openvpn:options
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| openvpn:options [2020/04/20 10:15] – peter | openvpn:options [2020/07/15 09:30] (current) – external edit 127.0.0.1 | ||
|---|---|---|---|
| Line 58: | Line 58: | ||
| |route network/IP [netmask] [gateway] [metric]|Add route to routing table after connection is established. Multiple routes can be specified. Routes will be automatically torn down in reverse order prior to TUN/TAP device close.| | |route network/IP [netmask] [gateway] [metric]|Add route to routing table after connection is established. Multiple routes can be specified. Routes will be automatically torn down in reverse order prior to TUN/TAP device close.| | ||
| |::: | |::: | ||
| - | |::: | + | |::: |
| - | |::: | + | |::: |
| |:::|The default can be specified by leaving an option blank or setting it to " | |:::|The default can be specified by leaving an option blank or setting it to " | ||
| |:::|The **network** and **gateway** parameters can also be specified as a DNS or /etc/hosts file resolvable name, or as one of three special keywords:| | |:::|The **network** and **gateway** parameters can also be specified as a DNS or /etc/hosts file resolvable name, or as one of three special keywords:| | ||
| Line 65: | Line 65: | ||
| |::: | |::: | ||
| |::: | |::: | ||
| + | |route-nopull|When used with **--client** or **--pull**, accept options pushed by server EXCEPT for routes, block-outside-dns and dhcp options like DNS servers.| | ||
| + | |:::|When used on the client, this option effectively bars the server from adding routes to the client' | ||
| |sndbuf size|Set the TCP/UDP socket send buffer size. Defaults to operation system default.| | |sndbuf size|Set the TCP/UDP socket send buffer size. Defaults to operation system default.| | ||
| - | |verb 3|Set output verbosity to n (default=1). Each level shows all info from the previous levels. | + | |tun-mtu n|Take the TUN device MTU to be n and derive the link MTU from it (default=1500). |
| + | |:::|The MTU (Maximum Transmission Units) is the maximum datagram size in bytes that can be sent unfragmented over a particular network path. OpenVPN requires that packets on the control or data channels be sent unfragmented.| | ||
| + | |:::|MTU problems often manifest themselves as connections which hang during periods of active usage.| | ||
| + | |::: | ||
| + | |verb n|Set output verbosity to **n** (default=1). | ||
| |:::|**0** -- No output except fatal errors.| | |:::|**0** -- No output except fatal errors.| | ||
| |:::|**1 to 4** -- Normal usage range.| | |:::|**1 to 4** -- Normal usage range.| | ||
| Line 85: | Line 91: | ||
| |client|A helper directive designed to simplify the configuration of OpenVPN' | |client|A helper directive designed to simplify the configuration of OpenVPN' | ||
| - | |::: | + | |:::|**pull**| |
| - | |::: | + | |:::|**tls-client**| |
| - | |pull|This option must be used on a client which is connecting to a multi-client server. It indicates to OpenVPN that it should accept options pushed by the server, provided they are part of the legal set of pushable options.| | + | |pull|This option must be used on a client which is connecting to a multi-client server. |
| - | |:::|In particular, --pull allows the server to push routes to the client, so you should not use --pull or --client in situations where you don't trust the server to have control over the client' | + | |:::|In particular, |
| Line 113: | Line 119: | ||
| |:::|This is an important security precaution to protect against a man-in-the-middle attack where an authorized client attempts to connect to another client by impersonating the server. | |:::|This is an important security precaution to protect against a man-in-the-middle attack where an authorized client attempts to connect to another client by impersonating the server. | ||
| |tls-client|Enable TLS and assume client role during TLS handshake.| | |tls-client|Enable TLS and assume client role during TLS handshake.| | ||
| - | |||
| - | ---- | ||
| - | |||
| - | |||
| - | |||
| - | |||
| - | |||
| - | |||
| - | |||
| - | |route-method exe| | ||
| - | |route-nopull|When used with **--client** or **--pull**, accept options pushed by server EXCEPT for routes, block-outside-dns and dhcp options like DNS servers.| | ||
| - | |:::|When used on the client, this option effectively bars the server from adding routes to the client' | ||
| - | |tun-mtu 1500| | ||
| |verify-x509-name Server name-prefix|Accept connections only if a host's X.509 name is equal to **name**. | |verify-x509-name Server name-prefix|Accept connections only if a host's X.509 name is equal to **name**. | ||
| |:::|Which X.509 name is compared to **name** depends on the setting of type. **type** can be " | |:::|Which X.509 name is compared to **name** depends on the setting of type. **type** can be " | ||
| Line 132: | Line 125: | ||
| |:::|Using a name prefix is a useful alternative to managing a CRL (Certificate Revocation List) on the client, since it allows the client to refuse all certificates except for those associated with designated servers.| | |:::|Using a name prefix is a useful alternative to managing a CRL (Certificate Revocation List) on the client, since it allows the client to refuse all certificates except for those associated with designated servers.| | ||
| |::: | |::: | ||
| + | |||
| + | |||
| + | |||
| + | ---- | ||
| + | |||
| + | ===== Windows-Specific Options ===== | ||
| + | |||
| + | |route-method m|Which method **m** to use for adding routes on Windows?| | ||
| + | |::: | ||
| + | |::: | ||
| + | |::: | ||
| ---- | ---- | ||
openvpn/options.1587377730.txt.gz · Last modified: 2020/07/15 09:30 (external edit)