DOC: Proofread openvpn.rst (#1778)

* DOC: Proofread openvpn.rst

* Update openvpn.rst

1 files changed, 232 insertions, 183 deletions

diff --git a/docs/configuration/interfaces/openvpn.rst b/docs/configuration/interfaces/openvpn.rst
index e2d16caf..85877d48 100644
--- a/docs/configuration/interfaces/openvpn.rst
+++ b/docs/configuration/interfaces/openvpn.rst
@@ -4,93 +4,102 @@
 OpenVPN
 #######
 
-Traditionally hardware routers implement IPsec exclusively due to relative
-ease of implementing it in hardware and insufficient CPU power for doing
-encryption in software. Since VyOS is a software router, this is less of a
-concern. OpenVPN has been widely used on the UNIX platform for a long time and
-is a popular option for remote access VPN, though it's also capable of
-site-to-site connections.
+Traditionally, hardware routers use IPsec exclusively because it is easy to 
+implement in hardware, and their CPUs lack sufficient power for software-based 
+encryption. This limitation is less relevant for VyOS, as it is a software 
+router.
 
-Advantages of OpenVPN are:
+OpenVPN has been widely used on UNIX platforms for a long time and is a popular 
+choice for remote-access VPNs. It also supports site-to-site connections.
 
-* It uses a single TCP or UDP connection and does not rely on packet source
-  addresses, so it will work even through a double NAT: perfect for public
-  hotspots and such
+OpenVPN offers the following advantages:
 
-* It's easy to setup and offers very flexible split tunneling
+* It uses a single TCP or UDP connection and does not rely on packet source 
+  addresses, so it works even through double NAT. This makes it well-suited for 
+  public hotspots.
 
-* There's a variety of client GUI frontends for any platform
+* It is easy to set up and offers very flexible split tunneling.
 
-Disadvantages are:
+* A variety of client GUI frontends are available for any platform.
 
-* It's slower than IPsec due to higher protocol overhead and the fact it runs
-  in user mode while IPsec, on Linux, is in kernel mode
+Disadvantages include:
 
-* None of the operating systems have client software installed by default
+* It is slower than IPsec due to higher protocol overhead and because it runs 
+  in user mode, while IPsec on Linux runs in kernel mode.
 
-In the VyOS CLI, a key point often overlooked is that rather than being
-configured using the `set vpn` stanza, OpenVPN is configured as a network
-`interface using `set interfaces openvpn`.
+* No operating system includes OpenVPN client software by default.
+
+In the VyOS CLI, OpenVPN is configured as a network interface using ``set 
+interfaces openvpn`` rather than ``set vpn``, which is often overlooked.
 
 *************
 Configuration
 *************
 
-.. cfgcmd:: set interfaces openvpn <interface> authentication password  <text> 
+.. cfgcmd:: set interfaces openvpn <interface> authentication password <text> 
+
+   **Configure the password for the** ``auth-user-pass`` **authentication method.** 
+
+   This option applies only to OpenVPN clients.
 
-   Provide a password for auth-user-pass authentication method (client-only option)
+.. cfgcmd:: set interfaces openvpn <interface> authentication username <text>
 
-.. cfgcmd:: set interfaces openvpn <interface> authentication username  <text>
+   **Configure the username for the** ``auth-user-pass`` **authentication method.** 
 
-   Provide a username for auth-user-pass authentication method (client-only option)
+   This option applies only to OpenVPN clients.
 
 .. cfgcmd:: set interfaces openvpn <interface> description <description>
 
-   set description <text> for openvpn interface being configured
+   Configure the description for the OpenVPN interface.
 
-.. cfgcmd:: set interfaces openvpn <interface> device-type  <tap | tun>
+.. cfgcmd:: set interfaces openvpn <interface> device-type <tap | tun>
  
-   * ``tun`` - devices encapsulate IPv4 or IPv6 (OSI Layer 3), default value
-   * ``tap`` - devices encapsulate Ethernet 802.3 (OSI Layer 2).
+   **Configure the virtual network device type for the OpenVPN interface:**
 
+   * ``tun`` **(default)**: Operates at Layer 3, encapsulating IPv4 or IPv6 packets.
+   * ``tap``: Operates at Layer 2, encapsulating Ethernet 802.3 frames.
+ 
 .. cfgcmd:: set interfaces openvpn <interface> disable
 
-   Administratively disable interface
+   Disable the specific OpenVPN interface. 
 
