luci-app-openvpn: prettify openvpn-advanced parameter set
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
This commit is contained in:
Florian Eckert
parent
0ec9636be4
commit
b92ac48bc8
1 changed files with 703 additions and 175 deletions
|
|
@ -7,191 +7,719 @@ require("luci.model.uci")
|
|||
|
||||
local knownParams = {
|
||||
--
|
||||
-- Widget Name Default(s) Description Option(s)
|
||||
--
|
||||
--Widget
|
||||
-- Name
|
||||
-- Default(s)
|
||||
-- Description
|
||||
-- Option(s)
|
||||
|
||||
{ "Service", {
|
||||
-- initialisation and daemon options
|
||||
{ ListValue, "verb", { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 }, translate("Set output verbosity") },
|
||||
{ Flag, "mlock", 0, translate("Disable Paging") },
|
||||
{ Flag, "disable_occ", 0, translate("Disable options consistency check") },
|
||||
-- { Value, "user", "root", translate("Set UID to user") },
|
||||
-- { Value, "group", "root", translate("Set GID to group") },
|
||||
{ Value, "cd", "/etc/openvpn", translate("Change to directory before initialization") },
|
||||
{ Value, "chroot", "/var/run", translate("Chroot to directory after initialization") },
|
||||
-- { Value, "daemon", "Instance-Name", translate("Daemonize after initialization") },
|
||||
-- { Value, "syslog", "Instance-Name", translate("Output to syslog and do not daemonize") },
|
||||
{ Flag, "passtos", 0, translate("TOS passthrough (applies to IPv4 only)") },
|
||||
-- { Value, "inetd", "nowait Instance-Name", translate("Run as an inetd or xinetd server") },
|
||||
{ Value, "log", "/var/log/openvpn.log", translate("Write log to file") },
|
||||
{ Value, "log_append", "/var/log/openvpn.log", translate("Append log to file") },
|
||||
{ Flag, "suppress_timestamps", 0, translate("Don't log timestamps") },
|
||||
-- { Value, "writepid", "/var/run/openvpn.pid", translate("Write process ID to file") },
|
||||
{ Value, "nice", 0, translate("Change process priority") },
|
||||
{ Flag, "fast_io", 0, translate("Optimize TUN/TAP/UDP writes") },
|
||||
{ Value, "echo", "some params echoed to log", translate("Echo parameters to log") },
|
||||
{ ListValue, "remap_usr1", { "SIGHUP", "SIGTERM" }, translate("Remap SIGUSR1 signals") },
|
||||
{ Value, "status", "/var/run/openvpn.status 5", translate("Write status to file every n seconds") },
|
||||
{ Value, "status_version", { 1, 2 }, translate("Status file format version") }, -- status
|
||||
{ Value, "mute", 5, translate("Limit repeated log messages") },
|
||||
|
||||
{ Value, "up", "/usr/bin/ovpn-up", translate("Shell cmd to execute after tun device open") },
|
||||
{ Value, "up_delay", 5, translate("Delay tun/tap open and up script execution") },
|
||||
{ Value, "down", "/usr/bin/ovpn-down", translate("Shell cmd to run after tun device close") },
|
||||
{ Flag, "down_pre", 0, translate("Call down cmd/script before TUN/TAP close") },
|
||||
{ Flag, "up_restart", 0, translate("Run up/down scripts for all restarts") },
|
||||
{ Value, "route_up", "/usr/bin/ovpn-routeup", translate("Execute shell cmd after routes are added") },
|
||||
{ Value, "ipchange", "/usr/bin/ovpn-ipchange", translate("Execute shell command on remote ip change"), { mode="p2p" } },
|
||||
{ DynamicList, "setenv", { "VAR1 value1", "VAR2 value2" }, translate("Pass environment variables to script") },
|
||||
{ Value, "tls_verify", "/usr/bin/ovpn-tlsverify", translate("Shell command to verify X509 name") },
|
||||
{ Value, "client_connect", "/usr/bin/ovpn-clientconnect", translate("Run script cmd on client connection") },
|
||||
{ Flag, "client_disconnect", 0, translate("Run script cmd on client disconnection") },
|
||||
{ Value, "learn_address", "/usr/bin/ovpn-learnaddress", translate("Executed in server mode whenever an IPv4 address/route or MAC address is added to OpenVPN's internal routing table") },
|
||||
{ Value, "auth_user_pass_verify", "/usr/bin/ovpn-userpass via-env", translate("Executed in server mode on new client connections, when the client is still untrusted") },
|
||||
{ ListValue, "script_security", { 0, 1, 2, 3 }, translate("Policy level over usage of external programs and scripts") },
|
||||
{ ListValue,
|
||||
"verb",
|
||||
{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 },
|
||||
translate("Set output verbosity") },
|
||||
{ Flag,
|
||||
"mlock",
|
||||
0,
|
||||
translate("Disable Paging") },
|
||||
{ Flag,
|
||||
"disable_occ",
|
||||
0,
|
||||
translate("Disable options consistency check") },
|
||||
-- { Value,
|
||||
-- "user",
|
||||
-- "root",
|
||||
-- translate("Set UID to user") },
|
||||
-- { Value,
|
||||
-- "group",
|
||||
-- "root",
|
||||
-- translate("Set GID to group") },
|
||||
{ Value,
|
