openvpn(8) System Manager's Manual openvpn(8) (NAME) openvpn - IP (VPN) (SYNOPSIS) openvpn [ options ... ] openvpn --help (INTRODUCTION) OpenVPN VPN James Yonan . OpenVPN VPN . OpenVPN VPN . OpenVPN : openvpn openvpn . (DESCRIPTION) OpenVPN VPN . OpenVPN SSL/TLS (ethernet bridging) TCP UDP NAT IP DHCP . OpenVPN OpenSSL . OpenVPN ( Static Key) ( SSL/TLS) . OpenVPN TCP/UDP . OpenVPN TUN/TAP . OpenVPN IPSec . (OPTIONS) OpenVPN . ("--") . (Generic Options) OpenVPN . --help . --auth-nocache / --askpass --auth-user-pass . OpenVPN / . OpenVPN / stdin OpenVPN . --auth-nocache / --chroot --daemon . --cd dir dir . dir "/" . .. . OpenVPN --daemon OpenVPN . --chroot dir chroot dir . --chroot dir (/) . OpenVPN . . chroot OpenVPN chroot . dir chroot . : SSL /dev/urandom chroot dir . SSL . BSD getrandom() getentropy() /dev/urandom . --compat-mode version OpenVPN version . . OpenVPN OpenVPN . OpenVPN . OpenVPN 2.6.0 2.5.x 2.4.x . . : . . o 2.5.x : --allow-compression asym . o 2.4.x : --cipher --data-ciphers . o 2.3.x : --data-ciphers-fallback --cipher . o 2.3.6 : --tls-version-min --tls-version-min 1.0 . . data-channel offloading . --config file file -- . --config file openvpn --config openvpn file . . ("" '') "#" ";" . OpenVPN 2.0 : \\ Maps to a single backslash character (\). \" Pass a literal doublequote character ("), don't interpret it as enclosing a parameter. \[SPACE] Pass a literal space or tab character, don't interpret it as a parameter delimiter. Windows : secret "c:\\OpenVPN\\secret.key" : # # Sample OpenVPN configuration file for # using a pre-shared static key. # # '#' or ';' may be used to delimit comments. # Use a dynamic tun device. dev tun # Our remote peer remote mypeer.mydomain # 10.1.0.1 is our local VPN endpoint # 10.1.0.2 is our remote VPN endpoint ifconfig 10.1.0.1 10.1.0.2 # Our pre-shared static key secret static.key --daemon progname . : daemon daemon progname syslog ( /var/log/messages) ifconfig /dev/null . syslog --daemon . --log syslog . progname OpenVPN progname . OpenVPN syslog . progname openvpn . OpenVPN --daemon . openvpn . OpenVPN . : OpenVPN . --askpass OpenVPN . --daemon --auth-user-pass ( ) --auth-nocache ( ) . --disable-occ " " (OCC) TLS . . --dev tun --dev tap . OpenVPN . --engine engine-name OpenSSL. : engine engine engine-name engine-name . --show-engines OpenSSL . --group group --user (GID) OpenVPN group . --ignore-unknown-option args : ignore-unknown-option opt1 opt2 opt3 ... optN opt1 ... optN OpenVPN . --ignore-unknown-option . OpenVPN . . --ignore-unknown-option OpenVPN 2.3.3 . --iproute cmd iproute2. OpenVPN . --keying-material-exporter args Exported Keying Material [RFC5705] len ( ) label (exported_keying_material) OPENVPN_PLUGIN_TLS_FINAL. : keying-material-exporter label len labels PRF . EXPORTER . --mlock POSIX mlockall. OpenVPN root ( OpenVPN --user (UID) ). . OpenVPN swap (ephemeral) --reneg ( ) . --mlock . . (RLIMIT_MEMLOCK) . ulimit systemd OpenVPN . getrlimit(2) OpenVPN mlockall(2) mlock . - OpenVPN . --nice n (n 0 n ). --providers providers (OpenSSL). tpm2-openssl legacy : --providers legacy default SIGHUP . // OpenVPN . --remap-usr1 signal SIGUSR1 SIGHUP ( ) SIGTERM () . signal SIGHUP SIGTERM . . --script-security level (policy) OpenVPN . level . level: 0 . 1 () ifconfig ip route netsh. 2 . 3 ( ). OpenVPN v2.3 method OpenVPN . execve system . OpenVPN 2.3 . --up . (space) . . .exe .com .bat .cmd . Visual Basic : --up 'C:\\Windows\\System32\\wscript.exe C:\\Program\ Files\\OpenVPN\\config\\my-up-script.vbs' (\\) . --setcon context context SELinux . SELinux OpenVPN I/O . --user --chroot (privilege escalation) . setcon /proc chroot ( mount --bind). setcon OpenVPN context ( OpenVPN SELinux Reference Policies ) . chroot setcon --persist-tun . --status args file n . n 60 . : status file status file n SIGUSR2 syslog . - (multi-client) . --status-version . point-to-point . --status-version n n. multi-client . : 1 (). : Common Name Real Address Bytes Received Bytes Sent Connected Since. 2 . 1 : Virtual Address Virtual IPv6 Address Username Client ID Peer ID Data Channel Cipher. . 3 2 (tab) . --test-crypto (self-test) OpenVPN . (peer) --dev --remote . --test-crypto : openvpn --test-crypto openvpn --test-crypto --verb 9 OpenVPN () OpenSSL OpenVPN . . OpenVPN --secret . . --tmp-dir dir dir TMPDIR ( "/tmp" ) . (root privileges) . : o --client-connect OPENVPN_PLUGIN_CLIENT_CONNECT client_connect_config_file / client_connect_deferred_file (deferred) o OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY / auth_control_file auth_pending_file . --use-prediction-resistance (prediction resistance) RNG mbed TLS . RNG (reseed) . (entropy pool) . . --user user (User ID) OpenVPN user . OpenVPN . OpenVPN . user openvpn . OpenVPN . OpenVPN SIGUSR1 ( DHCP) --persist OpenVPN ( ifconfig TUN). : openvpn nobody . . openvpn . --writepid file (PID) OpenVPN file . (Log options) --echo parms parms (echo) . OpenVPN . --errors-to-stderr stdout stderr --log . --log file file stdout/stderr . file (truncate) . --daemon syslog . OpenVPN SIGHUP SIGUSR1 --ping-restart . OpenVPN . --log-append file file . file . --log . --machine-readable-output . stdout . --mute n n . . --mute-replay-warnings (replay) WiFi . . --suppress-timestamps . stdout . --syslog progname (syslog) . progname --daemon . --verb n (verbosity) n ( 1). . 3 . 0 . 1 4 . 5 R W TCP/UDP TUN/TAP . 6 11 (debug) ( errlevel.h ). (Protocol options) (wire protocol) . OpenVPN . . --allow-compression mode --compress . OpenVPN . mode : asym OpenVPN . . no () OpenVPN . (data-channel offloading) OpenVPN (stub) . yes asym . OpenVPN . --auth alg ( ) tls-auth HMAC alg. ( SHA1 ). HMAC (MAC) . OpenVPN encrypt-then-mac ( HMAC ) padding oracle . AEAD ( GCM) --auth AEAD . alg tls-auth . (static-key) HMAC --genkey . TLS HMAC TLS . OpenVPN HMAC (drop). HMAC . alg=none . HMAC . --cipher alg TLS : o o OpenVPN 2.6.0 --cipher . MTU/ . 2.4.0 . 2.6.0 TLS . --data-ciphers ( ) --data-ciphers-fallback ( ) . OpenVPN --show-ciphers . alg none . --compress algorithm . . VPN VORACLE . migrate . algorithm lzo lz4 lz4-v2 stub stub-v2 migrate . LZO LZ4 LZ4 CPU . lz4-v2 stub-v2 . . stub-v2 IP tun ( ) . ( migrate ) algorithm stub stub-v2 push . stub stub-v2 lzo lz4 IV_ . : stub ( ) --comp-lzo no . migrate . --compress/--comp-lzo . . ( OCC) --push compress stub-v2 comp-lzo no --push comp-lzo . * * . ( ) . CRIME BREACH TLS VORACLE VPN . . OpenVPN . VPN . --comp-lzo mode LZO. . VPN VORACLE . LZO . . OpenVPN . mode yes no adaptive . --comp-noadapt OpenVPN . --key-direction direction --tls-auth. ( ). --data-ciphers cipher-list cipher-list. cipher-list (:) Chacha20-Poly1305 AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305 AES-256-GCM:AES-128-GCM . cipher-list push . Data channel cipher negotiation . OpenVPN 2.4 ! OpenVPN 2.6 ? . . AES-256-GCM:AES-128-GCM:?CHACHA20-POLY1305 Chacha20-Poly1305 SSL ( ) . OpenVPN 2.7 DEFAULT . DEFAULT:AES-192-CBC AES-192-CBC. - . --mode server ( --server ) --pull ( --client ). . / --data-ciphers-fallback . --compat-mode 2.5.0 --cipher --data-ciphers . OpenVPN . OpenVPN 2.4 --ncp-ciphers OpenVPN 2.5 --data-ciphers . --data-ciphers-fallback alg (cipher) (peer) . OpenVPN 2.3 --enable-small ( ). --allow-deprecated-insecure-static-crypto OpenVPN TLS . OpenVPN 2.8 . --tran-window n -- ( 3600 ). . --force-tls-key-material-export --mode server Keying Material Exporters (RFC 5705) . . OpenVPN . (Client Options) OpenVPN --server --server-bridge --mode server . --allow-pull-fqdn DNS ( IP) --ifconfig --route --route-gateway . --allow-recursive-routing OpenVPN tun (drop ). --auth-token token --client-connect --plugin OPENVPN_PLUGIN_CLIENT_CONNECT OPENVPN_PLUGIN_CLIENT_CONNECT_V2 (push) . OpenVPN . --auth-user-pass-verify --plugin OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY . . . OpenVPN AUTH_FAILED . HOTP TOTP OTP . . --client-connect --plugin push "auth-token UNIQUE_TOKEN_VALUE" / . OpenVPN UNIQUE_TOKEN_VALUE . (+2.4.7) . --auth-retry . --auth-token-user base64username --auth-token. auth-token . --auth-token . base64 . --auth-user-pass /. : auth-user-pass auth-user-pass up up / username-only . OpenVPN . up / . username [password] . username-only SSO . . [[BLANK]] . / management-notes.txt . . username-only / . 