diff --git a/usr/local/www/wizards/openvpn_wizard.inc b/usr/local/www/wizards/openvpn_wizard.inc index 2e01e6a492..cba0d1054a 100644 --- a/usr/local/www/wizards/openvpn_wizard.inc +++ b/usr/local/www/wizards/openvpn_wizard.inc @@ -1,30 +1,30 @@ $auth) { - if ($auth['type'] != "radius") - continue; + $authlist = auth_get_authserver_list(); + $fields[1]['options']['option'] = array(); + foreach ($authlist as $i => $auth) { + if ($auth['type'] != "radius") + continue; $found = true; - $opts = array(); - $opts['name'] = $auth['name']; - $opts['value'] = $auth['name']; - $fields[1]['options']['option'][] = $opts; - } + $opts = array(); + $opts['name'] = $auth['name']; + $opts['value'] = $auth['name']; + $fields[1]['options']['option'][] = $opts; + } if ($found == false) - $stepid = 4; + $stepid = 4; } function step4_submitphpaction() { - global $stepid; + global $stepid; if (isset($_POST['next'])) { - $_POST['uselist'] = ""; - $stepid++; - } + $_POST['uselist'] = ""; + $stepid++; + } } function step5_submitphpaction() { global $stepid, $savemsg, $config; - if (empty($_POST['name']) || empty($_POST['ip']) || empty($_POST['port']) || - empty($_POST['secret'])) { + if (empty($_POST['name']) || empty($_POST['ip']) || empty($_POST['port']) || + empty($_POST['secret'])) { $stepid--; - $savemsg = "Please enter all information for authentication server."; + $savemsg = "Please enter all information for authentication server."; } else if (count(($authcfg = auth_get_authserver($_POST['name']))) > 0) { $stepid--; $savemsg = "Please choose a different name because an authentication server with this name already exists."; - } else { + } else { $config['ovpnserver']['step2']['uselist'] = "on"; $_POST['uselist'] = "on"; } @@ -148,11 +148,11 @@ function step6_submitphpaction() { global $stepid, $config; if (isset($_POST['next'])) { - $_POST['uselist'] = ""; - $stepid++; - } else { + $_POST['uselist'] = ""; + $stepid++; + } else { $config['ovpnserver']['step6']['uselist'] = "on"; - $_POST['uselist'] = "on"; + $_POST['uselist'] = "on"; } } @@ -160,32 +160,32 @@ function step7_submitphpaction() { global $stepid, $savemsg, $_POST, $config; if (empty($_POST['name']) || empty($_POST['keylength']) || empty($_POST['lifetime']) || - empty($_POST['country']) || empty($_POST['state']) || empty($_POST['city']) || - empty($_POST['organization']) || empty($_POST['email'])) { + empty($_POST['country']) || empty($_POST['state']) || empty($_POST['city']) || + empty($_POST['organization']) || empty($_POST['email'])) { $stepid--; - $savemsg = "Please enter all information for the new Certificate Authority."; - } else { + $savemsg = "Please enter all information for the new Certificate Authority."; + } else { $config['ovpnserver']['step6']['uselist'] = "on"; $_POST['uselist'] = "on"; } } function step8_stepbeforeformdisplay() { - global $stepid, $config; + global $stepid, $config; - if (count($config['system']['cert']) < 1 || + if (count($config['system']['cert']) < 1 || (count($config['system']['cert']) == 1 && stristr($config['system']['cert'][0]['name'], "webconf"))) { $stepid++; - } + } } function step8_submitphpaction() { global $stepid, $_POST; if (isset($_POST['next'])) { - $_POST['uselist'] = ""; - $stepid++; - } + $_POST['uselist'] = ""; + $stepid++; + } } function step9_stepbeforeformdisplay() { @@ -194,18 +194,18 @@ function step9_stepbeforeformdisplay() { $pconfig = $config['ovpnserver']; if (isset($pconfig['step6']['uselist'])) { - $country = $pconfig['step6']['country']; - $state = $pconfig['step6']['state']; - $city = $pconfig['step6']['city']; - $org = $pconfig['step6']['organization']; - } else { + $country = $pconfig['step6']['country']; + $state = $pconfig['step6']['state']; + $city = $pconfig['step6']['city']; + $org = $pconfig['step6']['organization']; + } else { $ca = lookup_ca($pconfig['step6']['authcertca']); $cavl = cert_get_subject_array($ca['crt']); $country = $cavl[0]['v']; $state = $cavl[1]['v']; $city = $cavl[2]['v']; $org = $cavl[3]['v']; - } + } $fields =& $pkg['step'][$stepid]['fields']['field']; foreach ($fields as $idx => $field) { @@ -229,12 +229,12 @@ function step9_stepbeforeformdisplay() { function step9_submitphpaction() { global $stepid, $savemsg, $_POST, $config; - if (empty($_POST['name']) || empty($_POST['keylength']) || empty($_POST['lifetime']) || + if (empty($_POST['name']) || empty($_POST['keylength']) || empty($_POST['lifetime']) || empty($_POST['country']) || empty($_POST['state']) || empty($_POST['city']) || empty($_POST['organization']) || empty($_POST['email'])) { $stepid--; - $savemsg = "Please enter all information for the new certificate."; - } else { + $savemsg = "Please enter all information for the new certificate."; + } else { $config['ovpnserver']['step9']['uselist'] = "on"; $_POST['uselist'] = "on"; } @@ -245,21 +245,21 @@ function step10_stepbeforeformdisplay() { foreach ($pkg['step'][$stepid]['fields']['field'] as $idx => $field) { if ($field['name'] == "crypto") { - $pkg['step'][$stepid]['fields']['field'][$idx]['options']['option'] = array(); + $pkg['step'][$stepid]['fields']['field'][$idx]['options']['option'] = array(); $cipherlist = openvpn_get_cipherlist(); foreach ($cipherlist as $name => $desc) { $opt = array(); - $opt['name'] = $desc; - $opt['value'] = $name; - $pkg['step'][$stepid]['fields']['field'][$idx]['options']['option'][] = $opt; + $opt['name'] = $desc; + $opt['value'] = $name; + $pkg['step'][$stepid]['fields']['field'][$idx]['options']['option'][] = $opt; } } else if ($field['name'] == "nbttype") { - $pkg['step'][$stepid]['fields']['field'][$idx]['options']['option'] = array(); + $pkg['step'][$stepid]['fields']['field'][$idx]['options']['option'] = array(); foreach ($netbios_nodetypes as $type => $name) { $opt = array(); $opt['name'] = $name; $opt['value'] = $type; - $pkg['step'][$stepid]['fields']['field'][$idx]['options']['option'][] = $opt; + $pkg['step'][$stepid]['fields']['field'][$idx]['options']['option'][] = $opt; } } else if ($field['name'] == "localport") { if (count($config['openvpn']['openvpn-server']) < 1) @@ -271,27 +271,31 @@ function step10_stepbeforeformdisplay() { function step10_submitphpaction() { global $savemsg, $stepid; + /* Default OpenVPN port to 1194 if left empty. */ + if (empty($_POST['localport'])) + $_POST['localport'] = 1194; + /* input validation */ - if ($result = openvpn_validate_port($_POST['localport'], 'Local port')) - $input_errors[] = $result; + if ($result = openvpn_validate_port($_POST['localport'], 'Local port')) + $input_errors[] = $result; - if ($result = openvpn_validate_cidr($_POST['tunnelnet'], 'Tunnel network')) - $input_errors[] = $result; + if ($result = openvpn_validate_cidr($_POST['tunnelnet'], 'Tunnel network')) + $input_errors[] = $result; - if ($result = openvpn_validate_cidr($_POST['remotenet'], 'Remote network')) - $input_errors[] = $result; + if ($result = openvpn_validate_cidr($_POST['remotenet'], 'Remote network')) + $input_errors[] = $result; - if ($result = openvpn_validate_cidr($_POST['localnet'], 'Local network')) - $input_errors[] = $result; + if ($result = openvpn_validate_cidr($_POST['localnet'], 'Local network')) + $input_errors[] = $result; $portused = openvpn_port_used($_POST['protocol'], $_POST['localport']); if ($portused != 0) - $input_errors[] = "The specified 'Local port' is in use. Please select another value"; - + $input_errors[] = "The specified 'Local port' is in use. Please select another value"; + if (!isset($_POST['generatetlskey']) && isset($_POST['tlsauthentication'])) if (!strstr($_POST['tlssharedkey'], "-----BEGIN OpenVPN Static key V1-----") || !strstr($_POST['tlssharedkey'], "-----END OpenVPN Static key V1-----")) - $input_errors[] = "The field 'TLS Authentication Key' does not appear to be valid"; + $input_errors[] = "The field 'TLS Authentication Key' does not appear to be valid"; if (!empty($_POST['dnsserver1']) && !is_ipaddr(trim($_POST['dnsserver1']))) $input_errors[] = "The field 'DNS Server #1' must contain a valid IP address"; @@ -313,7 +317,7 @@ function step10_submitphpaction() { $input_errors[] = "The field 'WINS Server #2' must contain a valid IP address"; if ($_POST['concurrentcon'] && !is_numeric($_POST['concurrentcon'])) - $input_errors[] = "The field 'Concurrent connections' must be numeric."; + $input_errors[] = "The field 'Concurrent connections' must be numeric."; if (empty($_POST['tunnelnet'])) $input_errors[] = "You must specify a 'Tunnel network'."; @@ -331,8 +335,8 @@ function step12_submitphpaction() { if (!is_array($config['ovpnserver'])) { $message = "No configuration found please retry again."; - header("Location:wizard.php?xml=openvpn_wizard.xml&stepid=1&message={$message}"); - exit; + header("Location:wizard.php?xml=openvpn_wizard.xml&stepid=1&message={$message}"); + exit; } if ($pconfig['step1']['type'] == "local") { @@ -344,7 +348,7 @@ function step12_submitphpaction() { $auth['type'] = $pconfig['step1']['type']; $auth['refid'] = uniqid(); $auth['name'] = $pconfig['step2']['authtype']; - + if ($auth['type'] == "ldap") { $auth['host'] = $pconfig['step2']['ip']; $auth['ldap_port'] = $pconfig['step2']['port']; @@ -372,12 +376,12 @@ function step12_submitphpaction() { $config['system']['authserver'][] = $auth; } else if (!isset($pconfig['step2']['uselist']) && empty($pconfig['step2']['authserv'])) { $message = "Please choose an authentication server ."; - header("Location:wizard.php?xml=openvpn_wizard.xml&stepid=1&message={$message}"); - exit; + header("Location:wizard.php?xml=openvpn_wizard.xml&stepid=1&message={$message}"); + exit; } else if (!($auth = auth_get_authserver($pconfig['step2']['authserv']))) { $message = "Not a valid authentication server has been specified."; - header("Location:wizard.php?xml=openvpn_wizard.xml&stepid=1&message={$message}"); - exit; + header("Location:wizard.php?xml=openvpn_wizard.xml&stepid=1&message={$message}"); + exit; } if (isset($pconfig['step6']['uselist'])) { @@ -399,55 +403,55 @@ function step12_submitphpaction() { $config['system']['ca'][] = $ca; } else if (!isset($pconfig['step6']['uselist']) && empty($pconfig['step6']['authcertca'])) { $message = "Please choose a Certificate Authority."; - header("Location:wizard.php?xml=openvpn_wizard.xml&stepid=5&message={$message}"); - exit; + header("Location:wizard.php?xml=openvpn_wizard.xml&stepid=5&message={$message}"); + exit; } else if (!