||||
"cd",
|
||||
"/etc/openvpn",
|
||||
translate("Change to directory before initialization") },
|
||||
{ Value,
|
||||
"chroot",
|
||||
"/var/run",
|
||||
translate("Chroot to directory after initialization") },
|
||||
-- { Value,
|
||||
-- "daemon",
|
||||
-- "Instance-Name",
|
||||
-- translate("Daemonize after initialization") },
|
||||
-- { Value,
|
||||
-- "syslog",
|
||||
-- "Instance-Name",
|
||||
-- translate("Output to syslog and do not daemonize") },
|
||||
{ Flag,
|
||||
"passtos",
|
||||
0,
|
||||
translate("TOS passthrough (applies to IPv4 only)") },
|
||||
-- { Value,
|
||||
-- "inetd",
|
||||
-- "nowait Instance-Name",
|
||||
-- translate("Run as an inetd or xinetd server") },
|
||||
{ Value,
|
||||
"log",
|
||||
"/var/log/openvpn.log",
|
||||
translate("Write log to file") },
|
||||
{ Value,
|
||||
"log_append",
|
||||
"/var/log/openvpn.log",
|
||||
translate("Append log to file") },
|
||||
{ Flag,
|
||||
"suppress_timestamps",
|
||||
0,
|
||||
translate("Don't log timestamps") },
|
||||
-- { Value,
|
||||
-- "writepid",
|
||||
-- "/var/run/openvpn.pid",
|
||||
-- translate("Write process ID to file") },
|
||||
{ Value,
|
||||
"nice",
|
||||
0,
|
||||
translate("Change process priority") },
|
||||
{ Flag,
|
||||
"fast_io",
|
||||
0,
|
||||
translate("Optimize TUN/TAP/UDP writes") },
|
||||
{ Value,
|
||||
"echo",
|
||||
"some params echoed to log",
|
||||
translate("Echo parameters to log") },
|
||||
{ ListValue,
|
||||
"remap_usr1",
|
||||
{ "SIGHUP", "SIGTERM" },
|
||||
translate("Remap SIGUSR1 signals") },
|
||||
{ Value,
|
||||
"status",
|
||||
"/var/run/openvpn.status 5",
|
||||
translate("Write status to file every n seconds") },
|
||||
{ Value,
|
||||
"status_version",
|
||||
{ 1, 2 },
|
||||
translate("Status file format version") }, -- status
|
||||
{ Value,
|
||||
"mute",
|
||||
5,
|
||||
translate("Limit repeated log messages") },
|
||||
{ Value,
|
||||
"up",
|
||||
"/usr/bin/ovpn-up",
|
||||
translate("Shell cmd to execute after tun device open") },
|
||||
{ Value,
|
||||
"up_delay",
|
||||
5,
|
||||
translate("Delay tun/tap open and up script execution") },
|
||||
{ Value,
|
||||
"down",
|
||||
"/usr/bin/ovpn-down",
|
||||
translate("Shell cmd to run after tun device close") },
|
||||
{ Flag,
|
||||
"down_pre",
|
||||
0,
|
||||
translate("Call down cmd/script before TUN/TAP close") },
|
||||
{ Flag,
|
||||
"up_restart",
|
||||
0,
|
||||
translate("Run up/down scripts for all restarts") },
|
||||
{ Value,
|
||||
"route_up",
|
||||
"/usr/bin/ovpn-routeup",
|
||||
translate("Execute shell cmd after routes are added") },
|
||||
{ Value,
|
||||
"ipchange",
|
||||
"/usr/bin/ovpn-ipchange",
|
||||
translate("Execute shell command on remote ip change"),
|
||||
{ mode="p2p" } },
|
||||
{ DynamicList,
|
||||
"setenv",
|
||||
{ "VAR1 value1", "VAR2 value2" },
|
||||
translate("Pass environment variables to script") },
|
||||
{ Value,
|
||||
"tls_verify",
|
||||
"/usr/bin/ovpn-tlsverify",
|
||||
translate("Shell command to verify X509 name") },
|
||||
{ Value,
|
||||
"client_connect",
|
||||
"/usr/bin/ovpn-clientconnect",
|
||||
translate("Run script cmd on client connection") },
|
||||
{ Flag,
|
||||
"client_disconnect",
|
||||
0,
|
||||
translate("Run script cmd on client disconnection") },
|
||||
{ Value,
|
||||
"learn_address",
|
||||
"/usr/bin/ovpn-learnaddress",
|
||||
translate("Executed in server mode whenever an IPv4 address/route or MAC address is added to OpenVPN's internal routing table") },
|
||||
{ Value,
|
||||
"auth_user_pass_verify",
|
||||
"/usr/bin/ovpn-userpass via-env",
|
||||
translate("Executed in server mode on new client connections, when the client is still untrusted") },
|
||||
{ ListValue,
|
||||
"script_security",
|
||||
{ 0, 1, 2, 3 },
|
||||
translate("Policy level over usage of external programs and scripts") },
|
||||
} },
|
||||
|
||||
{ "Networking", {
|
||||
-- socket config
|
||||
{ ListValue, "mode", { "p2p", "server" }, translate("Major mode") },
|
||||
{ Value, "local", "0.0.0.0", translate("Local host name or ip address") },
|
||||
{ Value, "port", 1194, translate("TCP/UDP port # for both local and remote") },
|
||||
{ Value, "lport", 1194, translate("TCP/UDP port # for local (default=1194)") },
|
||||
{ Value, "rport", 1194, translate("TCP/UDP port # for remote (default=1194)") },
|
||||
{ Flag, "float", 0, translate("Allow remote to change its IP or port") },
|
||||
{ Flag, "nobind", 0, translate("Do not bind to local address and port") },
|
||||
|
||||
{ Value, "dev", "tun0", translate("tun/tap device") },
|
||||
{ ListValue, "dev_type", { "tun", "tap" }, translate("Type of used device") },
|
||||