'no_passsword' . --static-challenge dynamic challenge . --auth-user-pass-verify / . --auth-retry type OpenVPN / AUTH_FAILED . (fatal) / . AUTH_FAILED --auth-user-pass --client-connect . type : none ( ). nointeract / --auth-user-pass . (unattended) . interact / --auth-user-pass / . push . --client OpenVPN. : pull tls-client --client-nat args push NAT (stateless) ( ) ifconfig (pushed) IP . : client-nat snat|dnat network netmask alias : client-nat snat 192.168.0.0 255.255.0.0 10.64.0.0 client-nat dnat 10.64.0.0 255.255.0.0 192.168.0.0 network netmask ( 192.168.0.0 255.255.0.0) alias ( 10.64.0.0) netmask . snat ( NAT ) dnat ( NAT ) . / --verb 6 . --connect-retry args n ( 1). remote . : connect retry n connect retry n max max ( 300). --connect-retry-max n n --remote . n 1 . ( unlimited). --connect-timeout n --server-poll-timeout . --dns args DNS . : dns search-domains domain [domain ...] dns server n address addr[:port] [addr[:port] ...] dns server n resolve-domains domain [domain ...] dns server n dnssec yes|optional|no dns server n transport DoH|DoT|plain dns server n sni server-name --dns search-domains DNS . . --dns server DNS n . n -128 127 . DNS server (pushed) 0 127 . DNS . DNS DNS . . address () IPv4 / IPv6 DNS . DNS . . IPv6 () . resolve-domains DNS split-dns dns-routing (resolve) . DNS . dnssec DNSSEC . (resolvers) yes no optional . transport DNS-over-HTTPS (DoH) DNS-over-TLS (DoT) DNS . sni server-name TLS server name indication . . . . . --dns --dhcp-option . --dhcp-option --dns --dhcp-option . --dns --dhcp-option . : 1. tap-windows6 DNS DHCP . --dns search-domains --dns server n address .. n . --dns . dco . 2. --dns server n resolve-domains DNS n search-domains . DNS NRPT split-DNS . --explicit-exit-notify n UDP -- (point-to-point) OpenVPN / . / (timeout) . . (offloaded) . n ( 1) . UDP RESTART . n ( 1) . n = 1 n = 2 . OpenVPN . --inactive args OpenVPN n TUN/TAP . . 0 . : inactive n inactive n bytes bytes n bytes / tun/tap . OpenVPN ( keepalive ) TLS "" OpenVPN . : FreeBSD DCO . keepalive bytes . --proto-force p (connection profiles) p (tcp | udp) . UDP TCP . IPv4 IPv6 IP . 4 6 ( udp4 / udp6 / tcp4 / tcp6). . --pull . OpenVPN (push ) ( --pull --client ). --pull (routes) --pull --client . --pull-filter args . : pull-filter accept text pull-filter ignore text pull-filter reject text text . accept ignore reject SIGUSR1 . . . . text pull-filter ignore "route" route route-gateway . text . pull-filter accept "route 192.168.1." pull-filter ignore "route " 192.168.1 . reject . ignore . : pull-filter . . --push-peer-info . : IV_VER= OpenVPN IV_PLAT=[linux|solaris|openbsd|mac|netbsd|freebsd|win] IV_PROTO . : o : o : peer-id o : push-reply push-request . o : RFC5705 . o : AUTH_PENDING . o : P2P o : --dns o : EXIT . protocol-flags EKM o : AUTH_FAILED,TEMP o : tls-crypt o : data epoch IV_NCP=2 --cipher AES-GCM-128 AES-GCM-256 . IV_NCP IV_CIPHERS . IV_CIPHERS= --data-ciphers . IV_MTU= MTU MTU . IV_GUI_VER= de.blinkt.openvpn 0.5.47 . / --setenv . IV_SSO=[crtext,][openurl,][proxy_url] . / --setenv . . . IV_LZO=1 LZO . IV_LZO_STUB=1 LZO stub . IV_LZO=1 . --comp-lzo no . IV_LZ4=1 and IV_LZ4v2=1 LZ4 . IV_COMP_STUB=1 and IV_COMP_STUBv2=1 stub . --compress . --push-peer-info : IV_HWADDR= . (ASCII) . OpenVPN 2.x MAC . . IV_SSL= SSL OpenSSL 1.0.2f 28 Jan 2016. IV_PLAT_VER=x.y 6.1 Windows 7. / --setenv . Windows openvpn . OpenVPN uname() release . . UV_= UV_ . --remote args IP . : remote host remote host port remote host port proto port proto . OpenVPN host:port . proto tcp udp . IPv4 IPv6 4 6 udp4 / udp6 / tcp4 / tcp6. --remote OpenVPN --remote . --remote (connection-profile) . . . OpenVPN . : remote server1.example.net remote server1.example.net 1194 remote server2.example.net 1194 tcp : UDP --ping --ping-restart . --remote root --user / --group TUN/TAP (route) TUN/TAP . . --remote OpenVPN IP . IP ( IP UDP ). TCP --remote host . host DNS IP OpenVPN getaddrinfo() DNS . IP ( 4/6) OpenVPN IPv4 IPv6 getaddrinfo() . --remote-random / --remote . --remote-random-hostname ( /hex) DNS . "foo.bar.gov" ".foo.bar.gov" . --resolv-retry n --remote n . n infinite . --resolv-retry infinite . n=0 . --preresolve --remote --local --http-proxy --socks-proxy . OpenVPN . VPN DNS DNS ( DNS64/NAT64) . --single-session . . --ping-restart . --single-session --ping-exit --inactive . --server-poll-timeout n n . 120 . TCP . --static-challenge args / : static-challenge text echo [format] text . echo . echo 0 1 . format SCRV1 (format = scrv1) (format = concat). scrv1 . / OpenVPN management-notes.txt OpenVPN . --http-proxy args HTTP. server port . Proxy-Authenticate HTTP authfile stdin . --http-proxy-user-pass ( INLINE FILE SUPPORT ). auth-method none basic ntlm2 . HTTP Digest auto auto-nct ( ). authfile . auto OpenVPN auth-method / stdin . OpenVPN . . auto-nct ( ) OpenVPN HTTP Basic Authentication . : # no authentication http-proxy proxy.example.net 3128 # basic authentication, load credentials from file http-proxy proxy.example.net 3128 authfile.txt # basic authentication, ask user for credentials http-proxy proxy.example.net 3128 stdin # NTLM authentication, load credentials from file http-proxy proxy.example.net 3128 authfile.txt ntlm2 # determine which authentication is required, ask user for credentials http-proxy proxy.example.net 3128 auto # determine which authentication is required, but reject basic http-proxy proxy.example.net 3128 auto-nct # determine which authentication is required, but set credentials http-proxy proxy.example.net 3128 auto http-proxy-user-pass authfile.txt # basic authentication, specify credentials inline http-proxy proxy.example.net 3128 "" basic username password NTLMv1 OpenVPN 2.7 . ntlm ntlm2 OpenVPN NTLMv2 . --http-proxy-user-pass userpass / --http-proxy. ( INLINE FILE SUPPORT ) / . --http-proxy . : username password --http-proxy-option args HTTP. type parameter . . VERSION version HTTP version ( 1.0). AGENT user-agent "User-Agent" HTTP user-agent. CUSTOM-HEADER name content name content HTTP . : http-proxy-option VERSION 1.1 http-proxy-option AGENT OpenVPN/2.4 http-proxy-option X-Proxy-Flag some-flags --socks-proxy args Socks5. server . port ( 1080) authfile . authfile stdin . OpenVPN 2.0 TCP/UDP (multi-client) --mode server . OpenVPN (port) . tun tap . . SSL/TLS . --auth-gen-token args . : auth-gen-token [lifetime] [renewal-time] [external-auth] / OpenVPN (push). (renegotiation) OpenVPN . / . HMAC . lifetime . . 