User Manual

Table Of Contents
Chapter 9. Advanced Use Cases for Access Server
Determines whether to use routed IP channel (tun) or an Ethernet tunnel, i.e. Ethernet bridg-
ing (tap). ’tap’ creates a virtual Ethernet adapter, while ’tun’ device is a virtual point-to-point
IP link. We have chosen ’tun’ because of its better efficiency and scalability.
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
This is a so-called master Certificate Authority (CA) certificate. This will be placed in both the
server and client devices, it’s the same for all devices. Since the server is a Windows machine,
we need to use double backslashes ( \\ ) in pathnames. In Linux system one slash ( / ) is used.
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
This is the certificate (a.k.a public key) for the server device.
key "C:\\Program Files\\OpenVPN\\config\\server.key"
This is the private key for the server device and it should be kept secret.
dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"
This file refers to Diffie-Hellman key exchange, which is a cryptographic protocol that allows
two devices that have no prior knowledge of each other to establish a shared secret key over
an insecure connection.
server 172.30.203.0 255.255.255.0
Here we create the VPN subnet. In this example, the server will take 172.30.203.1 for itself, the
rest will be left for clients to use. Each client will be able to reach the server on 172.30.203.1.
ifconfig-pool-persist C:\\Program Files\\OpenVPN\\config\\Logs\\ipp.txt
This file maintains a record of client <-> virtual IP address associations. If OpenVPN goes
down or is restarted, reconnecting clients can be assigned the same virtual IP address that
was previously assigned.
keepalive 10 120
This feature causes ping-like messages to be sent back and forth over the link so that each side
knows when the other side has gone down. The default parameter "10 120" makes ping occur
every 10 seconds and remote peer is assumed down if no ping is received within 120 seconds.
124