{ Value, "dev_node", "/dev/net/tun", translate("Use tun/tap device node") },
|
||||
{ Flag, "tun_ipv6", 0, translate("Make tun device IPv6 capable") },
|
||||
|
||||
{ Value, "ifconfig", "10.200.200.3 10.200.200.1", translate("Set tun/tap adapter parameters") },
|
||||
{ Flag, "ifconfig_noexec", 0, translate("Don't actually execute ifconfig") },
|
||||
{ Flag, "ifconfig_nowarn", 0, translate("Don't warn on ifconfig inconsistencies") },
|
||||
|
||||
{ DynamicList, "route", "10.123.0.0 255.255.0.0", translate("Add route after establishing connection") },
|
||||
{ Value, "route_gateway", "10.234.1.1", translate("Specify a default gateway for routes") },
|
||||
{ Value, "route_delay", 0, translate("Delay n seconds after connection") },
|
||||
{ Flag, "route_noexec", 0, translate("Don't add routes automatically") },
|
||||
{ Flag, "route_nopull", 0, translate("Don't pull routes automatically") },
|
||||
|
||||
{ ListValue, "mtu_disc", { "yes", "maybe", "no" }, translate("Enable Path MTU discovery") },
|
||||
{ Flag, "mtu_test", 0, translate("Empirically measure MTU") },
|
||||
{ ListValue, "comp_lzo", { "yes", "no", "adaptive" }, translate("Use fast LZO compression") },
|
||||
{ Flag, "comp_noadapt", 0, translate("Don't use adaptive lzo compression"), { comp_lzo=1 } },
|
||||
{ Value, "link_mtu", 1500, translate("Set TCP/UDP MTU") },
|
||||
{ Value, "tun_mtu", 1500, translate("Set tun/tap device MTU") },
|
||||
{ Value, "tun_mtu_extra", 1500, translate("Set tun/tap device overhead") },
|
||||
{ Value, "fragment", 1500, translate("Enable internal datagram fragmentation"), { proto="udp" } },
|
||||
{ Value, "mssfix", 1500, translate("Set upper bound on TCP MSS"), { proto="udp" } },
|
||||
{ Value, "sndbuf", 65536, translate("Set the TCP/UDP send buffer size") },
|
||||
{ Value, "rcvbuf", 65536, translate("Set the TCP/UDP receive buffer size") },
|
||||
{ Value, "txqueuelen", 100, translate("Set tun/tap TX queue length") },
|
||||
{ Value, "shaper", 10240, translate("Shaping for peer bandwidth") },
|
||||
|
||||
{ Value, "inactive", 240, translate("tun/tap inactivity timeout") },
|
||||
{ Value, "keepalive", "10 60", translate("Helper directive to simplify the expression of --ping and --ping-restart in server mode configurations") },
|
||||
{ Value, "ping", 30, translate("Ping remote every n seconds over TCP/UDP port") },
|
||||
{ Value, "ping_exit", 120, translate("Remote ping timeout") },
|
||||
{ Value, "ping_restart", 60, translate("Restart after remote ping timeout") },
|
||||
{ Flag, "ping_timer_rem", 0, translate("Only process ping timeouts if routes exist") },
|
||||
|
||||
{ Flag, "persist_tun", 0, translate("Keep tun/tap device open on restart") },
|
||||
{ Flag, "persist_key", 0, translate("Don't re-read key on restart") },
|
||||
{ Flag, "persist_local_ip", 0, translate("Keep local IP address on restart") },
|
||||
{ Flag, "persist_remote_ip", 0, translate("Keep remote IP address on restart") },
|
||||
|
||||
{ ListValue,
|
||||
"mode",
|
||||
{ "p2p", "server" },
|
||||
translate("Major mode") },
|
||||
{ Value,
|
||||
"local",
|
||||
"0.0.0.0",
|
||||
translate("Local host name or ip address") },
|
||||
{ Value,
|
||||
"port",
|
||||
1194,
|
||||
translate("TCP/UDP port # for both local and remote") },
|
||||
{ Value,
|
||||
"lport",
|
||||
1194,
|
||||
translate("TCP/UDP port # for local (default=1194)") },
|
||||
{ Value,
|
||||
"rport",
|
||||
1194,
|
||||
translate("TCP/UDP port # for remote (default=1194)") },
|
||||
{ Flag,
|
||||
"float",
|
||||
0,
|
||||
translate("Allow remote to change its IP or port") },
|
||||
{ Flag,
|
||||
"nobind",
|
||||
0,
|
||||
translate("Do not bind to local address and port") },
|
||||
{ Value,
|
||||
"dev",
|
||||
"tun0",
|
||||
translate("tun/tap device") },
|
||||
{ ListValue,
|
||||
"dev_type",
|
||||
{ "tun", "tap" },
|
||||
translate("Type of used device") },
|
||||
{ Value,
|
||||
"dev_node",
|
||||
"/dev/net/tun",
|
||||
translate("Use tun/tap device node") },
|
||||
{ Flag,
|
||||
"tun_ipv6",
|
||||
0,
|
||||
translate("Make tun device IPv6 capable") },
|
||||
{ Value,
|
||||
"ifconfig",
|
||||
"10.200.200.3 10.200.200.1",
|
||||
translate("Set tun/tap adapter parameters") },
|
||||
{ Flag,
|
||||
"ifconfig_noexec",
|
||||
0,
|
||||
translate("Don't actually execute ifconfig") },
|
||||
{ Flag,
|
||||
"ifconfig_nowarn",
|
||||
0,
|
||||
translate("Don't warn on ifconfig inconsistencies") },
|
||||
{ DynamicList,
|
||||
"route",
|
||||
"10.123.0.0 255.255.0.0",
|
||||
translate("Add route after establishing connection") },
|
||||
{ Value,
|
||||
"route_gateway",
|
||||
"10.234.1.1",
|
||||
translate("Specify a default gateway for routes") },
|
||||
{ Value,
|
||||