 .. cfgcmd:: set interfaces openvpn <interface> encryption cipher < 3des | aes128 | aes128gcm | aes192 | aes192gcm | aes256 | aes256gcm | none >
 
-   Configure a single static encryption cipher for OpenVPN tunnels.
+   **Configure the static encryption cipher for the OpenVPN tunnel.**
+
+   The ``cipher`` option maps to OpenVPN’s ``--cipher`` directive and specifies 
+   the symmetric encryption algorithm for both control and data channels.
 
-   The ``cipher`` option directly maps to OpenVPN's ``--cipher`` directive and specifies
-   one symmetric encryption algorithm used for both control and data channels.
-   Historically, this was the default encryption method in all OpenVPN modes.
-   As of newer OpenVPN versions, this directive is considered **legacy** and
-   may only be used in compatibility scenarios.
+   This was previously the default encryption method in all OpenVPN modes. In 
+   newer OpenVPN versions, the ``--cipher`` directive is considered **legacy** 
+   and should be used only in compatibility scenarios.
 
 .. cfgcmd:: set interfaces openvpn <interface> encryption data-ciphers < 3des | aes128 | aes128gcm | aes192 | aes192gcm | aes256 | aes256gcm | none >
 
-   Configure a prioritized list of negotiated ciphers for use
-   with OpenVPN in *client* or *server* mode.
+   **Configure a prioritized list of negotiated ciphers for OpenVPN in** 
+   ``client`` **or** ``server`` **mode.**
 
-   The ``data-ciphers`` option represents a list of supported encryption algorithms.
-   It corresponds to OpenVPN's ``--data-ciphers`` directive and enables **cipher negotiation**,
-   where both peers automatically agree on a mutually supported cipher during session startup.
+   The ``data-ciphers`` option represents a list of supported encryption 
+   algorithms. It corresponds to OpenVPN’s ``--data-ciphers`` directive and 
+   enables cipher negotiation, where both peers automatically agree on a mutually 
+   supported cipher during session startup.
 
    .. note:: This option is not compatible with ``site-to-site`` mode.
 
 .. cfgcmd:: set interfaces openvpn <interface> encryption data-ciphers-fallback < 3des | aes128 | aes128gcm | aes192 | aes192gcm | aes256 | aes256gcm | none >
 
-   Define the fallback cipher for OpenVPN *site-to-site* tunnels.
+   **Configure the fallback cipher for** ``site-to-site`` **mode.**
 
-   The ``data-ciphers-fallback`` directive maps to OpenVPN's ``--data-ciphers-fallback`` option.
-   It specifies a single cipher to use when cipher negotiation is **not supported**.
-
-   .. note:: This option ensures consistent encryption setup between two static peers
-      that lack cipher negotiation capability.
+   The ``data-ciphers-fallback`` option maps to OpenVPN’s ``--data-ciphers-
+   fallback`` directive. It defines the cipher to use if negotiation is **not 
+   supported**.
+   
+   .. note:: This option ensures consistent encryption between two static peers 
+             without cipher negotiation capability.
 
 .. cfgcmd:: set interfaces openvpn <interface> hash <md5 | sha1 | sha256 | ...> 
 
-   Configure a secure hash algorithm
+   Configure the hashing algorithm for the OpenVPN interface.
 
 .. cmdinclude:: /_include/interface-ip.txt
    :var0: openvpn
@@ -102,75 +111,84 @@ Configuration
 
 .. cfgcmd:: set interfaces openvpn <interface> keep-alive failure-count <value>
 
-   Maximum number of keepalive packet failures. The default value is 60
+   **Configure the number of tolerated keepalive packet failures.**
+
+   Default: 60 consecutive failures.
 
 .. cfgcmd:: set interfaces openvpn <interface> keep-alive interval <value>
 
-   Send keepalive packet every interval seconds. Default value is 10
+   **Configure the frequency, in seconds, at which keepalive packets are sent.**
+
+   Default: 10 seconds.
 
 .. cfgcmd:: set interfaces openvpn <interface> local-address <address>
  
-   Define local IP address of tunnel (site-to-site mode only)
+   Configure the local tunnel IP address for ``site-to-site`` mode.
 
 .. cfgcmd:: set interfaces openvpn <interface> local-host <address>
 
-   Local IP address to accept connections. If specified, OpenVPN will bind to 
-   this address only. If unspecified, OpenVPN will bind to all interfaces.
+   **Configure the local IP address to accept connections.** 
+
+   If configured, OpenVPN binds to this IP address only. 
+
+   By default, OpenVPN binds to all interfaces.
 