($ca = lookup_ca($pconfig['step6']['authcertca']))) { $message = "Not a valid Certificate Authority specified."; - header("Location:wizard.php?xml=openvpn_wizard.xml&stepid=5&message={$message}"); - exit; + header("Location:wizard.php?xml=openvpn_wizard.xml&stepid=5&message={$message}"); + exit; } if (isset($pconfig['step9']['uselist'])) { - $cert = array(); - $cert['refid'] = uniqid(); - $cert['name'] = $pconfig['step9']['certname']; - $dn = array( - 'countryName' => $pconfig['step9']['country'], - 'stateOrProvinceName' => $pconfig['step9']['state'], - 'localityName' => $pconfig['step9']['city'], - 'organizationName' => $pconfig['step9']['organization'], - 'emailAddress' => $pconfig['step9']['email'], - 'commonName' => $pconfig['step9']['certname']); + $cert = array(); + $cert['refid'] = uniqid(); + $cert['name'] = $pconfig['step9']['certname']; + $dn = array( + 'countryName' => $pconfig['step9']['country'], + 'stateOrProvinceName' => $pconfig['step9']['state'], + 'localityName' => $pconfig['step9']['city'], + 'organizationName' => $pconfig['step9']['organization'], + 'emailAddress' => $pconfig['step9']['email'], + 'commonName' => $pconfig['step9']['certname']); - cert_create($cert, $ca['refid'], $pconfig['step9']['keylength'], $pconfig['step9']['lifetime'], $dn); - if (!is_array($config['system']['cert'])) - $config['system']['cert'] = array(); + cert_create($cert, $ca['refid'], $pconfig['step9']['keylength'], $pconfig['step9']['lifetime'], $dn); + if (!is_array($config['system']['cert'])) + $config['system']['cert'] = array(); - $config['system']['cert'][] = $cert; + $config['system']['cert'][] = $cert; } else if (!isset($pconfig['step6']['uselist']) && empty($pconfig['step9']['authcertname'])) { $message = "Please choose a Certificate."; - header("Location:wizard.php?xml=openvpn_wizard.xml&stepid=7&message={$message}"); - exit; + header("Location:wizard.php?xml=openvpn_wizard.xml&stepid=7&message={$message}"); + exit; } else if (!($cert = lookup_cert($pconfig['step9']['authcertname']))) { - $message = "Not a valid Certificate specified."; - header("Location:wizard.php?xml=openvpn_wizard.xml&stepid=7&message={$message}"); - exit; - } + $message = "Not a valid Certificate specified."; + header("Location:wizard.php?xml=openvpn_wizard.xml&stepid=7&message={$message}"); + exit; + } $server = array(); $server['vpnid'] = openvpn_vpnid_next(); switch ($auth['type']) { case "ldap": - $server['authmode'] = $auth['name']; - $server['mode'] = "server_user"; - break; - case "radius": - $server['authmode'] = $auth['name']; - $server['mode'] = "server_user"; - break; - default: - $server['authmode'] = "Local Database"; - $server['mode'] = "server_tls_user"; - break; + $server['authmode'] = $auth['name']; + $server['mode'] = "server_user"; + break; + case "radius": + $server['authmode'] = $auth['name']; + $server['mode'] = "server_user"; + break; + default: + $server['authmode'] = "Local Database"; + $server['mode'] = "server_tls_user"; + break; } $server['caref'] = $ca['refid']; $server['certref'] = $cert['refid']; @@ -522,17 +526,17 @@ function step12_submitphpaction() { $config['filter']['rule'][] = $rule; } if (isset($pconfig['step11']['ovpnallow'])) { - $rule = array(); - $rule['descr'] = gettext("OpenVPN {$server['description']} wizard rules."); - $rule['source']['any'] = TRUE; - $rule['destination']['any'] = TRUE; - $rule['interface'] = "openvpn"; - //$rule['protocol'] = $server['protocol']; - $rule['type'] = "pass"; - $rule['enabled'] = "on"; - $config['filter']['rule'][] = $rule; - } - + $rule = array(); + $rule['descr'] = gettext("OpenVPN {$server['description']} wizard rules."); + $rule['source']['any'] = TRUE; + $rule['destination']['any'] = TRUE; + $rule['interface'] = "openvpn"; + //$rule['protocol'] = $server['protocol']; + $rule['type'] = "pass"; + $rule['enabled'] = "on"; + $config['filter']['rule'][] = $rule; + } + if (!is_array($config['openvpn']['openvpn-server'])) $config['openvpn']['openvpn-server'] = array(); diff --git a/usr/local/www/wizards/openvpn_wizard.xml