"route_delay",
|
||||
0,
|
||||
translate("Delay n seconds after connection") },
|
||||
{ Flag,
|
||||
"route_noexec",
|
||||
0,
|
||||
translate("Don't add routes automatically") },
|
||||
{ Flag,
|
||||
"route_nopull",
|
||||
0,
|
||||
translate("Don't pull routes automatically") },
|
||||
{ ListValue,
|
||||
"mtu_disc",
|
||||
{ "yes", "maybe", "no" },
|
||||
translate("Enable Path MTU discovery") },
|
||||
{ Flag,
|
||||
"mtu_test",
|
||||
0,
|
||||
translate("Empirically measure MTU") },
|
||||
{ ListValue,
|
||||
"comp_lzo",
|
||||
{ "yes", "no", "adaptive" },
|
||||
translate("Use fast LZO compression") },
|
||||
{ Flag,
|
||||
"comp_noadapt",
|
||||
0,
|
||||
translate("Don't use adaptive lzo compression"),
|
||||
{ comp_lzo=1 } },
|
||||
{ Value,
|
||||
"link_mtu",
|
||||
1500,
|
||||
translate("Set TCP/UDP MTU") },
|
||||
{ Value,
|
||||
"tun_mtu",
|
||||
1500,
|
||||
translate("Set tun/tap device MTU") },
|
||||
{ Value,
|
||||
"tun_mtu_extra",
|
||||
1500,
|
||||
translate("Set tun/tap device overhead") },
|
||||
{ Value,
|
||||
"fragment",
|
||||
1500,
|
||||
translate("Enable internal datagram fragmentation"),
|
||||
{ proto="udp" } },
|
||||
{ Value,
|
||||
"mssfix",
|
||||
1500,
|
||||
translate("Set upper bound on TCP MSS"),
|
||||
{ proto="udp" } },
|
||||
{ Value,
|
||||
"sndbuf",
|
||||
65536,
|
||||
translate("Set the TCP/UDP send buffer size") },
|
||||
{ Value,
|
||||
"rcvbuf",
|
||||
65536,
|
||||
translate("Set the TCP/UDP receive buffer size") },
|
||||
{ Value,
|
||||
"txqueuelen",
|
||||
100,
|
||||
translate("Set tun/tap TX queue length") },
|
||||
{ Value,
|
||||
"shaper",
|
||||
10240,
|
||||
translate("Shaping for peer bandwidth") },
|
||||
{ Value,
|
||||
"inactive",
|
||||
240,
|
||||
translate("tun/tap inactivity timeout") },
|
||||
{ Value,
|
||||
"keepalive",
|
||||
"10 60",
|
||||
translate("Helper directive to simplify the expression of --ping and --ping-restart in server mode configurations") },
|
||||
{ Value,
|
||||
"ping",
|
||||
30,
|
||||
translate("Ping remote every n seconds over TCP/UDP port") },
|
||||
{ Value,
|
||||
"ping_exit",
|
||||
120,
|
||||
translate("Remote ping timeout") },
|
||||
{ Value,
|
||||
"ping_restart",
|
||||
60,
|
||||
translate("Restart after remote ping timeout") },
|
||||
{ Flag,
|
||||
"ping_timer_rem",
|
||||
0,
|
||||
translate("Only process ping timeouts if routes exist") },
|
||||
{ Flag,
|
||||
"persist_tun",
|
||||
0,
|
||||
translate("Keep tun/tap device open on restart") },
|
||||
{ Flag,
|
||||
"persist_key",
|
||||
0,
|
||||
translate("Don't re-read key on restart") },
|
||||
{ Flag,
|
||||
"persist_local_ip",
|
||||
0,
|
||||
translate("Keep local IP address on restart") },
|
||||
{ Flag,
|
||||
"persist_remote_ip",
|
||||
0,
|
||||
translate("Keep remote IP address on restart") },
|
||||
-- management channel
|
||||
{ Value, "management", "127.0.0.1 31194 /etc/openvpn/mngmt-pwds", translate("Enable management interface on <em>IP</em> <em>port</em>") },
|
||||
{ Flag, "management_query_passwords", 0, translate("Query management channel for private key") }, -- management
|
||||
{ Flag, "management_hold", 0, translate("Start OpenVPN in a hibernating state") }, -- management
|
||||
{ Value, "management_log_cache", 100, translate("Number of lines for log file history") }, -- management
|
||||
{ ListValue, "topology", { "net30", "p2p", "subnet" }, translate("'net30', 'p2p', or 'subnet'"), {dev_type="tun" } },
|
||||
{ Value,
|
||||
"management",
|
||||
"127.0.0.1 31194 /etc/openvpn/mngmt-pwds",
|
||||
translate("Enable management interface on <em>IP</em> <em>port</em>") },
|
||||
-- management
|
||||
{ Flag,
|
||||
"management_query_passwords",
|
||||
0,
|
||||
translate("Query management channel for private key") },
|
||||
-- managemnet
|
||||
{ Flag,
|
||||
"management_hold",
|
||||
0,
|
||||
translate("Start OpenVPN in a hibernating state") },
|
||||
-- management
|
||||
{ Value,
|
||||
"management_log_cache",
|
||||
100,
|
||||
translate("Number of lines for log file history") },
|
||||
{ ListValue,
|
||||
"topology",
|
||||
{ "net30", "p2p", "subnet" },
|
||||
translate("'net30', 'p2p', or 'subnet'"),
|
||||
{dev_type="tun" } },
|
||||
} },
|
||||
|
||||
{ "VPN", {
|
||||
{ Value, "server", "10.200.200.0 255.255.255.0", translate("Configure server mode"), { server_mode="1" } },
|
||||
{ Value, "server_bridge", "10.200.200.1 255.255.255.0 10.200.200.200 10.200.200.250", translate("Configure server bridge"), { server_mode="1" } },
|
||||
{ DynamicList, "push", { "redirect-gateway", "comp-lzo" }, translate("Push options to peer"), { server_mode="1" } },
|
||||
{ Flag, "push_reset", 0, translate("Don't inherit global push options"), { server_mode="1" } },