 .. cfgcmd:: set interfaces openvpn <interface> local-port <port>
 
-   Define local port number to accept connections
+   Configure the local port to accept connections.
 
 .. cfgcmd:: set interfaces openvpn <interface> mirror egress <monitor-interface>
 
-   Configure port mirroring for interface outbound traffic and copy the traffic 
-   to monitor-interface
+   Configure mirroring of outgoing traffic from this OpenVPN interface to the 
+   designated monitor interface.
 
 .. cfgcmd:: set interfaces openvpn <interface> mirror ingress <monitor-interface>
 
-   Configure port mirroring for interface inbound traffic and copy the traffic 
-   to monitor-interface
+   Configure mirroring of incoming traffic from this OpenVPN interface to the 
+   designated monitor interface.
 
 .. cfgcmd:: set interfaces openvpn <interface> mode <site-to-site | server | client>
 
-   Define a mode for OpenVPN operation
+   **Configure OpenVPN operation mode:** 
 
-   * **site-to-site** - enables site-to-site VPN connection
-   * **client** - acts as client in server-client mode
-   * **server** - acts as server in server-client mode
+   * ``site-to-site``: Establishes a site-to-site VPN connection.
+   * ``client``: Operates as a client in server-client mode.
+   * ``server``: Operates as a server in server-client mode.
 
-.. cfgcmd:: set interfaces openvpn <interface> offload dco
 
-   OpenVPN Data Channel Offload (DCO) enables significant performance enhancement
-   in encrypted OpenVPN data processing. By minimizing context switching for each
-   packet, DCO effectively reduces overhead. This optimization is achieved by
-   keeping most data handling tasks within the kernel, avoiding frequent switches
-   between kernel and user space for encryption and packet handling.
+OpenVPN Data Channel Offload (DCO)
+==================================
+
+OpenVPN :abbr:`DCO (Data Channel Offload)` improves the performance of 
+encrypted OpenVPN data processing by keeping most data handling in the kernel 
+and avoiding frequent context switches between the kernel and user space.
+
+As a result, packet processing becomes more efficient and may utilize hardware 
+encryption offload support available in the kernel.
+   
+.. note:: 
+      
+   * :abbr:`DCO (Data Channel Offload)` is an **experimental**, not fully supported 
+     OpenVPN feature. Some OpenVPN features and deployment scenarios are **not 
+     compatible** with :abbr:`DCO (Data Channel Offload)`.
 
-   As a result, the processing of each packet becomes more efficient, 
-   potentially leveraging hardware encryption offloading support available in 
-   the kernel.
+     For a complete list of supported features, visit:
 
-   .. note:: OpenVPN DCO is not a fully supported OpenVPN feature, and is currently
-      considered experimental. Furthermore, there are certain OpenVPN features and
-      use cases that remain incompatible with DCO. To get a comprehensive
-      understanding of the limitations associated with DCO, refer to the list of
-      known limitations in the documentation.
+     https://community.openvpn.net/openvpn/wiki/DataChannelOffload/Features
 
-      https://community.openvpn.net/openvpn/wiki/DataChannelOffload/Features
+   * :abbr:`DCO (Data Channel Offload)` is configured per tunnel and disabled 
+     by default. Existing tunnels operate without :abbr:`DCO (Data Channel 
+     Offload)` unless it is explicitly enabled.
 
+   * Enabling :abbr:`DCO (Data Channel Offload)` resets the interface.
 
-   Enabling OpenVPN DCO
-   ====================
+**Best practice:** Create a new tunnel with :abbr:`DCO (Data Channel Offload)` 
+enabled to avoid compatibility issues with existing clients.
 