b/usr/local/www/wizards/openvpn_wizard.xml index 58164af5e7..9768ccf4df 100644 --- a/usr/local/www/wizards/openvpn_wizard.xml +++ b/usr/local/www/wizards/openvpn_wizard.xml @@ -3,31 +3,31 @@ /* $Id$ */ /* - part of pfSense (http://www.pfsense.org/) + part of pfSense (http://www.pfsense.org/) Copyright (C) 2010 Ermal Lui - All rights reserved. + All rights reserved. - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. */ 12 @@ -40,7 +40,7 @@ select Type of Server authtype - Choose authentication backend type. + Choose authentication backend type. <br/><b>NOTE:</b> If you are unsure, leave this set to "Local User Aceess." ovpnserver->step1->type + submit Add new LDAP server @@ -96,9 +96,9 @@ step2_stepbeforeformdisplay(); - step2_submitphpaction(); - enablechange(); - /usr/local/www/wizards/openvpn_wizard.inc + step2_submitphpaction(); + enablechange(); + /usr/local/www/wizards/openvpn_wizard.inc 3 @@ -180,17 +180,17 @@ ovpnserver->step2->nameattr - memberattr - Member naming attribute - input - ovpnserver->step2->memberattr - + memberattr + Member naming attribute + input + ovpnserver->step2->memberattr + - groupattr - Group naming attribute - input - ovpnserver->step2->groupattr - + groupattr + Group naming attribute + input + ovpnserver->step2->groupattr + submit Add new Server @@ -201,75 +201,75 @@ /usr/local/www/wizards/openvpn_wizard.inc - 4 + 4 OpenVPN Remote Access Server Setup Wizard on - + - listtopic - Authentication Servers list - - - authserv - Authentication servers - select - ovpnserver->step2->authserv - - - - + listtopic + Authentication Servers list + - submit - Add new RADIUS server - - - submit - Next - + authserv + Authentication servers + select + ovpnserver->step2->authserv + + + + + + submit + Add new RADIUS server + + + submit + Next + - step4_stepbeforeformdisplay(); - step4_submitphpaction(); - enablechange(); - /usr/local/www/wizards/openvpn_wizard.inc + step4_stepbeforeformdisplay(); + step4_submitphpaction(); + enablechange(); + /usr/local/www/wizards/openvpn_wizard.inc 5 OpenVPN Remote Access Server Setup Wizard on - - listtopic - Add a new authentication server - - - name - Name - input + + listtopic + Add a new authentication server + + + name + Name + input ovpnserver->step2->authtype - - - ip - Hostname or IP address - input + + + ip + Hostname or IP address + input ovpnserver->step2->ip - - - port - Authentication Port - input - 8 + + + port + Authentication Port + input + 8 ovpnserver->step2->port - - - secret - Shared Secret - password - 20 + + + secret + Shared Secret + password + 20 ovpnserver->step2->password - + Add new Server submit @@ -284,7 +284,7 @@ on - Choose Certificate Authority + Choose Certificate Authority (CA) listtopic @@ -294,58 +294,59 @@ ovpnserver->step6->authcertca - submit - Add new CA - + submit + Add new CA + Next submit - step6_stepbeforeformdisplay(); - step6_submitphpaction(); - /usr/local/www/wizards/openvpn_wizard.inc + step6_stepbeforeformdisplay(); + step6_submitphpaction(); + /usr/local/www/wizards/openvpn_wizard.inc 7 OpenVPN Remote Access Server Setup Wizard on - + - Create a new CA certificate + Create a new Certificate Authority (CA) certificate listtopic name Descriptive name - This is the same as common-name for Certificates + A name for your reference, to identify this certificate. This is the same as common-name field for other Certificates. input ovpnserver->step6->certca keylength Key length + <br/>Size of the key which will be generated. The larger the key, the more security is offers, but larger keys are generally slower to use. select 2048 ovpnserver->step6->keylength - - - - - + + + + + lifetime @@ -353,12 +354,13 @@ input 10 3650 - Lifetime in days + Lifetime in days. This is commonly set to 3650 (Approximately 10 years.) ovpnserver->step6->lifetime country Country Code + Two-letter ISO country code (e.g. US, AU, CA) input 5 ovpnserver->step6->country @@ -366,6 +368,7 @@ state State or Province + Full State of Province name, not abbreviated (e.g. Kentucky, Indiana, Ontario). input 30 ovpnserver->step6->state @@ -373,6 +376,7 @@ city City + City or other Locality name (e.g. Louisville, Indianapolis, Toronto). input 30 ovpnserver->step6->city @@ -380,6 +384,7 @@ organization Organization + Organization name, often the Company or Group name. input 30 ovpnserver->step6->organization @@ -387,6 +392,7 @@ email E-mail + E-mail address for the Certificate contact. Often the e-mail of the person generating the certificate (i.e. You.) input 30 ovpnserver->step6->email @@ -406,9 +412,9 @@ on - Choose Certificate - listtopic - + Choose a Server Certificate + listtopic + cert_selection certname @@ -416,9 +422,9 @@ ovpnserver->step9->authcertname - submit - Add new Certificate - + submit + Add new Certificate + Next submit @@ -426,60 +432,63 @@ step8_stepbeforeformdisplay(); step8_submitphpaction(); - /usr/local/www/wizards/openvpn_wizard.inc + /usr/local/www/wizards/openvpn_wizard.inc - 9 + 9 OpenVPN Remote Access Server Setup Wizard on - + - Create a new certificate + Create a new server certificate listtopic name Descriptive name + A name for your reference, to identify this certificate. This is also known as the certificate's "Common Name." input ovpnserver->step9->certname keylength Key length + <br/>Size of the key which will be generated. The larger the key, the more security is offers, but larger keys are generally slower to use. select 2048 ovpnserver->step9->keylength - - - - - + + + + + lifetime Lifetime + Lifetime in days. This is commonly set to 3650 (Approximately 10 years.) input 10 3650 - Lifetime in days ovpnserver->step9->lifetime country Country Code + Two-letter ISO country code (e.g. US, AU, CA) input 5 ovpnserver->step9->country @@ -487,6 +496,7 @@ state State or Province + Full State of Province name, not abbreviated (e.g. Kentucky, Indiana, Ontario). input 30 ovpnserver->step9->state @@ -494,6 +504,7 @@ city City + City or other Locality name (e.g. Louisville, Indianapolis, Toronto). input 30 ovpnserver->step9->city @@ -501,6 +512,7 @@ organization Organization + Organization name, often the Company or Group name. input 30 ovpnserver->step9->organization @@ -508,6 +520,7 @@ email E-mail + E-mail address for the Certificate contact. Often the e-mail of the person generating the certificate (i.e. You.) input 30 ovpnserver->step9->email @@ -533,6 +546,7 @@ interface interfaces_selection + The interface where OpenVPN will listen for incoming connections (typically WAN.) Interface ovpnserver->step10->interface @@ -541,19 +555,21 @@ select ovpnserver->step10->protocol - - - + + + + <br/>Protocol to use for OpenVPN connections. If you are unsure, leave this set to UDP. localport Local port + Local port upon which OpenVPN will listen for connections. The default port is 1194. Leave this blank unless you need to use a different port. input 10 ovpnserver->step10->localport @@ -561,6 +577,7 @@ description Description + A name for this OpenVPN instance, for your reference. It can be set however you like, but is often used to distinguish the purpose of the service (e.g. "Remote Technical Staff"). input 30 ovpnserver->step10->descr @@ -577,7 +594,7 @@ ovpnserver->step10->tlsauth - Automatically