openVPN 2.1_rc7 (server) on openBSD 4.3 config examples

[s2scott]

I've successfully set up and openVPN (server) many-to-one (clients-to-gateway) vpn topology on an openBSD 4.3 pf firewall/gateway machine. Just sharing the config files here for anyone interested. Hope it helps someone, someday.

root@gw:/etc/ovpn # pg /etc/hostname.tun0
inet 169.254.235.1 255.255.255.252 169.254.235.2
!/sbin/route add 169.254.235.0/24 169.254.235.1
#

# /etc/ovpn/server.ovpn
# ---
tls-server
mode server
ifconfig-nowarn
ifconfig-pool 169.254.235.10 169.254.235.20
# ---
ca /etc/ovpn/keys/ca.cert.pem
dh /etc/ovpn/dh2048.pem
cert /etc/ovpn/keys/vpn.mydomain.ca.pem
key /etc/ovpn/keys/vpn.mydomain.ca.key
tls-auth /etc/ovpn/keys/tls-auth.key 0
max-clients 8

client-to-client
local vpn.mydomain.ca.
port 1194
proto udp
dev tun0
mssfix
tun-mtu 1500
daemon openvpn1194

push "redirect-gateway def1"

keepalive 30 120
ping-timer-rem
persist-tun
persist-key

tls-cipher DHE-RSA-AES256-SHA   # the key-exchange is 256-bit protected
cipher AES-128-CBC   # the data stream is sufficiently protected @ 128-bit
; cipher AES-128-OFB  # better cipher for use with streaming traffic e.g. sip

user _openvpn   # per openbsd package, use "nobody" otherwise
group _openvpn   # per openbsd package, use "nobody" otherwise

writepid /var/run/openvpn1194.pid
log    /var/log/openvpn.log
status /var/log/openvpn-status.log
verb 4
mute 5

[s2scott]

root@gw:/etc/ovpn # pg /etc/hostname.tun0
inet 169.254.235.1 255.255.255.252 169.254.235.2
!/sbin/route add 169.254.235.0/24 169.254.235.1
#

used in place of...

root@gw:pg /etc/ovpn/server.ovpn
ifconfig 169.254.235.1 169.254.235.2
route 169.254.235.0/24 169.254.235.1
#

I haven't drilled into it, but the openVPN uid _openvpn doesn't appear to have authority to effect the tun0 ifconfig nor the route add. By letting it happen through the hostname.tun0, it "just works."

Perhaps someone knows a better fix. It may be related to the fact that I mimicked -- likely imperfectly -- the _openvpn uid/gid framwork of openvpn 2.0.n package install.

/S

[s2scott]

I stand humbly before you folks, hat in hand and one hole in my foot...

In my server.ovpn config, I had ...

Incorrect...

user nobody
group nobody

Correct, per the "official" openbsd openvpn 2.0.n packages,...

user _openvpn
group _openvpn

/S