-   DCO support is a per-tunnel option and it is not automatically enabled by
-   default for new or upgraded tunnels. Existing tunnels will continue to function
-   as they have in the past.
+.. cfgcmd:: set interfaces openvpn <interface> offload dco
 
-   DCO can be enabled for both new and existing tunnels. VyOS adds an option in
-   each tunnel configuration where we can enable this function. The current best
-   practice is to create a new tunnel with DCO to minimize the chance of problems
-   with existing clients.
+   **Enable** :abbr:`DCO (Data Channel Offload)` **for the specified OpenVPN 
+   interface.**
 
    Example:
 
@@ -178,22 +196,25 @@ Configuration
 
      set interfaces openvpn vtun0 offload dco
 
-   Enable OpenVPN Data Channel Offload feature by loading the appropriate kernel
-   module.
-
-   Disabled by default - no kernel module loaded.
-
-   .. note:: Enable this feature causes an interface reset.
- 
+   This command enables :abbr:`DCO (Data Channel Offload)` and loads the required 
+   kernel module.
+    
 .. cfgcmd:: set interfaces openvpn <interface> openvpn-option <text>
  
-   OpenVPN has a lot of options, all of them are not included in VyOS CLI. 
-   If an option is missing, a feature request may be opened at Phabricator_ so 
-   all users can benefit from it (see :ref:`issues_features`). Alternatively,
-   use ``openvpn-option`` for passing raw OpenVPN options to openvpn.conf file.  
+   **Add raw OpenVPN configuration options to the openvpn.conf file.**
+   
+   OpenVPN provides many configuration options, but not all are available in the 
+   VyOS CLI. 
 
-   .. note:: Please use this only as last resort - things might break and OpenVPN 
-      won’t start if you pass invalid options/syntax. Check system logs for errors.
+   If a required option is missing, you may submit a feature request at 
+   Phabricator so all users can benefit from it (see :ref:`issues_features`). 
+
+   Alternatively, use ``openvpn-option`` to pass raw OpenVPN configuration options 
+   to the openvpn.conf file. 
+
+   .. warning:: Use this option only as a last resort. Invalid options or syntax 
+      may prevent OpenVPN from starting. Check system logs for errors after applying 
+      changes.
 
    Example:
 
@@ -201,56 +222,59 @@ Configuration
 
      set interfaces openvpn vtun0 openvpn-option 'persist-key'
 
-   This will add ``persist-key`` to the generated OpenVPN configuration. This 
-   option solves the problem by persisting keys across resets, so they 
-   don't need to be re-read.
+   This command adds ``persist-key`` to the configuration file. This solves the 
+   problem by persisting keys across resets, so they do not need to be re-read.
 
    .. code-block:: none
 
      set interfaces openvpn vtun0 openvpn-option 'route-up &quot;/config/auth/tun_up.sh arg1&quot;'
 
-   This will add ``route-up "/config/auth/tun_up.sh arg1"`` to the generated OpenVPN
-   config file. This option is executed after connection authentication, either
-   immediately after, or some number of seconds after as defined. The path and 
-   arguments need to be single- or double-quoted.
+   This command adds ``route-up "/config/auth/tun_up.sh arg1"`` to the 
+   configuration file. This option is executed after connection authentication, 
+   either immediately or after a short delay, as defined. 
 
-   .. note:: Sometimes option lines in the generated OpenVPN configuration require
-      quotes. This is done through a hack on our config generator. You can pass
-      quotes using the ``&quot;`` statement.
+   Ensure the path and arguments are enclosed in single or double quotes.
+
+   .. note:: Some raw configuration options require quotes. To include them, use 
+      the &quot; statement.
 
 .. cfgcmd:: set interfaces openvpn <interface> persistent-tunnel
 
-   This option prevents the TUN/TAP device from closing or reopening on 
-   connection resets or daemon reloads.
+   **Enable always-active mode for the TUN/TAP device.**
+
+   When enabled, the TUN/TAP device remains active upon connection resets or 
+   daemon reloads.
 
 .. cfgcmd:: set interfaces openvpn <interface> protocol <udp | tcp-passive | tcp-active >
 
-   Define a protocol for OpenVPN communication with remote host
+   **Configure the protocol for OpenVPN communication with a remote host:**
 
- * **udp** - default protocol is udp when not defined
- * **tcp-passive** - TCP protocol and accepts connections passively
- * **tcp-active** - TCP protocol and initiates connections actively
+   * ``udp`` **(default)**: Uses the UDP protocol.
+   * ``tcp-passive``: Uses the TCP protocol and accepts connections passively.
+   * ``tcp-active``: Uses the TCP protocol and initiates connections actively.
 
 .. cfgcmd:: set interfaces openvpn <interface> redirect <interface>
 
-   This option redirects incoming packets to destination
+   Enable redirection of incoming packets to the specified interface.
 
 .. cfgcmd:: set interfaces openvpn <interface> remote-address <address>
 
-   Define remote IP address of tunnel (site-to-site mode only)
+   Configure the remote tunnel IP address for site-to-site mode.
 