0 . renewal-time reneg-sec . lifetime * renewal-time . TLS . renewal-time reneg-sec reneweal-time . . (OTP) / auth-token . external-auth auth-token . auth-token . . session_id auth-gen-token . session_state . auth-token . : Initial . Authenticated . Expired . Invalid ( HMAC ). AuthenticatedEmptyUser / ExpiredEmptyUser ( ) . OpenVPN 3 . Invalid . : . . auth-token / (Invalid/Expired) external-auth ( ) ( ). (Expired) () . : --auth-gen-token --override-username . --auth-token-user . --auth-gen-token-secret file HMAC --auth-gen-token . file OpenVPN . auth-token auth-token OpenVPN . --auth-user-pass-optional / . --auth-user-pass-verify --management-client-auth ( ) OpenVPN . / ( X509) / . / / ("") . / . --ccd-exclusive --client-config-dir . --client-config-dir dir dir . OpenVPN common name X509 . . OpenVPN "DEFAULT" . root OpenVPN . IP --ifconfig-push --iroute . . : --push --push-reset --push-remove --iroute --ifconfig-push --vlan-pvid --config. : OpenVPN CN . . OpenVPN CN ( Windows macOS ) . CN . CA . --client-to-client OpenVPN tun tap . --client-to-client OpenVPN -- TUN/TAP . " ". . . data channel offload . . --disable ( common name). . CRL ( ) ( --crl-verify ). --client-config-dir --client-connect . --connect-freq args n sec . : connect-freq n sec DoS . --connect-freq-initial --tls-crypt-v2 ( allow-noncookie --tls-crypt-v2) . DoS . DoS --proto udp --tls-auth --tls-crypt . --connect-freq-initial args ( UDP) n sec OpenVPN . : connect-freq-initial n sec OpenVPN 2.6 . OpenVPN . OpenVPN . . . --duplicate-cn (common name) . OpenVPN . --ifconfig-pool args DHCP . : ifconfig-pool start-IP end-IP [netmask] tun /30 ( ). tap netmask (push) . --ifconfig-ipv6-pool args IPv6 . : ifconfig-ipv6-pool ipv6addr/bits ipv6addr IPv4 . IPv6 0 ipv6addr +1 . --ifconfig-pool-persist args ifconfig-pool seconds ( 600) file / . : ifconfig-pool-persist file [seconds] ( ) IP ifconfig-pool . --persist-tun . file ASCII ,. seconds = 0 file . file . OpenVPN IP . IP . --ifconfig-push . --ifconfig-push args IP (push) --ifconfig-pool . : ifconfig-push local remote-netmask [alias] local remote-netmask --ifconfig . local remote-netmask . IP DNS (resolve) . alias NAT . local/remote-netmask alias/remote-netmask . --client-config-dir --client-connect . --route local OpenVPN TUN/TAP . IP OpenVPN : 1. --client-connect IP ( ). 2. --client-config-dir IP ( ). 3. --ifconfig-pool IP ( ). DCO IP --ifconfig OpenVPN /32 IP local . --ifconfig-ipv6-push args IPv6 --client-config-dir --client-config-dir --ifconfig-push . : ifconfig-ipv6-push ipv6addr/bits ipv6remote DCO IP --ifconfig-ipv6 OpenVPN /128 IP ipv6addr . --multihome [same-interface] UDP (multi-homed) . IP ( IP ) --local . UDP . . : o UDP . o 2.7.0 OpenVPN / ("set ipi_ifindex=0"). o same-interface OpenVPN (index) (= OpenVPN). . o BSD* IPv4 API (IP_RECVDSTADDR) IPv6 . --iroute args . netmask 255.255.255.255 . : iroute network [netmask] . ( --route). --route OpenVPN . OpenVPN --iroute . DCO --iroute DCO . --route VPN ( ). --client-config-dir --client-connect . --iroute --push "route ..." . --iroute ( A ). A --push "route ..." --client-to-client . A OpenVPN A (push) A . OpenVPN iroute . --iroute-ipv6 args IPv6 --client-config-dir --iroute --route --iroute . : iroute-ipv6 ipv6addr/bits --max-clients n n . 1024 . --max-routes-per-client n n ( 256). DoS MAC (flood) . --client-config-dir --client-connect . OpenVPN . --override-username username . --auth-gen-token . --client-config-dir --auth-user-pass-verify --client-connect . --username-as-common-name common-name . --username-as-common-name --override-username . --auth-gen-token . --auth-gen-token --auth-token-user (push) . --override-username . . --override-username / . --auth-gen-token . --auth-token / --auth-token-user . --port-share args TCP OpenVPN : port-share host port [dir] TCP OpenVPN HTTPS . OpenVPN OpenVPN host:port . HTTP/HTTPS ssh . dir N C C IP:port N IP:port . . . Windows . --push option . option ("") . --pull . . . TLS MTU . : --route --route-gateway --route-delay --redirect-gateway --ip-win32 --dhcp-option --dns --inactive --ping --ping-exit --ping-restart --setenv --auth-token --persist-tun --echo --comp-lzo --socket-flags --sndbuf --rcvbuf --session-timeout : --push OpenVPN --mode server ( --server --server-bridge) . --push-remove opt --push "opt" . opt --push-remove route --push route ... --push route-ipv6 ... --push-remove "route-ipv6 2001:" IPv6 2001:... . --push-remove --client-config-dir --client-connect - --push-reset . : --push-remove --push . : 'ifconfig' 'ifconfig-ipv6' (push-remove ifconfig) IPv4/IPv6 . --push-reset push . --client-config-dir . --push . : --push-reset : . - --topology subnet --route-gateway . --push-remove push . --server args OpenVPN. OpenVPN / . .1 TUN/TAP . nopool IP VPN . : server network netmask [nopool] --server 10.8.0.0 255.255.255.0 : mode server tls-server push "topology [topology]" if dev tun AND (topology == net30 OR topology == p2p): ifconfig 10.8.0.1 10.8.0.2 if !nopool: ifconfig-pool 10.8.0.4 10.8.0.251 route 10.8.0.0 255.255.255.0 if client-to-client: push "route 10.8.0.0 255.255.255.0" else if topology == net30: push "route 10.8.0.1" if dev tap OR (dev tun AND topology == subnet): ifconfig 10.8.0.1 255.255.255.0 if !nopool: ifconfig-pool 10.8.0.2 10.8.0.253 255.255.255.0 push "route-gateway 10.8.0.1" if route-gateway unset: route-gateway 10.8.0.2 --server . --server-bridge . --server-bridge args --server OpenVPN . : server-bridge gateway netmask pool-start-IP pool-end-IP server-bridge [nogw] --server-bridge DHCP OpenVPN IP TAP DHCP LAN OpenVPN . DHCP TAP ( Windows) . nogw () . TAP . brctl Windows XP Network Connections Panel TAP "Bridge Connections" . IP/netmask . gateway netmask --server-bridge IP/netmask IP/netmask / . IP pool-start-IP pool-end-IP OpenVPN . server-bridge 10.8.0.4 255.255.255.0 10.8.0.128 10.8.0.254 : mode server tls-server ifconfig-pool 10.8.0.128 10.8.0.254 255.255.255.0 push "route-gateway 10.8.0.4" --server-bridge ( ) : mode server tls-server push "route-gateway dhcp" --server-bridge nogw : mode server tls-server --server-ipv6 args IPv6 --ifconfig-ipv6 --ifconfig-ipv6-pool --push tun-ipv6. : server-ipv6 ipv6addr/bits --tun-ipv6 --tun-ipv6 . --stale-routes-check args n ( ). t ( ) . : stale-routes-check n [t] t n . . --iroute ifconfig . . --max-routes-per-client . --username-as-common-name common-name common-name. --auth-user-pass . --auth-user-pass common-name . common_name ( client-connect) client-config . --verify-client-cert mode . mode : none . / . . --auth-user-pass-verify VPN . --verify-client-cert none --client-cert-not-required . optional . --auth-user-pass-verify . --auth-user-pass-verify VPN . require . VPN . ( --verify-client-cert require ) --auth-user-pass-verify OpenVPN . VPN --auth-user-pass-verify . --vlan-tagging . OpenVPN IEEE 802.1Q VLAN . TAP . (untagged) TAP --vlan-accept VLAN . 802.1Q "tagged" . VLAN ( VID) "VLAN-tagged" . VID Priority Control Point ( PCP) "prio-tagged" . 802.1Q "untagged" . --vlan-pvid v ( --client-config-dir ) VID . VID . VID --client-to-client . OpenVPN . VLAN . --vlan-tagging . OpenVPN VLAN . --dev tap mode . --vlan-accept args VLAN TAP . : vlan-accept all|tagged|untagged : tagged VLAN . VLAN TAP . untagged . VLAN TAP --vlan-pvid . all () . untagged tagged . Note: tagged "trunk ports" untagged "access ports" . PVID VLAN VID --vlan-pvid . PVID ( --vlan-pvid) . --vlan-pvid v "port" VLAN . --vlan-tagging . VLAN . VLAN TAP . --vlan-accept untagged --vlan-accept all . v 1 4094 . 1 . --vlan-pvid . PVID "Native VLAN" . SSL --show-ciphers () --cipher. --show-digests () --auth. --show-tls () TLS . OpenVPN TLS VPN . TLS () . ( RSA ECDSA ). --show-engines () OpenSSL . --show-groups () / --ecdh-curve tls-groups. --genkey args () keytype. keyfile stdout . keytype . : --genkey keytype keyfile keytype : secret OpenVPN tls-crypt secret tls-auth secret auth-token --auth-gen-token-key tls-crypt-v2-server TLS Crypt v2 tls-crypt-v2-client TLS Crypt v2 : $ openvpn --genkey secret shared.key $ openvpn --genkey tls-crypt shared.key $ openvpn --genkey tls-auth shared.key $ openvpn --genkey tls-crypt-v2-server v2crypt-server.key $ openvpn --tls-crypt-v2 v2crypt-server.key --genkey tls-crypt-v2-client v2crypt-client-1.key o Shared Secret Keys --tls-auth --tls-crypt. : $ openvpn --genkey tls-crypt|tls-auth keyfile keyfile . (tls-crypt tls-auth) . . scp(1) . o TLS Crypt v2 Server key --tls-crypt-v2 OpenVPN . keyfile . : --genkey tls-crypt-v2-server keyfile o TLS Crypt v2 Client key --tls-crypt-v2 OpenVPN . keyfile . --genkey tls-crypt-v2-client keyfile [metadata] metadata . base64 . ( base64 base64 ). OpenVPN UTC . tls-crypt-v2 . --tls-crypt-v2 . --tls-crypt-v2-verify . o Authentication Token key --auth-gen-token-secret . : --genkey auth-token [keyfile] : OpenVPN . OpenVPN / . --reneg-bytes n n ( ). OpenVPN / . . --reneg-bytes 64MB 0 SWEET32 . --cipher . (DCO) . DCO . --reneg-pkts n n ( ). (DCO) . DCO . --reneg-sec args max ( 3600) min ( max max ). reneg-sec max [min] --reneg-sec min max . 