2017-01-30 16:36:22 +00:00
|
|
|
# Copy this file to /etc/certidude/template.ovpn and customize gateway IP addresses
|
|
|
|
|
|
|
|
# Run as client
|
|
|
|
client # tls-client; pull
|
|
|
|
nobind
|
|
|
|
|
|
|
|
# OpenVPN gateway(s), uncomment remote-random to load balance
|
|
|
|
comp-lzo
|
|
|
|
proto udp
|
2017-03-13 11:42:58 +00:00
|
|
|
{% if servers %}
|
|
|
|
remote-random
|
|
|
|
{% for server in servers %}
|
2017-04-12 13:21:49 +00:00
|
|
|
remote {{ server }} 1194
|
2017-03-13 11:42:58 +00:00
|
|
|
{% endfor %}
|
|
|
|
{% else %}
|
|
|
|
remote 1.2.3.4 1194
|
|
|
|
{% endif %}
|
2017-01-30 16:36:22 +00:00
|
|
|
|
|
|
|
# Virtual network interface settings
|
|
|
|
dev tun
|
|
|
|
persist-tun
|
|
|
|
|
|
|
|
# Customize crypto settings
|
2017-03-13 11:42:58 +00:00
|
|
|
;tls-version-min 1.2
|
|
|
|
;tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384
|
2017-01-30 16:36:22 +00:00
|
|
|
;cipher AES-256-CBC
|
|
|
|
;auth SHA384
|
|
|
|
|
|
|
|
# Check that server presented certificate has TLS Server flag present
|
|
|
|
remote-cert-tls server
|
|
|
|
|
|
|
|
# X.509 business
|
|
|
|
persist-key
|
|
|
|
<ca>
|
|
|
|
{{ca}}
|
|
|
|
</ca>
|
|
|
|
<key>
|
|
|
|
{{key}}
|
|
|
|
</key>
|
|
|
|
<cert>
|
|
|
|
{{cert}}
|
|
|
|
</cert>
|
|
|
|
|
|
|
|
# Revocation list
|
2017-03-13 11:42:58 +00:00
|
|
|
# Tunnelblick doens't handle inlined CRL
|
|
|
|
# hard to update as well
|
|
|
|
;<crl-verify>
|
|
|
|
;</crl-verify>
|
2017-01-30 16:36:22 +00:00
|
|
|
|
|
|
|
# Pre-shared key for extra layer of security
|
|
|
|
;<ta>
|
|
|
|
;</ta>
|
|
|
|
|