Update ANW-URB.

ANW-URB/openvpn/server-gw-ckubu.conf

@@ -54,6 +54,9 @@ route 192.168.64.0 255.255.255.0 10.1.132.1
 ;dev tap
 dev tun
 
+# Enable TUN IPv6 module
+;tun-ipv6
+
 # Windows needs the TAP-Win32 adapter name
 # from the Network Connections panel if you
 # have more than one.  On XP SP2 or higher,
@@ -77,16 +80,16 @@ dev tun
 # Any X509 key management system can be used.
 # OpenVPN can also use a PKCS #12 formatted key file
 # (see "pkcs12" directive in man page).
-ca keys/ca.crt
-cert keys/server.crt
-key keys/server.key  # This file should be kept secret
+ca /etc/openvpn/gw-ckubu/keys/ca.crt
+cert /etc/openvpn/gw-ckubu/keys/server.crt
+key /etc/openvpn/gw-ckubu/keys/server.key  # This file should be kept secret
 
 # Diffie hellman parameters.
 # Generate your own with:
 #   openssl dhparam -out dh1024.pem 1024
 # Substitute 2048 for 1024 if you are using
-# 2048 bit keys. 
-dh keys/dh1024.pem
+# 2048 bit keys.
+dh /etc/openvpn/gw-ckubu/keys/dh4096.pem
 
 # Configure server mode and supply a VPN subnet
 # for OpenVPN to draw client addresses from.
@@ -95,6 +98,8 @@ dh keys/dh1024.pem
 # Each client will be able to reach the server
 # on 10.8.0.1. Comment this line out if you are
 # ethernet bridging. See the man page for more info.
+;server 10.8.0.0 255.255.255.0
+;server-ipv6 2a01:30:1fff:fd00::/64
 server 10.1.132.0 255.255.255.0
 
 # Maintain a record of client <-> virtual IP address
@@ -102,7 +107,7 @@ server 10.1.132.0 255.255.255.0
 # is restarted, reconnecting clients can be assigned
 # the same virtual IP address from the pool that was
 # previously assigned.
-ifconfig-pool-persist /etc/openvpn/ipp.txt
+ifconfig-pool-persist /etc/openvpn/gw-ckubu/ipp.txt
 
 # Configure server mode for ethernet bridging.
 # You must first use your OS's bridging capability
@@ -123,39 +128,44 @@ ifconfig-pool-persist /etc/openvpn/ipp.txt
 # to know to route the OpenVPN client
 # address pool (10.8.0.0/255.255.255.0)
 # back to the OpenVPN server.
-;push "route 192.168.23.0 255.255.255.0"
-;push "route 192.168.82.0 255.255.255.0"
-;push "route 192.168.132.0 255.255.255.0"
-;push "route 192.168.133.0 255.255.255.0"
+;push "route 10.8.0.0  255.255.255.0"
 
 # To assign specific IP addresses to specific
 # clients or if a connecting client has a private
 # subnet behind it that should also have VPN access,
 # use the subdirectory "ccd" for client-specific
 # configuration files (see man page for more info).
+client-config-dir /etc/openvpn/gw-ckubu/ccd/server-gw-ckubu
 
+# ---
 # EXAMPLE: Suppose the client
 # having the certificate common name "Thelonious"
 # also has a small subnet behind his connecting
 # machine, such as 192.168.40.128/255.255.255.248.
 # First, uncomment out these lines:
-client-config-dir /etc/openvpn/ccd/server-gw-ckubu
+;client-config-dir /etc/openvpn/ccd
 ;route 192.168.40.128 255.255.255.248
+
 # Then create a file ccd/Thelonious with this line:
 #   iroute 192.168.40.128 255.255.255.248
 # This will allow Thelonious' private subnet to
 # access the VPN.  This example will only work
 # if you are routing, not bridging, i.e. you are
 # using "dev tun" and "server" directives.
+# ---
 
+# ---
 # EXAMPLE: Suppose you want to give
 # Thelonious a fixed VPN IP address of 10.9.0.1.
 # First uncomment out these lines:
 ;client-config-dir ccd
 ;route 10.9.0.0 255.255.255.252
+
 # Then add this line to ccd/Thelonious:
 #   ifconfig-push 10.9.0.1 10.9.0.2
+# ---
 
+# ---
 # Suppose that you want to enable different
 # firewall access policies for different groups
 # of clients.  There are two methods:
@@ -167,6 +177,7 @@ client-config-dir /etc/openvpn/ccd/server-gw-ckubu
 #     from different clients.  See man
 #     page for more info on learn-address script.
 ;learn-address ./script
+# ---
 
 # If enabled, this directive will configure
 # all clients to redirect their default
@@ -188,10 +199,7 @@ client-config-dir /etc/openvpn/ccd/server-gw-ckubu
 # can be pushed to clients, such as DNS
 # or WINS server addresses.  CAVEAT:
 # http://openvpn.net/faq.html#dhcpcaveats
-;push "dhcp-option DNS 10.8.0.1"
 ;push "dhcp-option WINS 10.8.0.1"
-;push "dhcp-option DNS 192.168.132.1"
-;push "dhcp-option DOMAIN anwaeltinnen.netz"
 
 # Uncomment this directive to allow different
 # clients to be able to "see" each other.
@@ -235,7 +243,7 @@ keepalive 10 120
 # The second parameter should be '0'
 # on the server and '1' on the clients.
 ;tls-auth ta.key 0 # This file is secret
-tls-auth keys/ta.key 0
+tls-auth /etc/openvpn/gw-ckubu/keys/ta.key 0
 
 # Select a cryptographic cipher.
 # This config item must be copied to
@@ -243,11 +251,12 @@ tls-auth keys/ta.key 0
 ;cipher BF-CBC        # Blowfish (default)
 ;cipher AES-128-CBC   # AES
 ;cipher DES-EDE3-CBC  # Triple-DES
+cipher AES-256-CBC
 
 # Enable compression on the VPN link.
 # If you enable it here, you must also
 # enable it in the client config file.
-comp-lzo
+;comp-lzo
 
 # The maximum number of concurrently connected
 # clients we want to allow.
@@ -269,9 +278,11 @@ persist-key
 persist-tun
 persist-local-ip
 persist-remote-ip
+
 # Output a short status file showing
 # current connections, truncated
 # and rewritten every minute.
+;status openvpn-status.log
 status /var/log/openvpn/status-server-gw-ckubu.log
 
 # By default, log messages will go to the syslog (or
@@ -281,8 +292,9 @@ status /var/log/openvpn/status-server-gw-ckubu.log
 # "log" will truncate the log file on OpenVPN startup,
 # while "log-append" will append to it.  Use one
 # or the other (but not both).
-log         /var/log/openvpn/server-gw-ckubu.log
 ;log-append  openvpn.log
+;log         openvpn.log
+log         /var/log/openvpn/server-gw-ckubu.log
 
 # Set the appropriate level of log
 # file verbosity.
@@ -291,11 +303,12 @@ log         /var/log/openvpn/server-gw-ckubu.log
 # 4 is reasonable for general usage
 # 5 and 6 can help to debug connection problems
 # 9 is extremely verbose
-verb 4
+verb 1
 
 # Silence repeating messages.  At most 20
 # sequential messages of the same message
 # category will be output to the log.
 ;mute 20
 
-#crl-verify /etc/openvpn/keys/crl.pem
+# CRL (certificate revocation list) verification
+crl-verify /etc/openvpn/gw-ckubu/crl.pem