#
# Configure OpenVPN as TLS server.
#
tls-server

#
# Server VPN network configuration.
#
server 10.1.0.0 255.255.255.0

#
# Work mode.
#
mode server

#
# Setup management interface.
#
;management 127.0.0.1 5000

#
# Redirect client default geteway to VPN tunnel.
#
push "redirect-gateway def1"

#
# For Windows clients.
#
push "ip-win32"

#
# Send information about WINS server.
#
;push "dhcp-option WINS x.y.z.t"

#
# Tells OpenVPN which network device (type) to use.
#
dev tun

#
# Ping client.
#
ping 10

#
# Push client option to ping server.
#
push "ping 10"

#
# Close tunnel if there is no ping.
#
ping-exit 30

#
# Push client option to close tunnel if there is no ping.
#
push "ping-exit 30"

#
# Change rights after initialisation to user nobody.
#
user nobody

#
# Persist secret key and tunel during restart (this is 
# necessary if user was changed to nobady).
#
persist-key
persist-tun

#
# Log file.
#
log-append server.log

#
# OpenVPN uses lzo library to compress tunnel traffic.
#
;comp-lzo

#
# Sets the protocol OpenVPN uses.
# - For UDP: proto udp
# - For TCP server: proto tcp-server
#
proto udp

#
# Sets the maximum transmission units.
#
tun-mtu 1500

#
# Sets level of verbosity, 0 is lowest, 11 is maximum 
# detail level.
#
verb 1

#
# Specifies the local port witch OpenVPN will use.
#
lport 1194

#
# Specifies the remote port witch OpenVPN will use.
#
rport 1194

#
# Maximum number of clients simultaneously connected 
# to server.
#
;max-clients 20

#
# Allow client to client connections.
#
;client-to-client

#
# Directory with client config files.
#
client-config-dir ccd

#
# Key renegotiation time (in seconds).
#
reneg-sec 120

#
# TLS cipher used to protect transmission.
#
# For Suit B use one of the following:
#   * tls-cipher ECDHE-ECDSA-AES128-SHA
#   * tls-cipher ECDHE-ECDSA-AES192-SHA
#   * tls-cipher ECDHE-ECDSA-AES256-SHA
#
tls-cipher ECDHE-ECDSA-AES128-SHA

#
# ECDH domain paramethers. Use one of the follows: 
# - secp256r1 (same security level as AES128),
# - secp384r1 (same security level as AES192),
# - secp521r1 (same security level as AES256).
#
ecdh secp384r1.pem

#
# File with CA certificate.
#
ca ca.cert

#
# File with CA CRL.
#
crl-verify ca.crl

#
# File with server certificate signed by CA.
#
cert server.cert

#
# File with server key. It can not be encrypted.
#
key server.key