3600 3240 .. 3600 . . . --reneg-sec 3600 3600 . --reneg-sec 0 ( ) . TLS TLS OpenVPN . TLS TCP/UDP (multiplex) . OpenVPN TLS HMAC . TLS UDP . : UDP HMAC TLS - (Diffie Hellman forward secrecy) . TLS (peer) OpenVPN / (--cert --key) --ca . OpenVPN . --ca . TLS OpenVPN . OpenVPN RSA : --askpass file file . : askpass askpass file . OpenVPN . --askpass OpenVPN . . openssl -nodes . file file . . --ca file (CA) pem. root () . pem. . : openssl req -nodes -new -x509 -keyout ca.key -out ca.crt openssl.cnf certificate ca.crt . OpenVPN CA (ca.crt) . OpenVPN OpenVPN . --capath dir (CA CRL). mbed TLS . CA capath . . CRL .r . -CApath openssl verify -hash openssl x509 openssl crl X509_LOOKUP_hash_dir()(3) . --crl-verify CRL - CRL OpenVPN . --cert file|uri pem. URI -- --ca file . URI OpenSSL 3.0 (providers) . URI (syntax) . OpenSSL URI "" "file:" OpenSSL ( PEM PKCS12) . PKCS#11 URI (RFC 7512) pkcs11-provider . OpenVPN TLS . --ca . ( ) thawte.com ( :). : openssl req -nodes -new -keyout mycert.key -out mycert.csr (mycert.csr) ( ). : openssl ca -out mycert.crt -in mycert.csr (mycert.crt) csr. ( ). openssl ca /usr/share/ssl/openssl.cnf -- index.txt ( ) serial ( 01) . --crl-verify args (CRL). : crl-verify file/directory flag : crl-verify crl-file.pem crl-verify /etc/openvpn/crls dir CRL ( ) PKI . PKI CA . . CRL PKI . PKI . - CRL OpenVPN - : VERIFY WARNING: depth=0, unable to get certificate CRL . dir crl-verify ( ). ( ) . Note: ( ) crl root --user . --dh file Diffie Hellman .pem ( --tls-server ). file none Diffie Hellman ( ECDH X25519MLKEM768 ). SSL TLS ECDH ( OpenSSL 1.0.1+ mbed TLS 2.0+) . 2.7.0 --dh . Diffie Hellman openssl dhparam -out dh2048.pem 2048 none Diffie Hellman ECDH . Diffie Hellman . --ecdh-curve name Diffie Hellman . --show-curves . TLS ECDH . mbed TLS OpenVPN . --extra-certs file file PEM ( ) . (CA) "" CA CA . ca . --hand-window n (Handshake Window) -- TLS n ( 60 ). . --tran-window . --hand-window OpenVPN pull . --key file|uri .pem URI. ( --cert file ). URI OpenSSL 3.0 (providers) . ( --cert ). --ns-cert-type type --remote-cert-tls . . . nsCertType . TLS . . --pkcs12 file PKCS #12 CA . --ca --cert --key . mbed TLS . --remote-cert-eku oid extended key usage ( ) . . oid notation OpenSSL symbolic representation . --remote-cert-ku key-usage key-usage ( ) . keyUsage TLS TLS . ( TLS ). key-usage keyUsage key-usage . key-usage : remote-cert-ku a0 --remote-cert-tls type key usage extended key usage TLS RFC3280 . : remote-cert-tls server remote-cert-tls client . . --remote-cert-tls client : remote-cert-ku remote-cert-eku "TLS Web Client Authentication" --remote-cert-tls server : remote-cert-ku remote-cert-eku "TLS Web Server Authentication" (man-in-the-middle) . --remote-cert-tls --verify-x509-name --peer-fingerprint --tls-verify . --tls-auth args HMAC TLS DoS TLS. : tls-auth file tls-auth file 0 tls-auth file 1 --tls-auth " HMAC" TCP/UDP OpenVPN TLS HMAC . file () OpenVPN --genkey . ( OpenVPN 2.3) . (v2.4+) . direction (HMAC-send HMAC-receive) HMAC . DoS (replay) . direction . direction 0 1 . direction file . . OpenVPN OpenVPN direction --genkey . --tls-auth OpenVPN IP --remote --remote --float . . TLS . OpenVPN ( CPU) . OpenVPN OpenSSL . ( ) . . OpenVPN . . OpenVPN TLS HMAC (replay) . DoS ( ) . DoS . --tls-auth TLS HMAC TLS . (handshake) TLS . --tls-auth --replay-persist OpenVPN . --tls-auth TLS . . TLS --tls-crypt . --tls-groups list / . / TLS. . mbedTLS . OpenSSL 1.1+ : "X25519:secp256r1:X448:secp521r1:secp384r1". . ecdh --ecdh-curve ecdh . OpenVPN secp256r1 prime256v1 tls-groups mbedTLS OpenSSL . : TLS 1.3 TLS 1.3 . --tls-cert-profile profile profile. : insecure mbed TLS legacy legacy () SHA1 RSA . preferred SHA2 RSA . suiteb SHA256/SHA384 ECDSA P-256 P-384. mbed TLS . OpenSSL : insecure "security level 0" legacy () "security level 1" preferred "security level 2" suiteb "security level 3" --tls-cipher "SUITEB128" . OpenVPN 'preferred' . . : --tls-cipher --tls-ciphersuites tls-groups - - VPN . . ! --tls-cipher l l TLS (":") . ( ) TLS . OpenVPN TLS VPN . ( OpenSSL/IANA) . OpenSSL mbed TLS . OpenSSL --tls-cipher TLS 1.2 . TLS --show-tls . --tls-cipher mbed TLS mbed TLS DEFAULT:!EXP:!LOW:!MEDIUM:!kDH:!kECDH:!DSS:!PSK:!SRP:!kRSA OpenSSL . --tls-ciphersuites l --tls-cipher TLS 1.3 . mbed TLS TLS 1.3 --tls-cipher . --tls-ciphersuites . --tls-client TLS (handshake) TLS. --tls-crypt keyfile keyfile. ( --tls-auth .) ( ) : o TLS o OpenVPN o - "" ( ) . --tls-auth --tls-crypt --key-direction . --tls-crypt . IV 2^48 2^48 . . ( ) 2^16 (65536) () (/) tls-crypt . . ( .) IV --tls-crypt --tls-auth . DoS - TLS . --tls-crypt-v2 . ' ' . --tls-crypt-v2 keyfile : tls-crypt-v2 keyfile tls-crypt-v2 keyfile force-cookie tls-crypt-v2 keyfile allow-noncookie tls-crypt . keyfile tls-crypt . --genkey tls-crypt-v2-client . keyfile (unwrap) . ( --genkey tls-crypt-v2-client ). --tls-auth --tls-crypt . . force-cookie tls-crypt-v2 (stateless) (replay attacks) (state exhaustion) (OpenVPN 2.6 ). allow-noncookie tls-crypt-v2 . ( ) allow-noncookie . --tls-crypt-v2-verify cmd cmd tls-crypt-v2 . TLS ( X.509 ASN.1) . OpenVPN ( ): o script_type tls-crypt-v2-verify . o metadata_type 0 1 . o metadata_file . . --tls-crypt-v2-max-age n tls-crypt-v2 n . --tls-exit TLS. . ( OpenVPN .) --tls-server TLS TLS. OpenVPN . TLS . --tls-timeout n TLS n ( 2). OpenVPN n TCP . . ( ) OpenVPN TCP . --tls-version-min args TLS ( 2.6.0 "1.2" ). : tls-version-min version ['or-highest'] version 1.0 1.1 1.2 . or-highest version TLS SSL . --tls-version-max version TLS ( ). version 1.0 1.1 1.2 . --verify-hash args SHA1 SHA256 . : verify-hash hash [algo] CA ( ) (leaf) . hash . XX:XX:... . : AD:B0:95:D8:09:C8:36:45:12:A9:89:C8:90:09:CB:13:72:A6:AD:16 algo SHA1 SHA256 . SHA1 . 00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff 11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00 algo SHA256 . --peer-fingerprint args SHA256 SHA256 . . (inline) : peer-fingerprint AD:B0:95:D8:09:... : 00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff 11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00 --peer-fingerprint CA --ca --capath . --peer-fingerprint PKI . . --verify-x509-name args X.509 name . . : verify-x509 name type X.509 name type . type subject DN () name RDN name-prefix RDN . RDN name --x509-username-field . common name (CN) subject DN C=KG, ST=NA, L=Bishkek, CN=Server-1 : verify-x509-name 'C=KG, ST=NA, L=Bishkek, CN=Server-1' verify-x509-name Server-1 name verify-x509-name Server- name-prefix Server-1 Server-2 . --verify-x509-name --tls-verify --verify-x509-name --chroot . CRL ( ) . : OpenVPN CA . name-prefix CA . --x509-track attribute attribute X509 . + attribute . ( 0 ) . X509__= . --x509-track . attribute Subject X509 X509v3 (RFC 3280) . X509v3 TLS ( OpenSSL) . SHA1 SHA256 tls_digest_{n} tls_digest_sha256_{n} . Subject X509 . --x509-track . : x509-track CN # exports only X509_0_CN x509-track +CN # exports X509_{n}_CN for chain x509-track basicConstraints # exports value of "X509v3 Basic Constraints" x509-track SHA256 # exports SHA256 fingerprint --x509-username-field args (Subject) X.509 ( CN). _ . : x509-username-field [ext:]fieldname [[ext:]fieldname...] fieldname : x509-username-field emailAddress x509-username-field 1.2.840.113549.1.9.1 x509-username-field ext:subjectAltName x509-username-field CN serialNumber emailAddress Subject oid . ext: X.509 fieldname subjectAltName rfc822Name () . ext:fieldname . CN Subject _ serialNumber . --verify-x509-name Common Name fieldname . X.509 subjectAltName issuerAltName X.509 serialNumber . _ ( ) _ . PKCS#11 / (SmartCard) --pkcs11-cert-private args . . : pkcs11-cert-private 0 pkcs11-cert-private 1 --pkcs11-id name (id) . --show-pkcs11-ids . --pkcs11-providers . --pkcs11-id-management PKCS#11 (management interface). NEED-STR 'pkcs11-id-request' pkcs11-id-count pkcs11-id-get . --pkcs11-providers . --pkcs11-pin-cache seconds PIN . --pkcs11-private-mode mode . . : 0 () . 