|
||||
{ Flag, "disable", 0, translate("Client is disabled"), { server_mode="1" } },
|
||||
{ Value, "ifconfig_pool", "10.200.200.100 10.200.200.150 255.255.255.0", translate("Set aside a pool of subnets"), { server_mode="1" } },
|
||||
{ Value, "ifconfig_pool_persist", "/etc/openvpn/ipp.txt 600", translate("Persist/unpersist ifconfig-pool"), { server_mode="1" } },
|
||||
-- { Flag, "ifconfig_pool_linear", 0, translate("Use individual addresses rather than /30 subnets"), { server_mode="1" } }, -- deprecated and replaced by --topology p2p
|
||||
{ Value, "ifconfig_push", "10.200.200.1 255.255.255.255", translate("Push an ifconfig option to remote"), { server_mode="1" } },
|
||||
{ Value, "iroute", "10.200.200.0 255.255.255.0", translate("Route subnet to client"), { server_mode="1" } },
|
||||
{ Flag, "client_to_client", 0, translate("Allow client-to-client traffic"), { server_mode="1" } },
|
||||
{ Flag, "duplicate_cn", 0, translate("Allow multiple clients with same certificate"), { server_mode="1" } },
|
||||
{ Value, "client_config_dir", "/etc/openvpn/ccd", translate("Directory for custom client config files"), { server_mode="1" } },
|
||||
{ Flag, "ccd_exclusive", 0, translate("Refuse connection if no custom client config"), { server_mode="1" } },
|
||||
{ Value, "tmp_dir", "/var/run/openvpn", translate("Temporary directory for client-connect return file"), { server_mode="1" } },
|
||||
{ Value, "hash_size", "256 256", translate("Set size of real and virtual address hash tables"), { server_mode="1" } },
|
||||
{ Value, "bcast_buffers", 256, translate("Number of allocated broadcast buffers"), { server_mode="1" } },
|
||||
{ Value, "tcp_queue_limit", 64, translate("Maximum number of queued TCP output packets"), { server_mode="1" } },
|
||||
{ Value, "max_clients", 10, translate("Allowed maximum of connected clients"), { server_mode="1" } },
|
||||
{ Value, "max_routes_per_client", 256, translate("Allowed maximum of internal"), { server_mode="1" } },
|
||||
{ Value, "connect_freq", "3 10", translate("Allowed maximum of new connections"), { server_mode="1" } },
|
||||
{ Flag, "client_cert_not_required", 0, translate("Don't require client certificate"), { server_mode="1" } },
|
||||
{ Flag, "username_as_common_name", 0, translate("Use username as common name"), { server_mode="1" } },
|
||||
{ Flag, "client", 0, translate("Configure client mode"), { server_mode="0" }, { server_mode="" } },
|
||||
{ Flag, "pull", 0, translate("Accept options pushed from server"), { client="1" } },
|
||||
{ Value, "auth_user_pass", "/etc/openvpn/userpass.txt", translate("Authenticate using username/password"), { client="1" } },
|
||||
{ ListValue, "auth_retry", { "none", "nointeract", "interact" }, translate("Handling of authentication failures"), { client="1" } },
|
||||
{ Value, "explicit_exit_notify", 1, translate("Send notification to peer on disconnect"), { client="1" } },
|
||||
{ DynamicList, "remote", "1.2.3.4", translate("Remote host name or ip address"), { client="1" } },
|
||||
{ Flag, "remote_random", 1, translate("Randomly choose remote server"), { client="1" } },
|
||||
{ ListValue, "proto", { "udp", "tcp-client", "tcp-server" }, translate("Use protocol"), { client="1" } },
|
||||
{ Value, "connect_retry", 5, translate("Connection retry interval"), { proto="tcp-client" }, { client="1" } },
|
||||
{ Value, "http_proxy", "192.168.1.100 8080", translate("Connect to remote host through an HTTP proxy"), { client="1" } },
|
||||
{ Flag, "http_proxy_retry", 0, translate("Retry indefinitely on HTTP proxy errors"), { client="1" } },
|
||||
{ Value, "http_proxy_timeout", 5, translate("Proxy timeout in seconds"), { client="1" } },
|
||||
{ DynamicList, "http_proxy_option", { "VERSION 1.0", "AGENT OpenVPN/2.0.9" }, translate("Set extended HTTP proxy options"), { client="1" } },
|
||||
{ Value, "socks_proxy", "192.168.1.200 1080", translate("Connect through Socks5 proxy"), { client="1" } },
|
||||
{ Value, "socks_proxy_retry", 5, translate("Retry indefinitely on Socks proxy errors"), { client="1" } }, -- client && socks_proxy
|
||||
{ Value, "resolv_retry", "infinite", translate("If hostname resolve fails, retry"), { client="1" } },
|
||||
{ ListValue, "redirect_gateway", { "", "local", "def1", "local def1" }, translate("Automatically redirect default route"), { client="1" } },
|
||||
{ Value,
|
||||
"server",
|
||||
"10.200.200.0 255.255.255.0",
|
||||
translate("Configure server mode"),
|
||||
{ server_mode="1" } },
|
||||
{ Value,
|
||||
"server_bridge",
|
||||
"10.200.200.1 255.255.255.0 10.200.200.200 10.200.200.250",
|
||||
translate("Configure server bridge"),
