#Openvpn daemon install

Default is TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256:TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256:TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256:TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256Дb openvpn-s2s setprop sme1 LogLevel 5 Cipher AES-256-CBC Compression disabled tlsCipher12: This is the list of accepted ciphers for TLS v1.2 in order of presentation.tlsCipherSuites13: This is the list of accepted ciphers for TLS v1.3 in order of presentation.tlsVmin: This is the minimum TLS version accepted, unless you need to communicate with a very old server, you should not be using lower than 1.2 as it is insecure.If enabled, a server daemon will only accept the connection if the remote endpoint present a client certificate, and a client daemon will only accept the connection if the remote endpoint present a server certificate. CheckCertificateUsage: can be enabled or disabled (default is disabled).RemoteCommonName: The connection will be accepted only if the remote endpoint has a valid certificate, with this common name.

If you use TLS as authentication mechanism, you can set some other properties: Obviously, this setting only makes sens if you enable it on either the server or the client, but not both. This is usefull if you wan't a one-way VPN only (eg 192.168.9.0/24 can reach 192.168.11.0/24, but not the other way). If set to no, inbound connections from this VPN will be dropped.

AllowInbound: can be yes or no (default to yes).

This setting should match on both the server and the client Toggle the internal compression used by OpenVPN.

Compression: can be enabled or disabled.

This setting should match on both the server and the client. You shouldn't change this setting unless you have good reason to do so. Valid LogLevel values are numbers between 0 (no output except fatal errors) to 11 (really verbose)

LogLevel: if you want to increase the verbosity of a daemon (either client or server), you set the LogLevel property.

Some advanced settings are not available on the panel, but only with db commands: We are now able to ping hosts on the other side using their private IP. Those two virtual IP should be reversed between the client and the server

Remote Virtual IP: the IP used internally by OpenVPN on the other side.

You should choose a IP outside of any local networks

Local Virtual IP: the IP used internally by OpenVPN.

Remote Port on the client and Local Port on the server should be the same

Local Port (available on server only): port on which the OpenVPN server will bind, waiting for connection of the client.

Remote Port (available on client only): port used by the remote server.

Remote Host (available on client only): IP or FQDN of the remote peer.

Openvpn -show-digests | egrep 'digest size' | awk You can get a list of available HMAC using this command: Default is the insecure SHA1, we suggest you use SHA256 as a minimum.

HMAC: THis is part of the security of the data channel with the Cipher.

You can also use TLS if you want, but it's usually for power users (you need to manage a PKI, you can use PHPki for this if you want)

Authentication mechanism: How both ends will authenticate.

Status: you can disable a VPN connection if you want, but most of the time you'll want it enabled.

Description: a human readable description (eg link between SME1 and SME2).

Daemon ID: just a unique identifier for this connection.

Here are the explanation of some settings: On the next page, we have to enter the same key we've used on SME1

Public DNS domain name: (resolves to the public IP of SME2).

Public DNS domain name: (resolves to the public IP of SME1).

Local network: 192.168.9.0/24 (192.168.9.1 being the address of the internal interface of SME1).

Once connected, OpenVPN makes no difference between client and server, we just need to define which endpoint will bind on a local port waiting for a connection of the remote endpoint. A server can only be used by one client (it's not a one server for multiple clients solution), so if you want to connect several SME to one central server, you'll need to create several server daemon, binding on different ports. This contrib lets you create as many servers and clients daemon as you want.

#Openvpn daemon install

Yum -enablerepo=smecontribs install smeserver-openvpn-s2s