 .. cfgcmd:: set interfaces openvpn <interface> remote-host <address | host>
 
-   Define an IPv4/IPv6 address or hostname of server device if OpenVPN is being 
-   run in client mode, and is undefined in server mode.
+   **Configure the IPv4/IPv6 address or hostname for a server device if OpenVPN 
+   runs in client mode.**
+
+   This setting is not used in server mode.
 
 .. cfgcmd:: set interfaces openvpn <interface> remote-port <port>
 
-   Define a remote port number to connect to server
+   Configure the remote port to connect to the server.
 
 .. cfgcmd:: set interfaces openvpn <interface> replace-default-route 
 
-   This option will make OpenVPN tunnel to be used as the default route   
+   Configure the OpenVPN tunnel as the default route.    
 
 .. cfgcmd:: set interfaces openvpn <interface> server bridge disable
 
@@ -258,204 +282,229 @@ Configuration
 
 .. cfgcmd:: set interfaces openvpn <interface> server bridge gateway <ipv4 address>
 
-   Define a gateway ip address
+   Configure the gateway IP address.
 
 .. cfgcmd:: set interfaces openvpn <interface> server bridge start <ipv4 address>
 
-   First IP address in the pool to allocate to connecting clients
+   Configure the first IP address in the pool to allocate to connecting clients.
 
 .. cfgcmd:: set interfaces openvpn <interface> server bridge stop <ipv4 address>
 
-   Last IP address in the pool to allocate to connecting clients
+   Configure the last IP address in the pool to allocate to connecting clients.
 
 .. cfgcmd:: set interfaces openvpn <interface> server bridge subnet-mask <ipv4 subnet mask>
 
-   Define subnet mask pushed to dynamic clients.
+   Configure the subnet mask pushed to dynamic clients.
 
 .. cfgcmd:: set interfaces openvpn <interface> server client <name>
 
-   Define the common name specified in client certificate
+   Configure the Common Name (CN) specified in the client certificate.
 
 .. cfgcmd:: set interfaces openvpn <interface> server client <name> disable
 
-   Disable the client connection
+   Disable the client connection.
 
 .. cfgcmd:: set interfaces openvpn <interface> server client <name> ip <address>
 
-   Set a specific IPv4/IPv6 address to the client
+   Configure the IPv4/IPv6 address for the client.
 
 .. cfgcmd:: set interfaces openvpn <interface> server client <name> push-route <subnet>
 
-   Define a route to be pushed to a specific client 
+   Configure a route to be pushed to the specific client. 
 
 .. cfgcmd:: set interfaces openvpn <interface> server client <name> subnet <subnet>
 
-   Define this option to route a fixed subnet from the server to a particular 
-   client. Used as OpenVPN iroute directive.
+   **Configure a fixed subnet to be routed from the server to the specified 
+   client.** 
+
+   Used as OpenVPN’s ``iroute`` directive.
 
 .. cfgcmd:: set interfaces openvpn <interface> server client-ip-pool start <address>
 
-   Define a first IP address from IPv4 pool of subnet to be dynamically 
-   allocated to connecting clients   
+   Configure the first IP address in the subnet's IPv4 pool to be dynamically 
+   allocated to connecting clients.   
 
 .. cfgcmd:: set interfaces openvpn <interface> server client-ip-pool stop <address>
 
-   Define a last IP address from IPv4 pool of subnet to be dynamically allocated 
-   to connecting clients
+   Configure the last IP address in the subnet's IPv4 pool to be dynamically 
+   allocated to connecting clients.
 
 .. cfgcmd:: set interfaces openvpn <interface> server client-ip-pool subnet <netmask>
 
-   Define a subnet mask pushed to dynamic clients. This option is only used for 
-   device type tap, not to be used with bridged interfaces.
+   **Configure the subnet mask pushed to dynamic clients.** 
+
+   Use this command only for the TAP device type. Do not use it for bridged 
+   interfaces.
 
 .. cfgcmd:: set interfaces openvpn <interface> server client-ipv6-pool base <ipv6addr/bits>
 
-   Define an IPv6 address pool for dynamic assignment to clients
+   Configure the IPv6 address pool for dynamic assignment to clients.
 
 .. cfgcmd:: set interfaces openvpn <interface> server domain-name <name>
 
-   DNS suffix to be pushed to all clients
+   Configure the DNS suffix to be pushed to all clients.
 