1 sign. 2 sign recover. 4 decrypt. 8 unwrap. --pkcs11-protected-authentication args PKCS#11 . . : pkcs11-protected-authentication 0 pkcs11-protected-authentication 1 --pkcs11-providers providers RSA Security Inc. PKCS #11 (Cryptoki) . . --pkcs11-id pkcs11-id-management --cert --key --pkcs12 . p11-kit --pkcs11-id --pkcs11-id-management --pkcs11-providers p11-kit-proxy.so . . --show-pkcs11-ids args () PKCS#11. : show-pkcs11 [provider] [cert_private] cert_private 1 . p11-kit provider p11-kit-proxy.so . --verb . 2.4 OpenVPN . . OpenVPN 2.5 OpenVPN 2.5 --data-ciphers . --data-ciphers . AUTH_FAILED ( ): AUTH: Received control message: AUTH_FAILED,Data channel cipher negotiation failed (no shared cipher) 2.5 OpenVPN --data-ciphers . --data-ciphers AES-256-GCM:AES-128-GCM . 2.6 Chacha20-Poly1305 AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305 . 2.6 OpenVPN --compat-mode 2.4.x ( ) OpenVPN 2.5 --cipher . OpenVPN 2.4 OpenVPN 2.4 . " AES-256-GCM " . OpenVPN 2.4 AES GCM --ncp-disable AES-256-GCM AES-128-GCM IV_NCP=2 . --ncp-ciphers AES-256-GCM:AES-128-GCM . OpenVPN AES-256-GCM AES-128-GCM . AES-256-GCM AES-128-GCM --ncp-ciphers . OpenVPN 3 OpenVPN 3.x () --ncp-ciphers --data-ciphers . AES-CBC BF-CBC DES-CBC . AEAD (AES-256-GCM AES-128-GCM Chacha20-Poly1305) . OpenVPN 3.x --data-ciphers . OpenVPN 2.3 ( --ncp-disable) --cipher --data-ciphers . AUTH_FAILED . 2.3 --enable-small ./configure data-ciphers-fallback cipher . OpenVPN 2.4 AES-128-GCM AES-256-GCM ( IV_NCP=2) OpenVPN 2.4 --ncp-ciphers OpenVPN . OpenVPN 2.4 AES-128-GCM AES-256-GCM --data-ciphers . OpenVPN 2.5+ IV_NCP=2 . OpenVPN 2.3 ( --ncp-disable) --data-ciphers . ( OpenVPN 2.5 --cipher ) 2.3 --enable-small ./configure --data-ciphers-fallback cipher . Blowfish CBC (BF-CBC) --cipher OpenVPN 2.4 BF-CBC . . OpenVPN 2.5 --cipher BF-CBC --cipher BFC-CBC --data-ciphers . BF-CBC . (NETWORK CONFIGURATION) OpenVPN . (link) ( tun/tap) . (Link Options) . --bind keywords (Bind) . --proto tcp-client --http-proxy --socks-proxy . ipv6only OpenVPN IPv6 IPv6 ( IPv6 IPv4) . --float IP / DHCP NAT. --float UDP . --float --remote OpenVPN . dial-in DHCP . --float OpenVPN --remote . --fragment args : fragment max fragment max mtu UDP max . mtu max IP UDP . mtu 2.6.0 OpenVPN . mtu max --link-mtu UDP UDP. --fragment UDP (--proto udp). --fragment . --mssfix --fragment . UDP IP . MTU (path MTU discovery) . MTU IP IP . OpenVPN' (multicast) UDP . --keepalive args --ping --ping-restart . : keepalive interval timeout interval timeout . . timeout . --ping --ping-restart (push) . . timeout . . --keepalive 10 60 : if mode server: ping 10 # Argument: interval ping-restart 120 # Argument: timeout*2 push "ping 10" # Argument: interval push "ping-restart 60" # Argument: timeout else ping 10 # Argument: interval ping-restart 60 # Argument: timeout --link-mtu n UDP OpenVPN . . IP ( IPv4 IPv6) . tun-mtu . --local args : local host|* [port] [protocol] IP bind. OpenVPN (bind) . OpenVPN . '*' ' ' (OpenVPN ). -- ( ). OpenVPN --server / . '*' " " " IPv4" "0.0.0.0" " IPv6" '::' . --local --bind . --lport port TCP/UDP . --nobind . 0 " bind() " IP --local . --mark value value . mark (policy routing) (packetfilter) . . --mode m OpenVPN . OpenVPN -- (p2p) . OpenVPN 2.0 (server) . --mssfix args : mssfix max [mtu] mssfix max [fixed] mssfix TCP OpenVPN UDP OpenVPN max . 1492 mtu . mssfix 0 max . mtu max VPN IP UDP . mtu 2.6.0 OpenVPN . mtu max --link-mtu UDP UDP. IPv4 IPv6 (/ IP UDP). 1450 OpenVPN MTU 1478 IP ( 1498 IPv6). fixed OpenVPN VPN MSS IP (payload) . IPv4 MSS mssfix - 40 IPv6 mssfix - 60 . --mssfix --fragment --mssfix . --mssfix UDP -- OpenVPN --proto udp. --mssfix --fragment --mssfix TCP ( TCP) --fragment . --max-packet-size --fragment --mssfix Path MTU OpenVPN . OpenVPN . --fragment --mssfix --mssfix max --fragment max . UDP 1300 ( MTU): --tun-mtu 1500 --fragment 1300 --mssfix max-packet-size size mssfix size mtu . --mtu-disc type MTU (Path MTU discovery) TCP/UDP . : no DF (Don't Fragment) maybe yes DF (Don't Fragment) --mtu-test MTU --mtu-test . OpenVPN . --mtu-test . --nobind (bind) . IP . --remote . --passtos TOS TOS (payload) . --ping n n TCP/UDP ( --ping OpenVPN IP ). n . : 1. (stateful). UDP OpenVPN (time out) . 2. --ping-exit. OpenVPN --keepalive . --ping-exit n OpenVPN n . --inactive --ping --ping-exit . n . openvpn [options...] --inactive 3600 --ping 10 --ping-exit 60 OpenVPN . --ping-restart n --ping-exit n SIGUSR1 . n . IP DNS TTL IP DNS ddclient . --remote ( --resolv-retry ). --ping-restart --inactive . . --ping-restart . ( --keepalive ) . --ping-restart 0 . SIGUSR1 . SIGUSR1 --persist-tun --persist-local-ip --persist-remote-ip . --ping-exit --ping-restart . --ping-timer-rem --ping-exit / --ping-restart . ( --remote) . --proto p p . p udp tcp-client tcp-server . p udp4 tcp4-client tcp4-server udp6 tcp6-client tcp6-server OpenVPN IPv4 IPv6 . --proto udp . UDP --proto udp . TCP --proto tcp-server --proto tcp-client . tcp-server . tcp-client ( --connect-retry) N ( --connect-retry-max) . TCP SIGUSR1 . OpenVPN UDP TCP UDP . UDP TCP . IP TCP : TCP IP UDP . --port port TCP/UDP ( --lport --rport ). 1194 IANA OpenVPN 2.0-beta17 . 5000 . --rport port TCP/UDP --remote. --remote . --replay-window args (replay protection). : replay-window n replay-window n t n t . n 64 ( IPSec) t 15 . UDP --proto udp --proto . OpenVPN IP UDP . OpenVPN IPSec TCP/IP . a. . b. n . c. t . ( ) n . . OpenVPN --verb 4 "PID_ERR replay-window backtrack occurred [x]" . n . . IP IPSec OpenVPN . OpenVPN IPSec . OpenVPN TCP ( IPSec ) OpenVPN : . TCP . IP UDP ( IP ) TCP . IP UDP UDP IP . TCP VPN . --replay-persist file file . ( ) OpenVPN . () TLS --tls-auth . --session-timeout n n SIGTERM OpenVPN . OpenVPN . --client-config-dir --client-connect . . --socket-flags flags OpenVPN. TCP_NODELAY . TCP_NODELAY TCP TCP . . 2.7.6 OpenVPN TCP_NODELAY TCP . --tcp-nodelay TCP_NODELAY TCP . --mode server socket-flags TCP_NODELAY (push) 2.7.6 . . : if mode server: push "socket-flags TCP_NODELAY" --max-packet-size size OpenVPN --mssfix (on-write) . OpenVPN . 1250 . 154 2048 . UDP IP . --mssfix : mssfix size mtu --mssfix --max-packet-size --mssfix . 