# openvpn.conf.sample
#
# This is a sample configuration file for OpenVPN.
# Not all options are listed here; you can find good documentation 
# about all of the options in OpenVPN's manual page - openvpn(8).
#
# You can make a P-t-P connection by creating a shared key, 
# copying this key to other hosts in your network, and changing
# the IP addresses in this file.
#
# Commented options are provided for some typical configurations 

# Change the "search" path to /etc/openvpn
# All files referenced in this configuration will be relative to 
# whatever directory is specified here - we default to /etc/openvpn 
cd /etc/openvpn

# If running as a server, which local IP address should OpenVPN
# listen on? Specify this as either a hostname or IP address. If
# this is left blank, OpenVPN will default to listening on all
# interfaces.
#local a.b.c.d

# This option defines the IP or DNS name of the other side of your VPN
# connection.  This option is needed if you are making client or P-t-P 
# connections.  If you are the server, use "local" instead.  This may
# be specified as a domain name or IP address.
#remote vpn.server.org

# This option defins the protocol to use.  Valid options are:
# udp, tcp-server, or tcp-client.  Default is udp, and generally
# speaking, tcp is a bad idea.
proto udp

# This option defines the port on which your server will be listening 
# or trying to connect. The default is 1194
port 1194

# This option defines whether to use LZO compression. 
# If enabled, it must be enabled at both ends of the VPN connection. 
#comp-lzo

# Debug level (default 1)
#verb 3

# VPN logfile location
# If you don't specify a location here, logging will be done through
# syslogd and write to /var/log/messages
log-append /var/log/openvpn.log

# If you want to use OpenVPN as a daemon, uncomment this line.
# Generally speaking, servers should run OpenVPN as a daemon
# and clients should not.
#daemon

# Device type to use, you can choose between tun or tap. 
# TUN is the most common option. If you have multiple connections, 
# it is a good idea to bind each connection to a separate TUN/TAP 
# interface using tunX/tapX, where X is the number of each interface.
dev tun

# This option prevents OpenVPN from closing and re-opening the tun/tap 
# device every time it receives a SIGUSR1 signal
#persist-tun

# This is similar to the previous option, but it prevents OpenVPN from
# re-reading the key files every time
#persist-key

# If you are using a client-server architecture, you need to specify the 
# role of your computer in your VPN network.  To use one of these options,
# you need to configure TLS options too.
#
# To use the "server" option, you must specify a network subnet such
# as 172.16.1.0 255.255.255.0.  The first number is the network, the
# second is the netmask.  OpenVPN will take the first available IP
# for itself (in our example, 172.16.1.1) and the rest will be
# given to connecting clients dynamically.
#
# Leave these commented out if you are using OpenVPN in bridging mode.
#
#server 10.1.2.0 255.255.255.0
#client

# This option defines a file with IP address to client mapping. 
# This is useful in general, and necessary if clients use persist-tun.
#ifconfig-pool-persist ips.txt

# Enable this option if you want clients connected to this VPN to be
# able to talk directly to each other
#client-to-client

# This option defines the directory in which configuration files for clients 
# will reside.  With individual files you can make each client get different 
# options using "push" parameters
#client-config-dir ccd

# If you are using P-t-P, you need to specify the IP addresses at both ends 
# of your VPN connection.  The IP addresses are reversed at the other side.
#
# You can use this to specify client IP addresses in ccd files (on server) 
# or directly in client configuration
#ifconfig 10.1.2.1 10.1.2.2

# You can set routes to specific networks. In the sample below, "vpn_gateway"
# is an internal OpenVPN alias to your VPN gateway - leave it as is.
# This will enable you to talk with the networks behind your VPN server. 
# Multiple routes can be specified.
#
# +------------+ <eth>-<tun>               <tun>-<eth> +------------+
# |  Network1  |---| VPN1 |--[10.1.2.0/24]--| VPN2 |---|  Network2  |
# +------------+   +------+                 +------+   +------------+
# 192.168.0.0/24                                       192.168.2.0/24
#
# The sample below shows how VPN1 server can reach Network2
#route 192.168.2.0 255.255.255.0 vpn_gateway

# You can send clients many network configuration options using the 
# "push" directive and sending commands.
# Multiple "push" directives can be used.  You should only put global
# "push" directives here.  You can "push" different options to
# different clients in per-client configuration files.  See
# "client-config-dir" above.
#
# Using the same network configuration that you see above, the route statment 
# here allows VPN2 to reach Network1 
#push "route-delay 2 600"
#push "route 192.168.2.0 255.255.255.0 vpn_gateway"
#push "persist-key"

# This option sets the encryption algorithm to use in the VPN connection.
# Available options are:
# DES-CBC, RC2-CBC, DES-EDE-CBC,  DES-EDE3-CBC, 
# DESX-CBC, BF-CBC, RC2-40-CBC, CAST5-CBC, 
# RC2-64-CBC, AES-128-CBC, AES-192-CBC and AES-256-CBC
cipher BF-CBC

# Shared Key Connection
# ---------------------
# Secret is one shared key between the hosts that want to connect through VPNs.
# Without secret or TLS options, your data will not be encrypted.
# 
# To generate an encryption key do:
#   openvpn --genkey --secret /etc/openvpn/keys/shared.key
#
# Do the above on one host and copy it to the others
secret keys/shared.key

# TLS Connections
# ---------------
# TLS must be used if you use option "server" or "client"
# The basic idea there is: You have one Certificate Authority, and all 
# machines in your VPN network need to have individual certificates and 
# keys signed by Certificate Authority.  This means each client can
# have its own key, making it easier to revoke a key without copying
# a shared secret key to every client.
#
# Inside the /usr/doc/openvpn-$VERSION documentation directory, you can
# find "easy-rsa" scripts to make certificate and key management easier.

# Certificate Authority file 
# This file must be identical on all hosts that connect to your VPN
#ca certs/ca.crt

# If you are the server, you need to specify some Diffie Hellman parameters. 
# OpenVPN provides some sample .pem files in documentation directory
#dh my-dh.pem

# Certificate and Key signed by Certificate Authority
# Each machine needs to have their own unique certificate
#cert certs/machine.cert
#key keys/machine.key

# To prevent some DoS attacks we can add another authentication layer in the
# TLS control channel.  This needs to be enabled at both ends to work
# client uses the value 1; server uses the value 0
#tls-auth keys/shared.key 0