Technical data

4. Packages
This setting will cause OpenVPN to automatically generate keyfiles on boot of the fli4l
router. An OpenVPN connection won’t be started then. For details see OPENVPN_x_SECRET
(Page 164).
OPENVPN_DEFAULT_DIGEST Default: OPENVPN_DEFAULT_DIGEST=’SHA1’
Enter available checksums her. OpenVPN uses ’SHA1’ as default.
OPENVPN_DEFAULT_FLOAT Default: OPENVPN_DEFAULT_FLOAT=’yes’
OpenVPN remote stations that use DynDNS addresses can change their IP address at
any time. To make OpenVPN accept this changed IP address set OPENVPN_DEFAULT_FLOAT
to ’yes’. If ’no’ is set changing of an IP address is not allowed. This only makes sense
with WLAN connections or connections to remote stations with static IP addresses (i.e.
some provider’s root servers). This setting can be superseded be a per connection setting
as all other OPENVPN_DEFAULT_ settings can.
OPENVPN_DEFAULT_KEYSIZE Default: OPENVPN_DEFAULT_KEYSIZE=”
Keysize depends on the encryption method used. Only change this setting when con-
necting to an OpenVPN remote station that does not use default settings and which you
have no influence on. If keysize can be determined by you this value should stay empty.
OpenVPN will use the optimal keysize for the encryption method used then.
OPENVPN_DEFAULT_OPEN_OVPNPORT Default: OPENVPN_DEFAULT_OPEN_OVPNPORT=’yes’
fli4l’s packet filter rules have to be changed to enable OpenVPN connections. For all
TCP or UDP ports (see OPENVPN_x_PROTOCOL) OpenVPN should listen on PF_INPUT_x
(Page 42) in base.txt has to be adapted. By specifiying ’yes’ these packet filter rules
will be generated automatically. For some connections it may make sense to set ’no’ and
define the rules yourself.
OPENVPN_DEFAULT_ALLOW_ICMPPING Default: OPENVPN_DEFAULT_ALLOW_ICMPPING=’yes’
’yes’ configures the packet filter for the connection to let pass ping data packets. If
there is no really good cause ICMP ping should be allowed at any time. This setting is
not equivalent to OpenVPN’s ping option!
OPENVPN_DEFAULT_PF_INPUT_LOG Default: OPENVPN_DEFAULT_PF_INPUT_LOG=’BASE’
’yes’ or ’no’ sets whether the packet filter should protocol denied incoming packets for
the VPN connection in the INPUT list or not. By specifiying ’BASE’ the setting from
’PF_INPUT_LOG=’ in base.txt will be used.
OPENVPN_DEFAULT_PF_INPUT_POLICY Default: OPENVPN_DEFAULT_PF_INPUT_POLICY=’REJECT’
This setting equals ’PF_INPUT_POLICY=’ (Page 52) in base.txt. By specifiying ’BASE’ the
setting from ’PF_INPUT_POLICY=’ in base.txt will be used.
OPENVPN_DEFAULT_PF_FORWARD_LOG Default: OPENVPN_DEFAULT_PF_FORWARD_LOG=’BASE’
’yes’ or ’no’ sets whether the packet filter should protocol denied incoming packets for
the VPN connection in the FORWARD list or not. By specifiying ’BASE’ the setting
from ’PF_FORWARD_LOG=’ in base.txt will be used.
170