1250 IPv6 MTU 1280 . ( VPN) tun/tap IP VPN . --bind-dev device ( ) device Virtual Routing and Forwarding (VRF) --block-ipv6 IPv6 VPN IPv6 ICMPv6 no route host . IPv6 ICMPv6 no route to host . IPv6 . --block-ipv6 IPv6 ICMPv6 fe80::7 . tun . IPv6 OpenVPN no route to host IPv6 ( IPv6 dual-stack VPN IPv4 ). Client config --ifconfig-ipv6 fd15:53b6:dead::2/64 fd15:53b6:dead::1 --redirect-gateway ipv6 --block-ipv6 Server config ipv6 <<>> --push "ifconfig-ipv6 fd15:53b6:dead::2/64 fd15:53b6:dead::1" --push "redirect-gateway ipv6" --block-ipv6 : ( ). IPv6 tun . --dev device TUN/TAP tunX tapX null (X .) --dev --dev-type OpenVPN tun tunX . TUN . tun tap. : tun IPv4 IPv6 ( OSI) tap Ethernet 802.3 ( OSI). : dev tun2 dev tap4 dev ovpn tun tap . tunN ( tun2 tun30) tapN ( tap3) tun/tap - OpenVPN . "numbered tap" --dev tap3 . ( --dev tun-home) FreeBSD ( DCO tun) ( tun tap DCO tun/tap) . tun tap ( tun-home) OpenVPN . --dev-type tun --dev-type tap . Windows tun tap . --dev-node . --dev-node node tun/tap . tun/tap /dev/net/tun --dev-node ... . Mac OS X tun . --dev-node utun Darwin tun . --dev-node utunN utun . tun.kext (/dev/tunX) --dev-node tun . --dev-node openvpn utun tun.kext . TAP-Win32 Network Connections Control Panel node GUID . --show-adapters TAP-Win32 GUID TAP-Win32 . --dev-node node tun/tap . OpenVPN node TUN TAP --dev-type tun --dev-type tap . node unix: openvpn . OpenVPN (unix domain socket) tun . TUNTAP_SOCKET_FD . unix: lwipovpn (). --dev-type device-type device-type tun ( OSI) tap ( OSI) . TUN/TAP --dev tun tap . --dhcp-option args . (push) . tap-windows6 dhcp OpenVPN . OpenVPN for Android . --up foreign_option_{n} . --up . tunnelblick . : dhcp-option type [parm] DOMAIN name DNS name. ADAPTER_DOMAIN_SUFFIX name DOMAIN. . DOMAIN-SEARCH name name . . . DNS address IPv4 IPv6 (DNS) . DNS . : DNS IPv6 netsh ( DHCP DHCP IPv4 IPv4 ). --up . WINS address WINS ( NetBIOS TCP/IP). WINS . NBDD address NBDD ( NetBIOS TCP/IP). NBDD . NTP address NTP ( ). NTP . NBT type NetBIOS TCP/IP. : 1 b-node ( ) 2 p-node ( WINS) 4 m-node ( ) 8 h-node ( ). NBS scope-id (Scope) NetBIOS TCP/IP. NetBIOS NetBIOS TCP/IP ( NBT) . NetBIOS NetBIOS NetBIOS . NetBIOS NetBIOS . NetBIOS . NetBIOS . NetBIOS . ( NetBIOS ) DISABLE-NBT Netbios-over-TCP/IP. code PROXY_HTTP host port HTTP VPN . OpenVPN for Android . --ifconfig args TUN/TAP. IP VPN . TUN -- (point-to-point) IP VPN . TAP TUN --topology subnet . TUN IP -- ( --topology net30 p2p) --ifconfig IP . IP . VPN rn VPN . TAP TUN --topology subnet ( " " ) --ifconfig IP . (ethernet bridge) IP ( DHCP ). ifconfig(8) TUN/TAP ifconfig . --ifconfig IP DNS /etc/hosts . TAP TAP IP DHCP --ifconfig . : # tun device in net30/p2p mode ifconfig 10.8.0.2 10.8.0.1 # tun/tap device in subnet mode ifconfig 10.8.0.2 255.255.255.0 --ifconfig-ipv6 args IPv6 tun. : ifconfig-ipv6 ipv6addr/bits [ipv6remote] ipv6addr/bits IPv6 . (gateway) --route-ipv6 . --topology --ifconfig-ipv6 . --ifconfig-noexec ifconfig/netsh --ifconfig . --ifconfig-nowarn --ifconfig . ( --disable-occ ) ifconfig . --ifconfig --ifconfig-nowarn . " " . --lladdr address (link layer address) MAC . TAP . --persist-tun SIGUSR1 --ping-restart TUN/TAP up/down . SIGUSR1 SIGHUP . OpenVPN (root) CAP_NET_ADMIN . --persist-tun IP/ ( / ). --redirect-gateway flags IP VPN. . : 1. --remote . (3) . 2. . 3. VPN ( --route-gateway --ifconfig --dev tun ). . : local OpenVPN ( ) local . local (1) . autolocal local . def1 0.0.0.0/1 128.0.0.0/1 0.0.0.0/0. . bypass-dhcp DHCP ( ) ( ). bypass-dns () DNS ( ) ( ). block-local LAN LAN. LAN ( LAN) . WFP VPN . TunnelCrack (: ). ipv6 IPv6 . def1 IPv6 (2000::/4 3000::/4) IPv6 . !ipv4 IPv4 - ipv6 !ipv4 IPv6 . --redirect-private flags --redirect-gateway (default gateway) . (push) . --route-table id (id) --route. OpenVPN . ( ). --route args . . TUN/TAP . : route network/IP route network/IP netmask route network/IP netmask gateway route network/IP netmask gateway metric route(8) OpenVPN . netmask 255.255.255.255 gateway --route-gateway --ifconfig --dev tun . metric --route-metric 0 . default . network gateway DNS /etc/hosts : vpn_gateway VPN ( --route-gateway --ifconfig --dev tun ). net_gateway IP ( ). remote_host --remote OpenVPN . --route-delay args : route-delay route-delay n route-delay n w n ( 0) . n 0 . --route-delay TUN/TAP --up --user --group ( --chroot) . DHCP tap . DHCP . --route-delay w ( 30) TAP-Win32 . --route-ipv6 args IPv6 IPv6 tun OpenVPN. : route-ipv6 ipv6addr/bits route-ipv6 ipv6addr/bits gateway route-ipv6 ipv6addr/bits gateway metric gateway IPv6 tap ipv6remote --ifconfig-ipv6 --route-ipv6-gateway . metric --route-metric 0 . --route-gateway arg gateway --route. dhcp (gateway) DHCP LAN OpenVPN . : route-gateway gateway route-gateway dhcp --route-ipv6-gateway gw (gateway) gw --route-ipv6. --route-metric m m --route. --route-noexec . --route-up . --route-nopull --client --pull block-outside-dns dhcp DNS. TCP/IP TUN/TAP . --topology mode --dev tun. --dev tap subnet . --server --server-bridge . . --dev . mode : subnet -- tun IP (subnet mask) --dev tap (ethernet bridging). IP . . net30 -- 30/ . -- . p2p -- tun tun . IP . . : --topology subnet --ifconfig "address netmask" "local remote". --tun-mtu args : tun-mtu tun-mtu tun-mtu tun-mtu occ-mtu MTU TUN tun-mtu MTU . . tun-mtu 1500 . OCC MTU MTU . occ-mtu tun-mtu . MTU (Maximum Transmission Units) (unfragmented) . OpenVPN . MTU . --fragment / --mssfix MTU . : tun-mtu ( Linux FreeBSD) ( macOS) MTU . --tun-mtu-max maxmtu MTU maxmtu . maxmtu 1600 . 1600 max-mtu 1600 . --tun-mtu-extra n TUN/TAP n --tun-mtu . 0 TUN . TAP MTU TAP 32 . OpenVPN . TUN/TAP --dev --user / --group . --mktun () . TUN/TAP . TUN/TAP OpenVPN . --up --down ifconfig(8) route(8) . OpenVPN . TUN/TAP OpenVPN . DHCP IP ( --ipchange ). MTU ( --link-mtu --tun-mtu ). TAP-Win32 . --rmtun () . (VRF) . >= 4.9 . VPN () . VRF VRF . . tun/tap VRF . up-script ip link set . VRF iproute2 VRF vrf_external 1023 ip link add vrf_external type vrf table 1023 eth0 vrf_external ip link set master vrf_external dev eth0 eth0 :code`main` 1023 VRF ifupdown ifupdown2 ifupdown VRF . eth0 VRF code:vrf_external : auto eth0 iface eth0 address 192.0.2.42/24 address 2001:db8:08:15::42/64 gateway 192.0.2.1 gateway 2001:db8:08:15::1 vrf vrf_external auto vrf_external iface vrf_external vrf-table 1023 OpenVPN OpenVPN : bind-dev vrf_external VRF : FrOSCon 2018 o : o (): (SCRIPTING INTEGRATION) OpenVPN OpenVPN . (Script Order of Execution) 1. --dns-updown TCP/UDP TUN/TAP --up . 2. --up TCP/UDP TUN/TAP --dns-updown . 3. --tls-verify . 4. --ipchange IP . 5. --client-connect --mode server . 6. --route-up --route-delay . 7. --route-pre-down . 8. --client-disconnect --mode server . 9. --dns-updown TCP/UDP TUN/TAP --down . 10. --down TCP/UDP TUN/TAP --dns-updown . 11. --learn-address --mode server / IP MAC OpenVPN . 12. --auth-user-pass-verify --mode server . 13. --client-crresponse --mode server CR_RESPONSE . (SCRIPT HOOKS) --auth-user-pass-verify args / ( ) . : auth-user-pass-verify cmd method OpenVPN cmd / . cmd ( ) . / . method via-env OpenVPN cmd username password / . . method via-file OpenVPN . cmd OpenVPN . --tmp-dir . /dev/shm ( ) / . (0) (1) (2) . / . 1 0 auth_control_file . auth_failed_reason_file AUTH_FAILED . auth_control_file . "User has been permanently disabled" . TEMP . . AUTH_FAILED,TEMP / . : backoff s s . . advance addr (IP) . advance remote IP . advance no . TEMP[backoff 42,advance no]: No free IP addresses VPN . auth_pending_file . (timeout) ( crtext) EXTRA client-pending-auth doc/management.txt . OpenVPN . : ('_') ('-') ('.') ('@'). CR LF . ('_') . . . PAM sample-scripts/auth-pam.pl OpenVPN . --client-crresponse (challenge response) . : client-crresponse cmd OpenVPN . cmd OpenVPN . . base64 . auth_control_file . `--auth-user-pass-verify`` . TOTP (RFC 6238) sample-scripts/totpauth.py . --client-connect cmd cmd . cmd ( ) . / . (common name) IP ( ). ( cmd ) OpenVPN . . --client-config-dir . script . script . --client-connect client_connect_deferred_file client_connect_config_file . . --client-disconnect cmd --client-connect . --client-connect ( ) (0) . --client-disconnect (cascaded) client-connect client-disconnect client-connect . --client-disconnect ( cmd ). --dns-updown cmd cmd DNS up/down openvpn . cmd disable --dns-updown . --dns . DNSSEC . split DNS (full redirect) . . --dns-updown . Windows DNS . Android DNS . --dns --dhcp-option DNS . --dns server --dhcp-option DNS . --up foreign_option --dns . --up --dns-updown . . --up --dns-updown force cmd . DNS --up . --down cmd cmd TUN/TAP ( UID --user / --chroot ). cmd ( ) . / . --up . --user / --group --down . --down-pre / --down TUN/TAP . --ipchange cmd cmd IP . cmd ( ) . / . cmd cmd : cmd ip address port number --ipchange --mode server . --client-connect . . IP IP /etc/hosts . IP . IP DHCP IP ( dhcpcd(8) ) SIGHUP SIGUSR1 OpenVPN . OpenVPN IP . --learn-address cmd cmd . cmd ( ) . / . cmd : $1 - [] "add" "update" "delete" OpenVPN . $2 - [] . : o IPv4 "198.162.10.14" o IPv4 "198.162.10.0/24" o IPv6 "2001:db8:1:2:3:4:5:6" o IPv6 "2001:db8:1:2:3:4:5::/112" o MAC ( --dev tap ) "00:FF:01:02:03:04". $3 - [ ] (Common Name) . "add" "update" "delete". "add" "update" () OpenVPN . cmd TUN/TAP VPN . OpenVPN IP MAC . (dual-stack) cmd IPv4 IPv6 . --route-up cmd cmd --route-delay. cmd ( ) . / . . --route-pre-down cmd cmd . cmd ( ) . / . . --setenv args name=value . : setenv name value setenv FORWARD_COMPATIBLE 1 setenv opt config_option FORWARD_COMPATIBLE 1 OpenVPN . OpenVPN . . . : setenv opt OpenVPN 2.3.3 setenv opt . --ignore-unknown-option . --setenv-safe args OPENVPN_name value . : setenv-safe name value (push) OPENVPN_ LD_PRELOAD . --tls-verify cmd cmd X509 TLS ( --crl-verify --tls-verify ). cmd TLS 0 1 . cmd ( ) . / . cmd cmd : cmd certificate_depth subject (subject dn) X509 . . X509 . perl (common name) verify-cn OpenVPN . Environmental Variables . --tls-export-cert dir peer_cert --tls-verify OPENVPN_PLUGIN_TLS_VERIFY . PEM dir . --up cmd cmd TUN/TAP ( UID --user). cmd ( ) . / . up IP VPN . --dev tun : cmd tun_dev tun_mtu 0 ifconfig_local_ip ifconfig_remote_ip [init | restart] --dev tap : cmd tap_dev tap_mtu 0 ifconfig_local_ip ifconfig_netmask [init | restart] Environmental Variables . 0 link_mtu - 0 . cmd OpenVPN . cmd . up TUN/TAP . init. . --up-restart up . OpenVPN TUN/TAP ( --persist-tun ). SIGUSR1 --ping-restart TCP --proto . --up-restart up restart . NOTE: OpenVPN . - . up-restart UID/GID ( ). --up . (NOTE: UDP 9999 . control-c ). openvpn --dev tun --port 9999 --verb 4 --ping-restart 10 \ --up 'echo up' --down 'echo down' --persist-tun \ --up-restart OpenVPN --ifconfig ifconfig TUN --up --up . --ifconfig OpenVPN ifconfig --up : route add -net 10.0.0.0 netmask 255.255.255.0 gw $5 --up-delay TUN/TAP --up TCP/UDP (peer). --proto udp --ping UDP " (connectionless)" . TAP-Win32 "connected" . --up-restart --up --down . --up . OpenVPN (remapping) . ('_') . : . : . --no-name-remapping --compat-names 2.5 . OpenVPN : X509 ('_') ('-') ('.') ('@') (':') ('/') ('='). - (Alphanumeric) true isalnum() C . (Common Names) ('_') ('-') ('.') ('@'). --auth-user-pass : OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY . --auth-user-pass " " CR LF. true isprint() C . --client-config-dir common name username ('_') ('-') ('@') ('.') "." ".." . ('_'). . ('_') . OpenVPN . bytes_received VPN. --client-disconnect . bytes_sent VPN. --client-disconnect . client_connect_config_file --client-connect ( ). --client-connect . client_connect_deferred_file --client-connect . . 1 0 ( ) 2 . () 2 0 deferred handler started OK . client_connect_config_file 1 ( 0) . 1 . . common_name (common name) X509 . --client-connect --client-disconnect --auth-user-pass-verify . config --config. SIGHUP . daemon --daemon "1" "0" . SIGHUP . daemon_log_redirect --log --log-append "1" "0" . SIGHUP . dev TUN/TAP . --up --down . dev_idx (index) TUN/TAP ( netsh.exe ). --up --down . dns_* --dns --dns-updown . . --dns . dns_search_domain_{n} dns_server_{n}_address_{m} dns_server_{n}_port_{m} dns_server_{n}_resolve_domain_{m} dns_server_{n}_dnssec dns_server_{n}_transport dns_server_{n}_sni foreign_option_{n} --push (push) --dhcp-option --up . ifconfig_ipv6_local IPv6 VPN --ifconfig-ipv6 ( ). ifconfig code:netsh ( ifconfig) OpenVPN --up . ifconfig_ipv6_netbits (prefix length) IPv6 VPN. nnn/ IPv6 --ifconfig-ipv6 ( ). ifconfig netsh ( ifconfig) OpenVPN --up . ifconfig_ipv6_remote IPv6 (remote) VPN --ifconfig-ipv6 ( ). ifconfig netsh ( ifconfig) OpenVPN --up . ifconfig_local IP VPN --ifconfig ( ). ifconfig netsh ( ifconfig) OpenVPN --up . ifconfig_remote IP (remote) VPN --ifconfig ( ) --dev tun . ifconfig netsh ( ifconfig) OpenVPN --up . ifconfig_netmask (subnet mask) --ifconfig --dev tap . ifconfig netsh ( ifconfig) OpenVPN --up . ifconfig_pool_local_ip IPv4 TUN/TAP --ifconfig-push ifconfig ( --ifconfig-pool). --dev tun . --client-connect --client-disconnect . ifconfig_pool_local_ip6 IPv6 TUN/TAP --ifconfig-ipv6-push ifconfig ( --ifconfig-ipv6-pool). --dev tun . --client-connect --client-disconnect . ifconfig_pool_netmask (netmask) IPv4 TUN/TAP --ifconfig-push ifconfig ( --ifconfig-pool). --dev tap . --client-connect --client-disconnect . ifconfig_pool_ip6_netbits (prefix length) IPv6 TUN/TAP --ifconfig-ipv6-push ifconfig ( --ifconfig-ipv6-pool). --dev tap . --client-connect --client-disconnect . ifconfig_pool_remote_ip IPv4 TUN/TAP --ifconfig-push ifconfig ( --ifconfig-pool). --client-connect --client-disconnect . ifconfig_pool_remote_ip6 IPv6 TUN/TAP --ifconfig-ipv6-push ifconfig ( --ifconfig-ipv6-pool). --client-connect --client-disconnect . link_mtu REMOVED OpenVPN 2.6.0 . ( IP) UDP . local --local. SIGHUP . local_port --port --lport. SIGHUP . password . via-env --auth-user-pass-verify . peer_cert --tls-export-cert PEM . certificate_depth --tls-verify . proto --proto. SIGHUP . remote_{n} --remote. SIGHUP . remote_port_{n} --port --rport. SIGHUP . route_net_gateway IP . --up . route_vpn_gateway --route --route-gateway --ifconfig --dev tun . --up . route_{parm}_{n} --up . parm network netmask" gateway metric . n OpenVPN 1 . DNS IP . route_ipv6_{parm}_{n} IPv6 --up . parm network gateway metric . IPv4 route_ipv6_network_{n} netmask /nnn . n OpenVPN 1 . DNS IP . route_redirect_gateway_ipv4 route_redirect_gateway_ipv6 1 LAN (block-local) 2 . . --up . script_context up/down "init" "restart" . --up . script_type . : up down ipchange route-up tls-verify auth-user-pass-verify client-connect client-disconnect learn-address. . signal . sigusr1 sighup sigterm sigint inactive ( --inactive) ping-exit ( --ping-exit) ping-restart ( --ping-restart) connection-reset ( TCP) error unknown ( ) . down . time_ascii . --client-connect . time_duration ( ) . --client-disconnect . time_unix / . --client-connect . tls_digest_{n} / tls_digest_sha256_{n} SHA1 / SHA256 n . TLS . --tls-verify . tls_id_{n} n . TLS . --tls-verify . tls_serial_{n} n . TLS . --tls-verify . "933971680" OCSP ( OpenSSL "0x" ). . contrib/OCSP_check/OCSP_check.sh . tls_serial_hex_{n} tls_serial_{n} ( 12:34:56:78:9A). tun_mtu MTU TUN/TAP. --up --down . trusted_ip / trusted_ip6) IP . --ipchange --client-connect --client-disconnect . ipv6 ( udp6 tcp6) trusted_ip6 . trusted_port . --ipchange --client-connect --client-disconnect . untrusted_ip / untrusted_ip6 IP . nmap --tls-verify . --tls-verify --auth-user-pass-verify . ipv6 ( udp6 tcp6) untrusted_ip6 . untrusted_port . --tls-verify --auth-user-pass-verify . username . --auth-user-pass-verify via-env . X509_{n}_{subject_field} (subject) X509 n . TLS . --tls-verify . tls_id_{n} X509 ( "_"). OpenVPN sample-keys ( client.crt) . 