Technical data

4. Packages
OPENVPN_DEFAULT_PF_FORWARD_POLICY Default: OPENVPN_DEFAULT_PF_FORWARD_POLICY=’REJECT’
This setting equals ’PF_FORWARD_POLICY=’ (Page 54) in base.txt. By specifiying ’BASE’
the setting from ’PF_FORWARD_POLICY=’ in base.txt will be used.
OPENVPN_DEFAULT_PING Default: OPENVPN_DEFAULT_PING=’60’
To keep an established tunnel open and to recognize if the OpenVPN remote station can
still be reached an encrypted ping will be sent over the line in the interval in seconds
specified here. ’off’ does not send pings over the line but only real user data.
OPENVPN_DEFAULT_PING_RESTART Default: OPENVPN_DEFAULT_PING_RESTART=’180’
If in the time interval set here no ping or other data is transferred succesfully the VPN
connection concerned will be restarted. The value in OPENVPN_DEFAULT_PING_RESTART has
to be greater than the one in OPENVPN_DEFAULT_PING. ’off’ disables automatic restart.
OPENVPN_DEFAULT_RESOLV_RETRY Default: OPENVPN_DEFAULT_RESOLV_RETRY=’infinite’
If OPENVPN_x_REMOTE_HOST or OPENVPN_x_LOCAL_HOST holds DNS names instead of IP ad-
dresses they have to be resolved to IP addresses when starting an OpenVPN connection.
If this fails OpenVPN will retry to resolve the DNS name for the timespan set here. If this
doesn’t work within the time limit set here no OpenVPN connection will be established.
With ’infinite’ OpenVPN will try forever to resolve the DNS name. Only change this
setting if if you know what you’re doing!
OPENVPN_DEFAULT_RESTART Default: OPENVPN_DEFAULT_RESTART=’ip-up’
After disconnection of a tunnel an immedeate restart should be done in order to keep
disconnection time as small as possible. For all OpenVPN connections made over dial-in
lines like DSL or ISDN ’ip-up’ should be specified here. ’never’ should be set instead
for OpenVPN connections over WLAN because of reconnection being independent of
dial-ins. For OpenVPN tunnels over an ISDN dial-in connection being established with
ISDN_CIRC_x_TYPE=’raw’ ’raw-up’ has to be set here.
OPENVPN_DEFAULT_PROTOCOL Default: OPENVPN_DEFAULT_PROTOCOL=’udp’
This variable sets which protocol should be used as default. UDP is a a good choice nor-
mally but sometimes only TCP is allowed, which has a remarkable overhead. Possible
values are ’udp’, ’udp6’, ’tcp-server’, ’tcp-server6’, ’tcp-client’ or ’tcp-client6’.
Settings ’tcp-server’ or ’tcp-client’ make only sense if a VPN tunnel has to be es-
tablished through a number of paket filters or other tunnels. If no special case should
be handled always use the default setting ’udp’. By adding ’6’ the tunnel will be IPv6
capable (WAN) and can be reached over IPv6-Internet.
OPENVPN_DEFAULT_START Default: OPENVPN_DEFAULT_START=’always’
OpenVPN connections can either be started ’always’ or ’on-demand’. Particular Open-
VPN connections can be started with the OpenVPN WebGUI (see 4.14.6) only when
needed. They can also be started via fli4l console at any time. Login to the fli4l console
and execute the following command:
cd /etc/openvpn
openvpn --config name.conf --daemon openvpn-name
171