|
||||
{ server_mode="1" } },
|
||||
{ DynamicList,
|
||||
"push",
|
||||
{ "redirect-gateway", "comp-lzo" },
|
||||
translate("Push options to peer"),
|
||||
{ server_mode="1" } },
|
||||
{ Flag,
|
||||
"push_reset",
|
||||
0,
|
||||
translate("Don't inherit global push options"),
|
||||
{ server_mode="1" } },
|
||||
{ Flag,
|
||||
"disable",
|
||||
0,
|
||||
translate("Client is disabled"),
|
||||
{ server_mode="1" } },
|
||||
{ Value,
|
||||
"ifconfig_pool",
|
||||
"10.200.200.100 10.200.200.150 255.255.255.0",
|
||||
translate("Set aside a pool of subnets"),
|
||||
{ server_mode="1" } },
|
||||
{ Value,
|
||||
"ifconfig_pool_persist",
|
||||
"/etc/openvpn/ipp.txt 600",
|
||||
translate("Persist/unpersist ifconfig-pool"),
|
||||
{ server_mode="1" } },
|
||||
-- deprecated and replaced by --topology p2p
|
||||
-- { Flag,
|
||||
-- "ifconfig_pool_linear",
|
||||
-- 0,
|
||||
-- translate("Use individual addresses rather than /30 subnets"),
|
||||
-- { server_mode="1" } },
|
||||
{ Value,
|
||||
"ifconfig_push",
|
||||
"10.200.200.1 255.255.255.255",
|
||||
translate("Push an ifconfig option to remote"),
|
||||
{ server_mode="1" } },
|
||||
{ Value,
|
||||
"iroute",
|
||||
"10.200.200.0 255.255.255.0",
|
||||
translate("Route subnet to client"),
|
||||
{ server_mode="1" } },
|
||||
{ Flag,
|
||||
"client_to_client",
|
||||
0,
|
||||
translate("Allow client-to-client traffic"),
|
||||
{ server_mode="1" } },
|
||||
{ Flag,
|
||||
"duplicate_cn",
|
||||
0,
|
||||
translate("Allow multiple clients with same certificate"),
|
||||
{ server_mode="1" } },
|
||||
{ Value,
|
||||
"client_config_dir",
|
||||
"/etc/openvpn/ccd",
|
||||
translate("Directory for custom client config files"),
|
||||
{ server_mode="1" } },
|
||||
{ Flag,
|
||||
"ccd_exclusive",
|
||||
0,
|
||||
translate("Refuse connection if no custom client config"),
|
||||
{ server_mode="1" } },
|
||||
{ Value,
|
||||
"tmp_dir",
|
||||
"/var/run/openvpn",
|
||||
translate("Temporary directory for client-connect return file"),
|
||||
{ server_mode="1" } },
|
||||
{ Value,
|
||||
"hash_size",
|
||||
"256 256",
|
||||
translate("Set size of real and virtual address hash tables"),
|
||||
{ server_mode="1" } },
|
||||
{ Value,
|
||||
"bcast_buffers",
|
||||
256,
|
||||
translate("Number of allocated broadcast buffers"),
|
||||
{ server_mode="1" } },
|
||||
{ Value,
|
||||
"tcp_queue_limit",
|
||||
64,
|
||||
translate("Maximum number of queued TCP output packets"),
|
||||
{ server_mode="1" } },
|
||||
{ Value,
|
||||
"max_clients",
|
||||
10,
|
||||
translate("Allowed maximum of connected clients"),
|
||||
{ server_mode="1" } },
|
||||
{ Value,
|
||||
"max_routes_per_client",
|
||||
256,
|
||||
translate("Allowed maximum of internal"),
|
||||
{ server_mode="1" } },
|
||||
{ Value,
|
||||
"connect_freq",
|
||||
"3 10",
|
||||
translate("Allowed maximum of new connections"),
|
||||
{ server_mode="1" } },
|
||||
{ Flag,
|
||||
"client_cert_not_required",
|
||||
0,
|
||||
translate("Don't require client certificate"),
|
||||
{ server_mode="1" } },
|
||||
{ Flag,
|
||||
"username_as_common_name",
|
||||
0,
|
||||
translate("Use username as common name"),
|
||||
{ server_mode="1" } },
|
||||
{ Flag,
|
||||
"client",
|
||||
0,
|
||||
translate("Configure client mode"),
|
||||
{ server_mode="0" }, { server_mode="" } },
|
||||
{ Flag,
|
||||
"pull",
|
||||
0,
|
||||
translate("Accept options pushed from server"),
|
||||
{ client="1" } },
|
||||
{ Value,
|
||||
"auth_user_pass",
|
||||
"/etc/openvpn/userpass.txt",
|
||||
translate("Authenticate using username/password"),
|
||||
{ client="1" } },
|
||||
{ ListValue,
|
||||
"auth_retry",
|
||||
{ "none", "nointeract", "interact" },
|
||||
translate("Handling of authentication failures"),
|
||||
{ client="1" } },
|
||||
{ Value,
|
||||
"explicit_exit_notify",
|
||||
1,
|
||||
translate("Send notification to peer on disconnect"),
|
||||
{ client="1" } },
|
||||
{ DynamicList,
|
||||
"remote",
|
||||
"1.2.3.4",
|
||||
translate("Remote host name or ip address"),
|
||||
{ client="1" } },
|
||||
{ Flag,
|
||||
"remote_random",
|
||||
1,
|
||||
translate("Randomly choose remote server"),
|
||||
{ client="1" } },
|
||||
{ ListValue,
|
||||
"proto",
|
||||
{ "udp", "tcp-client", "tcp-server" },
|
||||
translate("Use protocol"),
|
||||
{ client="1" } },
|
||||
{ Value,
|
||||
"connect_retry",
|
||||
5,
|
||||
translate("Connection retry interval"),
|
||||
{ proto="tcp-client" }, { client="1" } },
|
||||
{ Value,
|
||||
"http_proxy",
|
||||
"192.168.1.100 8080",
|
||||
translate("Connect to remote host through an HTTP proxy"),
|
||||
{ client="1" } },
|
||||
{ Flag,
|
||||
"http_proxy_retry",
|
||||
0,
|
||||