 .. cfgcmd:: set interfaces openvpn <interface> server max-connections <1-4096>
 
-   Define the maximum number of client connections
+   Configure the maximum number of client connections.
 
 .. cfgcmd:: set interfaces openvpn <interface> server mfa totp challenge <enable | disable>
 
-   If set to enable, openvpn-otp will expect password as result of challenge/
+   If enabled, openvpn-otp expects a password as a result of the challenge/
    response protocol.
 
 .. cfgcmd:: set interfaces openvpn <interface> server mfa totp digits <1-65535>
 
-   Configure number of digits to use for totp hash (default: 6)
+   **Configure the number of digits to use for the** :abbr:`TOTP (Time-based 
+   One-Time Password)` **hash.** 
+
+   Default: 6.
 
 .. cfgcmd:: set interfaces openvpn <interface> server mfa totp drift <1-65535>
 
-   Configure time drift in seconds (default: 0)
+   **Configure the time drift in seconds.** 
+
+   Default: 0.
 
 .. cfgcmd:: set interfaces openvpn <interface> server mfa totp slop <1-65535>
 
-   Configure maximum allowed clock slop in seconds (default: 180)
+   **Configure the allowed clock slop in seconds.**
+
+   Default: 180.
 
 .. cfgcmd:: set interfaces openvpn <interface> server mfa totp step <1-65535>
 
-   Configure step value for totp in seconds (default: 30)
+   **Configure the step value for** :abbr:`TOTP (Time-based One-Time Password)`
+   **in seconds.**
+
+   Default: 30.
 
 .. cfgcmd:: set interfaces openvpn <interface> server name-server <address>
 
-   Define Client DNS configuration to be used with the connection
+   Define the client DNS configuration to be used with the connection.
 
 .. cfgcmd:: set interfaces openvpn <interface> server push-route <subnet>
 
-   Define a route to be pushed to all clients   
+   Configure the route to be pushed to all clients.   
 
 .. cfgcmd:: set interfaces openvpn <interface> server reject-unconfigured-client
 
-   Reject connections from clients that are not explicitly configured 
+   Reject connections from clients that are not explicitly configured. 
 
 .. cfgcmd:: set interfaces openvpn <interface> server subnet <subnet>
 
-   Manadatory field to define in server mode, set ipv4 or ipv6 network
+   **Configure the IPv4 or IPv6 network.** 
+
+   This parameter is mandatory when operating in server mode.
 
 .. cfgcmd:: set interfaces openvpn <interface> server topology < net30 | point-to-point | subnet>
 
-   Define virtual addressing topology when running in ``tun`` mode. This directive 
-   has no meaning in ``tap`` mode, which always uses a subnet topology.
+   **Configure the virtual addressing topology for** ``tun`` **mode.**
 
-   * **subnet** - This topology is the current recommended and default topology.
-     This mode allocates a single IP address per connecting client.
-   * **net30** - This is the old topology for support with Windows clients, by 
-     allocating one /30 subnet per client. It is effictively depcrecated.
-   * **point-to-point** - Use a point-to-point topology where the remote endpoint
-     of the client's tun interface always points to the local endpoint of the 
-     server's tun interface. This mode allocates a single IP address per connecting 
-     client. Only use when none of the connecting clients are Windows systems.
+   This command does not affect ``tap`` mode, which always uses the ``subnet`` 
+   topology.
+
+   * ``subnet`` **(default)**: Allocates a single IP address to each connecting client. 
+     This is the recommended topology.
+   * ``net30``: Allocates a /30 subnet to each connecting client. This is a legacy 
+     topology used to support Windows clients. It is now effectively deprecated.
+   * ``point-to-point``: Creates a point-to-point topology where the remote 
+     endpoint of the client’s ``tun`` interface always points to the local endpoint  
+     of the server’s ``tun`` interface.
+
+     Like ``subnet``, this topology allocates a single IP address per client. Use it 
+     only if no clients run Windows operating systems.
 
 
 .. cfgcmd:: set interfaces openvpn <interface> shared-secret-key <key>
 
-   Define a static secret key, used with site-to-site OpenVPN option only
+   Configure the static secret key for a site-to-site OpenVPN connection.
 