0 CA 1 . --x509-track . X509_0_emailAddress=me@myhost.mydomain X509_0_CN=Test-Client X509_0_O=OpenVPN-TEST X509_0_ST=NA X509_0_C=KG X509_1_emailAddress=me@myhost.mydomain X509_1_O=OpenVPN-TEST X509_1_L=BISHKEK X509_1_ST=NA X509_1_C=KG (Management Interface Options) OpenVPN . --management args socket-name TCP . : management socket-name unix # management socket-name unix pw-file # (recommended) management IP port # (INSECURE) management IP port pw-file # pw-file . stdin OpenVPN . . --management-client-user --management-client-group . TCP . IP tunnel . VPN TUN/TAP TCP . TCP * *. pw-file . IP:port OpenVPN ( ) . IP 127.0.0.1 (localhost) . OpenVPN telnet telnet "raw" . help . management-notes.txt management OpenVPN . --management-client TCP TCP/unix domain IP:port --management . SIGTERM OpenVPN . --management-client-auth . management-notes.txt OpenVPN . --management-client-group g g . --management-client-user u u . --management-external-cert certificate-hint --cert ( ). certificate-hint NEED-CERTIFICATE . --management-external-key . --management-external-key args --key ( ). : management-external-key management-external-key nopadding management-external-key pkcs1 management-external-key pss : management-external-key nopadding pkcs1 management-external-key pkcs1 pss nopadding pkcs1 pss (padding) . doc/mangement-notes.txt . --management-forget-disconnect OpenVPN . / --http-proxy . (cache) . --management-hold OpenVPN hold release . --management-log-cache n n (cache) . --management-query-passwords / --auth-user-pass . . --management-query-proxy --remote ( ). --management-query-remote (override) --remote ( ). --management-signal SIGUSR1 OpenVPN . OpenVPN . --management-client SIGTERM . --management-up-down / (up/down) . (Plug-in) OpenVPN . OpenVPN Plug-In API . --plugin args OpenVPN . : plugin module-name plugin module-name "arguments" module-name . (init) . (") . OpenVPN . module-name . . --plugin path Effective directory used ===================== ============================= myplug.so DEFAULT_DIR/myplug.so subdir/myplug.so DEFAULT_DIR/subdir/myplug.so ./subdir/myplug.so CWD/subdir/myplug.so /usr/lib/my/plug.so /usr/lib/my/plug.so DEFAULT_DIR OpenVPN . CWD OpenVPN OpenVPN --cd --plugin . OpenVPN README plugin OpenVPN . RPM OpenVPN /usr/share/openvpn/plugin . doc lib . . OpenVPN . (callback) . / ( tls-verify auth-user-pass-verify client-connect) (0) . : (deferred execution) OpenVPN (thread) . OpenVPN . OpenVPN . Windows Windows ( --route-method). --setenv opt --ignore-unknown-option . . --allow-nonadmin TAP-adapter (Standalone) TAP-adapter (non-administrative). TAP-adapter TAP . TAP-Win32 . (administrator) . --block-outside-dns DNS DNS. TCP UDP 53 . Windows Filtering Platform (WFP) Windows Vista . --cryptoapicert select-string ( Windows/OpenSSL) Windows Certificate System Store. --cert --key . Windows Cert Store . (GemSAFE Cryptoflex Swedish Post Office eID) PKCS12 . (subject) : cryptoapicert "SUBJ:Peter Runestig" ( SHA1) : cryptoapicert "THUMB:f6 49 24 41 01 b4 ..." Windows Certificate Store . . (issuer) : cryptoapicert "ISSUER:Sample CA" OID : cryptoapicert "TMPL:Name of Template" cryptoapicert "TMPL:1.3.6.1.4..." select-string . --dhcp-release Windows (lease) TAP . OpenVPN 2.4.1 . --dhcp-renew Windows (lease) TAP . Windows TAP DHCP Media Status TAP-Win32 "Always Connected" . --ip-win32 method --ifconfig Windows IP TAP-Win32 method . --ifconfig . manual IP . IP/netmask OpenVPN . dynamic [offset] [lease-time] IP DHCP . "" TCP/IP DHCP . : 1. TCP/IP TAP-Win32 "Obtain an IP address automatically" 2. OpenVPN IP DHCP . --dev tap OpenVPN . 192.168.4.0 netmask 255.255.255.0 OpenVPN IP 192.168.4.0 DHCP . --dev tun OpenVPN DHCP (masquerade) . offset > -256 < 256 0 . offset DHCP IP + offset . offset DHCP IP (broadcast) + offset . ipconfig /all Windows Windows DHCP . OpenVPN "" . OpenVPN DHCP . lease-time DHCP TAP-Win32 . TAP-Win32 (sleep) . . netsh IP "netsh" Windows. Windows XP Windows 2000 . ipapi IP Windows IP Helper API. (semantics) . TCP/IP TAP-Win32 "Obtain an IP address automatically." . adaptive () dynamic DHCP TAP-Win32 20 netsh (fail over). DHCP TAP-Win32 . (failover) netsh TCP/IP TAP-Win32 DHCP (static) OpenVPN adaptive netsh dynamic . " " adaptive netsh OpenVPN dynamic TCP/IP TAP-Win32 DHCP . --pause-exit "press any key to continue" OpenVPN. OpenVPN Windows Explorer . --register-dns ipconfig /flushdns ipconfig /registerdns . DNS . --route-method m m adaptive () IP helper API . route.exe . ipapi IP helper API. exe route.exe. --service args OpenVPN . : service exit-event [0|1] OpenVPN OpenVPN . exit-event OpenVPN . exit-event 0 . OpenVPN exit-event . exit-event OpenVPN . OpenVPN --service OpenVPN / --log --log-append . --show-adapters () TAP-Win32 --dev-node . ifconfig(8) . --show-net () OpenVPN . --show-net-up OpenVPN syslog TUN/TAP . --show-valid-subnets () --dev tun. TAP-Win32 TUN TAP-Win32 TUN . TUN /30 ( netmask 255.255.255.252) . --tap-sleep n OpenVPN TAP-Win32 "connected" n . --ifconfig --ip-win32 TAP-Win32 Windows IP Helper API . --win-sys path route.exe netsh.exe. OpenVPN SystemRoot . OpenVPN 2.3 . --win-sys env SystemRoot C:\\WINDOWS . env . . --show-gateway args () IPv4 IPv6 ( ). : --show-gateway --show-gateway IPv4-target --show-gateway IPv6-target IPv4 0.0.0.0/0 IPv4 IPv4 . IPv6 ::/128 IPv6 IPv6 . IPv4/IPv6 VPN OpenVPN . . --hash-size args r v . : hash-size r v --max-clients . --max-clients . --bcast-buffers n n ( 256). --persist-local-ip IP SIGUSR1 --ping-restart. --persist-remote-ip IP SIGUSR1 --ping-restart. --rcvbuf size TCP/UDP. . --shaper n n TCP/UDP. p2p . . OpenVPN : n b TCP/UDP (b / n) . OpenVPN . ( ) MTU ( ) TLS TCP . OpenVPN n / / . --sndbuf size TCP/UDP. . --tcp-queue-limit n TCP ( 64). OpenVPN TUN/TAP TCP TUN/TAP TCP . TCP OpenVPN . --txqueuelen n ( ) TX TUN/TAP. . --disable-dco (DCO) . DCO OpenVPN DCO . data-ciphers AEAD ( AES-GCM Chacha20-Poly1305) ovpn . ovpn . backport . DCO . DCO disable-dco . (UNSUPPORTED OPTIONS) OpenVPN --client-cert-not-required OpenVPN 2.5 . --verify-client-cert none . --fast-io OpenVPN 2.7 . . --http-proxy-retry OpenVPN 2.4 . --max-connect-retry . --http-proxy-timeout OpenVPN 2.4 . --connect-timeout . --ifconfig-pool-linear OpenVPN 2.5 . --topology p2p . --key-method OpenVPN 2.5 . key-method VPN . key-method OpenVPN 2.0 . --management-client-pf OpenVPN 2.6 . (pf) . --max-routes OpenVPN 2.4 . . --ncp-disable OpenVPN 2.6 . NCP . . --no-iv OpenVPN 2.5 . VPN . OpenVPN 2.4 NOOP () . --no-replay OpenVPN 2.7 . VPN . OpenVPN 2.5 . --prng OpenVPN 2.6 . PRNG SSL . --persist-key OpenVPN 2.7 . . --opt-verify OpenVPN 2.7 . . --socks-proxy-retry OpenVPN 2.4 . --max-connect-retry . --windows-driver OpenVPN 2.7 . OpenVPN ovpn-dco Windows . ovpn-dco tap-windows6 . (CONNECTION PROFILES) . --remote . . --remote . OpenVPN . --remote-random "" . : client dev tun remote 198.19.34.56 1194 udp remote 198.19.34.56 443 tcp remote 198.19.34.56 443 tcp http-proxy 192.168.0.8 8080 remote 198.19.36.99 443 tcp http-proxy 192.168.0.8 8080 persist-tun pkcs12 client.p12 remote-cert-tls server verb 3 UDP 198.19.34.56:1194 . TCP 198.19.34.56:443 . HTTP 192.168.0.8:8080 198.19.34.56:443 TCP . 198.19.36.99:443 TCP . OpenVPN : bind connect-retry connect-retry-max connect-timeout explicit-exit-notify float fragment http-proxy http-proxy-option key-direction link-mtu local lport mssfix mtu-disc nobind port proto remote rport socks-proxy tls-auth tls-crypt tls-crypt-v2 tun-mtu tun-mtu-extra. . ( remote) . nobind . nobind . (INLINE FILE SUPPORT) OpenVPN --ca --cert --dh --extra-certs --key --pkcs12 --crl-verify --http-proxy-user-pass --tls-auth --auth-gen-token-secret --peer-fingerprint --tls-crypt --tls-crypt-v2 --verify-hash --auth-user-pass . . : -----BEGIN CERTIFICATE----- [...] -----END CERTIFICATE----- --pkcs12 base64 . .p12 base64 OpenSSL openssl base64 -in input.p12 . (SIGNALS) SIGHUP OpenVPN TUN/TAP ( ) TUN/TAP . SIGUSR1 SIGHUP --persist-tun --persist-local-ip --persist-remote-ip ( ) TUN/TAP IP/ IP/ . (timeout) --ping-restart . --persist-remote-ip DHCP IP . --ipchange . SIGUSR2 OpenVPN ( --daemon syslog stdout). SIGINT, SIGTERM (gracefully) OpenVPN . (FAQ) (HOWTO) openvpn-examples(5) . OpenVPN HOWTO : (PROTOCOL) OpenVPN : (WEB) OpenVPN . OpenVPN Git . (BUGS) OpenVPN : (SEE ALSO) openvpn-examples(5), dhcpcd(8), ifconfig(8), openssl(1), route(8), scp(1) ssh(1) (NOTES) OpenSSL () TLS : LZO : (COPYRIGHT) (C) - OpenVPN Inc. (GNU GPL) / . (AUTHORS) James Yonan openvpn(8)