translate("Retry indefinitely on HTTP proxy errors"),
|
||||
{ client="1" } },
|
||||
{ Value,
|
||||
"http_proxy_timeout",
|
||||
5,
|
||||
translate("Proxy timeout in seconds"),
|
||||
{ client="1" } },
|
||||
{ DynamicList,
|
||||
"http_proxy_option",
|
||||
{ "VERSION 1.0", "AGENT OpenVPN/2.0.9" },
|
||||
translate("Set extended HTTP proxy options"),
|
||||
{ client="1" } },
|
||||
{ Value,
|
||||
"socks_proxy",
|
||||
"192.168.1.200 1080",
|
||||
translate("Connect through Socks5 proxy"),
|
||||
{ client="1" } },
|
||||
-- client && socks_proxy
|
||||
{ Value,
|
||||
"socks_proxy_retry",
|
||||
5,
|
||||
translate("Retry indefinitely on Socks proxy errors"),
|
||||
{ client="1" } },
|
||||
{ Value,
|
||||
"resolv_retry",
|
||||
"infinite",
|
||||
translate("If hostname resolve fails, retry"),
|
||||
{ client="1" } },
|
||||
{ ListValue,
|
||||
"redirect_gateway",
|
||||
{ "", "local", "def1", "local def1" },
|
||||
translate("Automatically redirect default route"),
|
||||
{ client="1" } },
|
||||
} },
|
||||
|
||||
{ "Cryptography", {
|
||||
{ FileUpload, "secret", "/etc/openvpn/secret.key", translate("Enable Static Key encryption mode (non-TLS)") },
|
||||
{ Value, "auth", "SHA1", translate("HMAC authentication for packets") }, -- parse
|
||||
{ Value, "cipher", "BF-CBC", translate("Encryption cipher for packets") }, -- parse
|
||||
{ Value, "keysize", 1024, translate("Size of cipher key") }, -- parse
|
||||
{ Value, "engine", "dynamic", translate("Enable OpenSSL hardware crypto engines") }, -- parse
|
||||
{ Flag, "no_replay", 0, translate("Disable replay protection") },
|
||||
{ Value, "replay_window", "64 15", translate("Replay protection sliding window size") },
|
||||
{ Flag, "mute_replay_warnings", 0, translate("Silence the output of replay warnings") },
|
||||
{ Value, "replay_persist", "/var/run/openvpn-replay-state", translate("Persist replay-protection state") },
|
||||
{ Flag, "no_iv", 0, translate("Disable cipher initialisation vector") },
|
||||
{ Flag, "tls_server", 0, translate("Enable TLS and assume server role"), { tls_client="" }, { tls_client="0" } },
|
||||
{ Flag, "tls_client", 0, translate("Enable TLS and assume client role"), { tls_server="" }, { tls_server="0" } },
|
||||
{ FileUpload, "ca", "/etc/easy-rsa/keys/ca.crt", translate("Certificate authority") },
|
||||
{ FileUpload, "dh", "/etc/easy-rsa/keys/dh1024.pem", translate("Diffie Hellman parameters") },
|
||||
{ FileUpload, "cert", "/etc/easy-rsa/keys/some-client.crt", translate("Local certificate") },
|
||||
{ FileUpload, "key", "/etc/easy-rsa/keys/some-client.key", translate("Local private key") },
|
||||
{ FileUpload, "pkcs12", "/etc/easy-rsa/keys/some-client.pk12", translate("PKCS#12 file containing keys") },
|
||||
{ ListValue, "key_method", { 1, 2 }, translate("Enable TLS and assume client role") },
|
||||
{ Value, "tls_cipher", "DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:RC4-SHA:RC4-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC4-MD5",
|
||||
{ FileUpload,
|
||||
"secret",
|
||||
"/etc/openvpn/secret.key",
|
||||
translate("Enable Static Key encryption mode (non-TLS)") },
|
||||
-- parse
|
||||
{ Value,
|
||||
"auth",
|
||||
"SHA1",
|
||||
translate("HMAC authentication for packets") },
|
||||
-- parse
|
||||
{ Value,
|
||||
"cipher",
|
||||
"BF-CBC",
|
||||
translate("Encryption cipher for packets") },
|
||||
-- parse
|
||||
{ Value,
|
||||
"keysize",
|
||||
1024,
|
||||
translate("Size of cipher key") },
|
||||
-- parse
|
||||
{ Value,
|
||||
"engine",
|
||||
"dynamic",
|
||||
translate("Enable OpenSSL hardware crypto engines") },
|
||||
{ Flag,
|
||||
"no_replay",
|
||||
0,
|
||||
translate("Disable replay protection") },
|
||||
{ Value,
|
||||
"replay_window",
|
||||
"64 15",
|
||||
translate("Replay protection sliding window size") },
|
||||
{ Flag,
|
||||
"mute_replay_warnings",
|
||||
0,
|
||||
translate("Silence the output of replay warnings") },
|
||||
{ Value,
|
||||
"replay_persist",
|
||||
"/var/run/openvpn-replay-state",
|
||||
translate("Persist replay-protection state") },
|
||||
{ Flag,
|
||||
"no_iv",
|
||||
0,
|
||||
translate("Disable cipher initialisation vector") },
|
||||
{ Flag,
|
||||
"tls_server",
|
||||
0,
|
||||
translate("Enable TLS and assume server role"), { tls_client="" }, { tls_client="0" } },
|
||||
{ Flag,
|
||||
"tls_client",
|
||||
0,
|
||||
translate("Enable TLS and assume client role"), { tls_server="" }, { tls_server="0" } },
|
||||
{ FileUpload,
|
||||
"ca",
|
||||
"/etc/easy-rsa/keys/ca.crt",
|
||||
translate("Certificate authority") },
|
||||
{ FileUpload,
|
||||
"dh",
|
||||
"/etc/easy-rsa/keys/dh1024.pem",
|
||||
translate("Diffie Hellman parameters") },