 .. cfgcmd:: set interfaces openvpn <interface> tls auth-key <key>
 
-   Define a tls secret key for tls-auth which adds an additional HMAC signature 
-   to all SSL/TLS handshake packets for integrity verification. Use ``run generate pki openvpn shared-secret install <name>`` to generate the key. 
+   **Configure the TLS secret key for tls-auth.**
+
+   This adds an HMAC signature to all SSL/TLS handshake packets to verify 
+   integrity.
+
+   Use ``run generate pki openvpn shared-secret install <name>`` to generate 
+   the key. 
 
 .. cfgcmd:: set interfaces openvpn <interface> tls ca-certificate <name>
 
-   Define Certificate Authority chain in PKI configuration
+   Configure the Certificate Authority chain in the PKI configuration.
 
 .. cfgcmd:: set interfaces openvpn <interface> tls certificate <name>
 
-   Define a name of certificate in PKI configuration
+   Configure the certificate name in the PKI configuration.
 
 .. cfgcmd:: set interfaces openvpn <interface> tls crypt-key
 
-   Define a shared secret key to provide an additional level of security, 
-   a variant similar to tls-auth
+   Configure a shared secret key to provide an additional level of security, 
+   a variant similar to tls-auth.
 
 .. cfgcmd:: set interfaces openvpn <interface> tls dh-params
 
-   Define Diffie Hellman parameters, required only on server mode 
+   Configure Diffie-Hellman parameters for server mode. 
 
 .. cfgcmd:: set interfaces openvpn <interface> tls peer-fingerprint <text>
 
-   Peer certificate SHA256 fingerprint, configured in site-to-site mode
+   Configure the peer certificate SHA256 fingerprint for site-to-site mode.
 
 .. cfgcmd:: set interfaces openvpn <interface> tls role <active | passive>
 
-   Define a role for TLS negotiation, preferably used in site-to-site mode
+   **Configure the TLS negotiation role, preferably used in site-to-site mode:**
 
-   * **active** - Initiate TLS negotiation actively
-   * **passive** - Wait for incoming TLS connection
+   * ``active``: Initiates TLS negotiation actively.
+   * ``passive``: Waits for incoming TLS connections.
 
-.. cfgcmd:: set interfaces openvpn <interface> tls tls-version-min <1.0 | 1.1 | 1.2 | 1.4 >
+.. cfgcmd:: set interfaces openvpn <interface> tls tls-version-min <1.0 | 1.1 | 1.2 | 1.3 >
 
-   This option sets the minimum TLS version which will accept from the peer
+   Configure the minimum TLS version to be accepted from the peer.
 
-.. cfgcmd:: set interfaces openvpn <interface>  use-lzo-compression
+.. cfgcmd:: set interfaces openvpn <interface> use-lzo-compression
 
-   Use fast LZO compression on this TUN/TAP interface
+   Configure fast LZO compression on this TUN/TAP interface.
 
 .. cfgcmd:: set interfaces openvpn <interface> vrf <name>
 
-   Place interface in given VRF instance.
+   Assign the interface to a specific VRF instance.
 
 **************
-Operation Mode
+Operation mode
 **************
 
 .. opcmd:: show openvpn site-to-site
 
-   Show tunnel status for OpenVPN site-to-site interfaces
+   Show tunnel status for OpenVPN site-to-site interfaces.
 
 .. opcmd:: show openvpn server
 
-   Shows tunnel status for Openvpn server interfaces
+   Show tunnel status for OpenVPN server interfaces.
 
 .. opcmd:: show openvpn client
 
-   Shows tunnel status for OpenVPN client interfaces
+   Show tunnel status for OpenVPN client interfaces.
 
 .. opcmd:: show log openvpn
 
-   Show logs for all OpenVPN interfaces
+   Show logs for all OpenVPN interfaces.
 
 .. opcmd:: show log openvpn interface <interface>
 
-   Show logs for specific OpenVPN interface
+   Show logs for the specific OpenVPN interface.
 
 .. opcmd:: reset openvpn client <text>
 
-   Reset specified OpenVPN client
+   Reset the specified OpenVPN client.
 
 .. opcmd:: reset openvpn interface <interface>
 
-   Reset OpenVPN process on specified interface
+   Reset the OpenVPN process on the specified interface.
 
 .. opcmd::  generate openvpn client-config interface <interface> ca <name> certificate <name> 
 
-   Generate OpenVPN client configuration file in ovpn format to load in client machines
+   Generate an OpenVPN client configuration file in the .ovpn format for client machines.
 
 ********
 Examples