mirror of
https://github.com/kiddin9/op-packages.git
synced 2026-11-15 04:53:00 +08:00
48 lines
1.1 KiB
Plaintext
Executable File
48 lines
1.1 KiB
Plaintext
Executable File
# Modern OpenVPN Server Configuration Instance
|
|
|
|
# --- Connection Mode ---
|
|
dev tun
|
|
proto udp
|
|
|
|
# --- Network & IP Management ---
|
|
port 1194
|
|
setenv portextern 1194
|
|
server 10.8.0.0 255.255.255.0
|
|
server-ipv6 fd00:db8:0:1::/64
|
|
topology subnet
|
|
|
|
# --- Tuning & Optimization ---
|
|
tls-timeout 5
|
|
mssfix 1360
|
|
tun-mtu 1420
|
|
# Increased max-clients absorbs attacks and client roaming
|
|
max-clients 4096
|
|
|
|
# --- Certificates & Keys ---
|
|
ca /etc/openvpn/keys/ca_default.crt
|
|
cert /etc/openvpn/keys/server_default.crt
|
|
key /etc/openvpn/keys/server_default.key
|
|
dh /etc/openvpn/keys/dh_default.pem
|
|
|
|
# --- Hardening & Security ---
|
|
tls-crypt-v2 /etc/openvpn/keys/server_default.tls2.key
|
|
tls-groups secp256r1
|
|
cipher AES-256-GCM
|
|
data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305
|
|
|
|
# --- Smart Firewall ---
|
|
setenv ovpnfirewall on
|
|
|
|
# --- Client Push Options ---
|
|
push "dhcp-option DNS 9.9.9.9"
|
|
push "dhcp-option DNS 149.112.112.112"
|
|
push "dhcp-option DNS6 2620:fe::fe"
|
|
push "dhcp-option DNS6 2620:fe::9"
|
|
|
|
# --- Verification & Logging ---
|
|
status /tmp/run/openvpn.instance.status 5
|
|
status-version 1
|
|
setenv logfilter on
|
|
keepalive 10 60
|
|
verb 3
|