|
||||
{ FileUpload,
|
||||
"cert",
|
||||
"/etc/easy-rsa/keys/some-client.crt",
|
||||
translate("Local certificate") },
|
||||
{ FileUpload,
|
||||
"key",
|
||||
"/etc/easy-rsa/keys/some-client.key",
|
||||
translate("Local private key") },
|
||||
{ FileUpload,
|
||||
"pkcs12",
|
||||
"/etc/easy-rsa/keys/some-client.pk12",
|
||||
translate("PKCS#12 file containing keys") },
|
||||
{ ListValue,
|
||||
"key_method",
|
||||
{ 1, 2 },
|
||||
translate("Enable TLS and assume client role") },
|
||||
{ Value,
|
||||
"tls_cipher",
|
||||
"DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHA:RC4-SHA:RC4-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC4-MD5",
|
||||
translate("TLS cipher") },
|
||||
{ Value, "tls_timeout", 2, translate("Retransmit timeout on TLS control channel") },
|
||||
{ Value, "reneg_bytes", 1024, translate("Renegotiate data chan. key after bytes") },
|
||||
{ Value, "reneg_pkts", 100, translate("Renegotiate data chan. key after packets") },
|
||||
{ Value, "reneg_sec", 3600, translate("Renegotiate data chan. key after seconds") },
|
||||
{ Value, "hand_window", 60, translate("Timeframe for key exchange") },
|
||||
{ Value, "tran_window", 3600, translate("Key transition window") },
|
||||
{ Flag, "single_session", 0, translate("Allow only one session") },
|
||||
{ Flag, "tls_exit", 0, translate("Exit on TLS negotiation failure") },
|
||||
{ Value, "tls_auth", "/etc/openvpn/tlsauth.key", translate("Additional authentication over TLS") },
|
||||
--{ Value, "askpass", "[file]", translate("Get PEM password from controlling tty before we daemonize") },
|
||||
{ Flag, "auth_nocache", 0, translate("Don't cache --askpass or --auth-user-pass passwords") },
|
||||
{ Value, "tls_remote", "remote_x509_name", translate("Only accept connections from given X509 name") },
|
||||
{ ListValue, "ns_cert_type", { "client", "server" }, translate("Require explicit designation on certificate") },
|
||||
{ ListValue, "remote_cert_tls", { "client", "server" }, translate("Require explicit key usage on certificate") },
|
||||
{ Value, "crl_verify", "/etc/easy-rsa/keys/crl.pem", translate("Check peer certificate against a CRL") },
|
||||
{ Value, "tls_version_min", "1.0", translate("The lowest supported TLS version") },
|
||||
{ Value, "tls_version_max", "1.2", translate("The highest supported TLS version") },
|
||||
{ Value, "key_direction", "1", translate("The key direction for 'tls-auth' and 'secret' options") },
|
||||
{ Value,
|
||||
"tls_timeout",
|
||||
2,
|
||||
translate("Retransmit timeout on TLS control channel") },
|
||||
{ Value,
|
||||
"reneg_bytes",
|
||||
1024,
|
||||
translate("Renegotiate data chan. key after bytes") },
|
||||
{ Value,
|
||||
"reneg_pkts",
|
||||
100,
|
||||
translate("Renegotiate data chan. key after packets") },
|
||||
{ Value,
|
||||
"reneg_sec",
|
||||
3600,
|
||||
translate("Renegotiate data chan. key after seconds") },
|
||||
{ Value,
|
||||
"hand_window",
|
||||
60,
|
||||
translate("Timeframe for key exchange") },
|
||||
{ Value,
|
||||
"tran_window",
|
||||
3600,
|
||||
translate("Key transition window") },
|
||||
{ Flag,
|
||||
"single_session",
|
||||
0,
|
||||
translate("Allow only one session") },
|
||||
{ Flag,
|
||||
"tls_exit",
|
||||
0,
|
||||
translate("Exit on TLS negotiation failure") },
|
||||
{ Value,
|
||||
"tls_auth",
|
||||
"/etc/openvpn/tlsauth.key",
|
||||
translate("Additional authentication over TLS") },
|
||||
-- { Value,
|
||||
-- "askpass",
|
||||
-- "[file]",
|
||||
-- translate("Get PEM password from controlling tty before we daemonize") },
|
||||
{ Flag,
|
||||
"auth_nocache",
|
||||
0,
|
||||
translate("Don't cache --askpass or --auth-user-pass passwords") },
|
||||
{ Value,
|
||||
"tls_remote",
|
||||
"remote_x509_name",
|
||||
translate("Only accept connections from given X509 name") },
|
||||
{ ListValue,
|
||||
"ns_cert_type",
|
||||
{ "client", "server" },
|
||||
translate("Require explicit designation on certificate") },
|
||||
{ ListValue,
|
||||
"remote_cert_tls",
|
||||
{ "client", "server" },
|
||||
translate("Require explicit key usage on certificate") },
|
||||
{ Value,
|
||||
"crl_verify",
|
||||
"/etc/easy-rsa/keys/crl.pem",
|
||||
translate("Check peer certificate against a CRL") },
|
||||
{ Value,
|
||||
"tls_version_min",
|
||||
"1.0",
|
||||
translate("The lowest supported TLS version") },
|
||||
{ Value,
|
||||
"tls_version_max",
|
||||
"1.2",
|
||||
translate("The highest supported TLS version") },
|
||||
{ Value,
|
||||
"key_direction",
|
||||
"1",
|
||||
translate("The key direction for 'tls-auth' and 'secret' options") },
|
||||
} }
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue