ifname }}-otp-secrets otp_slop={{ totp_config.slop }} totp_t0={{ totp_config.drift }} totp_step={{ totp_config.step }} totp_digits={{ totp_config.digits }} password_is_cr={{ '1' if totp_config.challenge == 'enable' else '0' }}" {% endif %} {% endif %} {% else %} # # OpenVPN site-2-site mode # ping {{ keep_alive.interval }} ping-restart {{ keep_alive.failure_count }} {% if device_type == 'tap' %} {% if local_address is vyos_defined %} {% for laddr, laddr_conf in local_address.items() if laddr | is_ipv4 %} {% if laddr_conf.subnet_mask is vyos_defined %} ifconfig {{ laddr }} {{ laddr_conf.subnet_mask }} {% endif %} {% endfor %} {% endif %} {% else %} {% for laddr in local_address if laddr | is_ipv4 %} {% for raddr in remote_address if raddr | is_ipv4 %} ifconfig {{ laddr }} {{ raddr }} {% endfor %} {% endfor %} {% for laddr in local_address if laddr | is_ipv6 %} {% for raddr in remote_address if raddr | is_ipv6 %} ifconfig-ipv6 {{ laddr }} {{ raddr }} {% endfor %} {% endfor %} {% endif %} {% endif %} {% if tls is vyos_defined %} # TLS options {% if tls.ca_certificate is vyos_defined %} ca /run/openvpn/{{ ifname }}_ca.pem {% endif %} {% if tls.certificate is vyos_defined %} cert /run/openvpn/{{ ifname }}_cert.pem {% endif %} {% if tls.private_key is vyos_defined %} key /run/openvpn/{{ ifname }}_cert.key {% endif %} {% if tls.crypt_key is vyos_defined %} tls-crypt /run/openvpn/{{ ifname }}_crypt.key {% endif %} {% if tls.crl is vyos_defined %} crl-verify /run/openvpn/{{ ifname }}_crl.pem {% endif %} {% if tls.tls_version_min is vyos_defined %} tls-version-min {{ tls.tls_version_min }} {% endif %} {% if tls.dh_params is vyos_defined %} dh /run/openvpn/{{ ifname }}_dh.pem {% else %} dh none {% endif %} {% if tls.auth_key is vyos_defined %} {% if mode == 'client' %} tls-auth /run/openvpn/{{ ifname }}_auth.key 1 {% elif mode == 'server' %} tls-auth /run/openvpn/{{ ifname }}_auth.key 0 {% endif %} {% endif %} {% if tls.role is vyos_defined('active') %} tls-client {% elif tls.role is vyos_defined('passive') %} tls-server {% endif %} {% if tls.peer_fingerprint is vyos_defined %} {% for fp in tls.peer_fingerprint %} {{ fp }} {% endfor %} {% endif %} {% endif %} # Encryption options {% if encryption is vyos_defined %} {% if encryption.cipher is vyos_defined %} cipher {{ encryption.cipher | openvpn_cipher }} {% if encryption.cipher is vyos_defined('bf128') %} keysize 128 {% elif encryption.cipher is vyos_defined('bf256') %} keysize 256 {% endif %} {% endif %} {% if encryption.ncp_ciphers is vyos_defined %} data-ciphers {{ encryption.ncp_ciphers | openvpn_ncp_ciphers }} {% endif %} {% endif %} # https://vyos.dev/T5027 # Required to support BF-CBC (default ciphername when none given) providers legacy default {% if hash is vyos_defined %} auth {{ hash }} {% endif %} {% if authentication is vyos_defined %} auth-user-pass {{ auth_user_pass_file }} auth-retry nointeract {% endif %}