diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-10-07 20:05:14 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-10-07 20:05:14 +0200 |
| commit | d7180eee731b58b664b1691173a4d2e8bbc206c3 (patch) | |
| tree | 8dd85cd841d2b9080465b330e6ee66f56f19b55c /docs | |
| parent | de45e02be519513c45229db2f9d1db6cc759970d (diff) | |
| parent | e9248b8dd0f202499149a25c806a034289b7a21e (diff) | |
| download | vyos-documentation-d7180eee731b58b664b1691173a4d2e8bbc206c3.tar.gz vyos-documentation-d7180eee731b58b664b1691173a4d2e8bbc206c3.zip | |
Merge pull request #2324 from mandelbitdev/T9370-openvpn-chacha20poly1305
openvpn: T9370: document the chacha20poly1305 data cipher
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/configuration/interfaces/openvpn.md | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/docs/configuration/interfaces/openvpn.md b/docs/configuration/interfaces/openvpn.md index da39fd00..2c31ea80 100644 --- a/docs/configuration/interfaces/openvpn.md +++ b/docs/configuration/interfaces/openvpn.md @@ -79,7 +79,7 @@ and should be used only in compatibility scenarios. ``` -```{cfgcmd} set interfaces openvpn \<interface\> encryption data-ciphers \< 3des | aes128 | aes128gcm | aes192 | aes192gcm | aes256 | aes256gcm | none \> +```{cfgcmd} set interfaces openvpn \<interface\> encryption data-ciphers \< 3des | aes128 | aes128gcm | aes192 | aes192gcm | aes256 | aes256gcm | chacha20poly1305 | none \> **Configure a prioritized list of negotiated ciphers for OpenVPN in** ``client`` **or** ``server`` **mode.** @@ -89,13 +89,16 @@ algorithms. It corresponds to OpenVPN’s ``--data-ciphers`` directive and enables cipher negotiation, where both peers automatically agree on a mutually supported cipher during session startup. +`chacha20poly1305` selects ChaCha20-Poly1305, which DCO offloads just like +the AES-GCM ciphers. + :::{note} This option is not compatible with ``site-to-site`` mode. ::: ``` -```{cfgcmd} set interfaces openvpn \<interface\> encryption data-ciphers-fallback \< 3des | aes128 | aes128gcm | aes192 | aes192gcm | aes256 | aes256gcm | none \> +```{cfgcmd} set interfaces openvpn \<interface\> encryption data-ciphers-fallback \< 3des | aes128 | aes128gcm | aes192 | aes192gcm | aes256 | aes256gcm | chacha20poly1305 | none \> **Configure the fallback cipher for** ``site-to-site`` **mode.** |