summaryrefslogtreecommitdiff
path: root/docs/configuration/interfaces/openvpn.rst
diff options
context:
space:
mode:
authorrebortg <github@ghlr.de>2023-11-24 10:48:09 +0100
committerrebortg <github@ghlr.de>2023-11-24 10:48:09 +0100
commit5fb241c9ae0f95a3917a90d34c9979f06b965197 (patch)
tree7a08969e9162bb64df60af9641278d54a8e14f29 /docs/configuration/interfaces/openvpn.rst
parentd6d9dbbbef70549bcc4c855486398b97f2aa32cb (diff)
downloadvyos-documentation-5fb241c9ae0f95a3917a90d34c9979f06b965197.tar.gz
vyos-documentation-5fb241c9ae0f95a3917a90d34c9979f06b965197.zip
fix some build warnings
Diffstat (limited to 'docs/configuration/interfaces/openvpn.rst')
-rw-r--r--docs/configuration/interfaces/openvpn.rst10
1 files changed, 7 insertions, 3 deletions
diff --git a/docs/configuration/interfaces/openvpn.rst b/docs/configuration/interfaces/openvpn.rst
index 2160e781..bfa40a7e 100644
--- a/docs/configuration/interfaces/openvpn.rst
+++ b/docs/configuration/interfaces/openvpn.rst
@@ -71,7 +71,7 @@ In both cases, we will use the following settings:
dynamic IP for our remote router.
Setting up certificates
------------------------
+=======================
Setting up a full-blown PKI with a CA certificate would arguably defeat the purpose
of site-to-site OpenVPN, since its main goal is supposed to be configuration simplicity,
@@ -129,7 +129,7 @@ Note: certificate names don't matter, we use 'openvpn-local' and 'openvpn-remote
Repeat the procedure on the other router.
Setting up OpenVPN
-------------------
+==================
Local Configuration:
@@ -148,6 +148,7 @@ Local Configuration:
set interfaces openvpn vtun1 tls certificate 'openvpn-local' # The self-signed certificate
set interfaces openvpn vtun1 tls peer-fingerprint <remote cert fingerprint> # The output of 'run show pki certificate <name> fingerprint sha256
on the remote rout
+
Remote Configuration:
.. code-block:: none
@@ -163,8 +164,9 @@ Remote Configuration:
set interfaces openvpn vtun1 tls certificate 'openvpn-remote' # The self-signed certificate
set interfaces openvpn vtun1 tls peer-fingerprint <local cert fingerprint> # The output of 'run show pki certificate <name> fingerprint sha256
on the local router
+
Pre-shared keys
----------------
+===============
Until VyOS 1.4, the only option for site-to-site OpenVPN without PKI was to use pre-shared keys.
That option is still available but it is deprecated and will be removed in the future.
@@ -200,6 +202,7 @@ Then you need to install the key on the remote router:
Then you need to set the key in your OpenVPN interface settings:
.. code-block:: none
+
set interfaces openvpn vtun1 shared-secret-key s2s
Firewall Exceptions
@@ -433,6 +436,7 @@ Branch 1's router might have the following lines:
set interfaces openvpn vtun10 tls ca-cert ca-1
set interfaces openvpn vtun10 tls certificate branch-1
+
Client Authentication
=====================