generate a TLS key + Generate TLS Key generatetlskey tlssharedkey on @@ -586,7 +603,9 @@ ovpnserver->step10->gentlskey + TLS Shared Key tlssharedkey + Paste in a shared TLS key if one has already been generated. textarea 30 5 @@ -598,19 +617,20 @@ select ovpnserver->step10->dhkey - - - - + + + + + <br/>Length of Diffie-Hellman (DH) key exchange parameters, used for establishing a secure communications channel. As with other such settings, the larger values are more secure, but may be slower in operation. crypto @@ -618,11 +638,12 @@ Encryption algorithm ovpnserver->step10->crypto - + + <br/>The method used to encrypt traffic between endpoints. This setting must match on the client and server side, but is otherwise set however you like. Certain algorithms will perform better on different hardware, depending on the availability of supported VPN accelerator chips. listtopic @@ -634,6 +655,7 @@ input 20 ovpnserver->step10->tunnelnet + This is the virtual network used for private communications between this server and client hosts expressed using CIDR notation (eg. 10.0.8.0/24). The first network address will be assigned to the server virtual interface. The remaining network addresses can optionally be assigned to connecting clients. (see Address Pool) Redirect Gateway @@ -642,19 +664,21 @@ Force all client generated traffic through the tunnel. ovpnserver->step10->rdrgw - - Remote network - remotenet - input - 20 - ovpnserver->step10->remotenet - Local network localnet input 20 ovpnserver->step10->localnet + This is the network that will be accessible from the remote endpoint, expressed as a CIDR range. You may leave this blank if you don't want to add a route to the local network through this tunnel on the remote machine. This is generally set to your LAN network. + + + Remote network + remotenet + input + 20 + ovpnserver->step10->remotenet + This is a network that will be routed through the tunnel, so that a site-to-site VPN can be established without manually changing the routing tables. Expressed as a CIDR range. If this is a site-to-site VPN, enter the remote LAN here. You may leave this blank if you don't want a site-to-site VPN. Concurrent Connections @@ -665,116 +689,127 @@ ovpnserver->step10->concurrentcon - Compression - compression - checkbox - Compress tunnel packets using the LZO algorithm. + Compression + compression + checkbox + Compress tunnel packets using the LZO algorithm. ovpnserver->step10->compression - + - Type-of-Service - tos - checkbox - Set the TOS IP header value of tunnel packets to match the encapsulated packet value. + Type-of-Service + tos + checkbox + Set the TOS IP header value of tunnel packets to match the encapsulated packet value. ovpnserver->step10->tos - + - Inter-client communication - interclient - checkbox - Allow communication between clients connected to this server. + Inter-client communication + interclient + checkbox + Allow communication between clients connected to this server. ovpnserver->step10->interclient - + listtopic Client Settings - Address Pool - addrpool - checkbox + Address Pool + addrpool + checkbox on - Provide a virtual adapter IP address to clients (see Tunnel Network). + Provide a virtual adapter IP address to clients (see Tunnel Network). ovpnserver->step10->addrpool - - - DNS Default Domain - defaultdomain - input - Provide a default domain name to clients. - ovpnserver->step10->defaultdomain - - - DNS Server 1 - dnsserver1 - input - ovpnserver->step10->dns1 - DNS Server 2 + DNS Default Domain + defaultdomain + input + Provide a default domain name to clients. + ovpnserver->step10->defaultdomain + + + DNS Server 1 + dnsserver1 + input + ovpnserver->step10->dns1 + DNS server to provide for connecting client systems. + + + DNS Server 2 dnserver2 input ovpnserver->step10->dns2 + DNS server to provide for connecting client systems. - DNS Server 3 + DNS Server 3 dnserver3 input ovpnserver->step10->dns3 + DNS server to provide for connecting client systems. - DNS Server 4 + DNS Server 4 dnserver4 input ovpnserver->step10->dns4 - + DNS server to provide for connecting client systems. + - NTP Server - ntpserver1 - input + NTP Server + ntpserver1 + input ovpnserver->step10->ntp1 - - - NTP Server 2 - ntpserver2 + Network Time Protocol server to provide for connecting client systems. + + + NTP Server 2 + ntpserver2 input ovpnserver->step10->ntp2 - + Network Time Protocol server to provide for connecting client systems. + nbtenable checkbox - Enable NetBios option + NetBIOS Options + Enable NetBIOS over TCP/IP. <br/>If this option is not set, all NetBIOS-over-TCP/IP options (including WINS) will be disabled. - NetBios Node Type - nbttype - select - ovpnserver->step10->nbttype - - - - + NetBIOS Node Type + nbttype + select + ovpnserver->step10->nbttype + + + + <br/>Possible options: b-node (broadcasts), p-node (point-to-point name queries to a WINS server), m-node (broadcast then query name server), and h-node (query name server, then broadcast). + - NetBios Scope - nbtscope - input - ovpnserver->step10->nbtscope - + NetBIOS Scope ID + nbtscope + input + ovpnserver->step10->nbtscope + A NetBIOS Scope ID provides an extended naming service for NetBIOS over TCP/IP. The NetBIOS scope ID isolates NetBIOS traffic on a single network to only those nodes with the same NetBIOS scope ID. + - WINS Server 1 - winsserver1 - input - ovpnserver->step10->wins1 - - - WINS Server 2 - winsserver2 - input - ovpnserver->step10->wins2 - + WINS Server 1 + winsserver1 + input + ovpnserver->step10->wins1 + A Windows Internet Name Service (WINS) server to provide for connecting clients, which allows them to browse Windows shares. This is typically an Active Directory Domain Controller, designated WINS server, or Samba server. + + + WINS Server 2 + winsserver2 + input + ovpnserver->step10->wins2 + A Windows Internet Name Service (WINS) server to provide for connecting clients, which allows them to browse Windows shares. This is typically an Active Directory Domain Controller, designated WINS server, or Samba server. + Advanced textarea @@ -799,11 +834,11 @@ listtopic - Firewall Rules configuration + Firewall Rule Configuration text - Firewall Rules control what network traffic is permitted. You must add rules to allow traffic to the OpenVPN server's IP and port, as well as allowing traffic from connected clients through the tunnel. These rules can be auto-added here, or configured manually after completing the wizardr. + Firewall Rules control what network traffic is permitted. You must add rules to allow traffic to the OpenVPN server's IP and port, as well as allowing traffic from connected clients through the tunnel. These rules can be automtically added here, or configured manually after completing the wizard. listtopic @@ -812,7 +847,7 @@ ovpnrule Firewall Rule - Automatically add rule to permit + Add a rule to permit traffic from clients on the Internet to the OpenVPN server process. checkbox ovpnserver->step11->ovpnrule @@ -823,7 +858,7 @@ ovpnallow OpenVPN rule - Add a rule to allow all traffic from connected clients + Add a rule to allow all traffic from connected clients to pass across the VPN tunnel. checkbox ovpnserver->step11->ovpnallow