OpenVPN#
Protect → OpenVPN manages the router's OpenVPN instances. An instance is one of three things: a server that remote devices connect to, a client of another server, or one site-to-site end of a tunnel between two routers. Certificates and keys come from the router's own certificate store, and the agent makes the ones that are missing. A server's clients — their certificates, their configuration files, their revocation — are run from the server's settings.
What the page shows#
Four tiles: the number of instances, and how many are servers, clients and site-to-site ends. Then one row per instance:
| Column | Shows |
|---|---|
| Instance | Its name, vtun and a number, with its description. |
| Mode | Server, Client or Site-to-site. |
| Transport | UDP, TCP (listen) or TCP (dial), and the port it listens on. |
| Connects to | The server or other router it dials. |
| Authentication | Certificates or Shared secret. |
| Client network | The network a server gives its clients addresses from. |
| Status | For a server, how many clients are connected; Off for an instance that is turned off. |
Adding an instance#
Add instance opens a panel. Choose Server, Client or Site-to-site, then:
| Field | What it is |
|---|---|
| Name | vtun and a number. The lowest free one is filled in. |
| Description | Optional. |
| Transport | UDP; TCP (listen) for a server or a site-to-site end that waits; TCP (dial) for a client or an end that connects. |
| Listen port | For an instance that listens. 1194. |
| Server or Other router, and its port | For an instance that dials. A site-to-site end left empty waits for the other end. |
| Keep the tunnel up across restarts | On by default. |
| Allow the listen port through the firewall | On by default: adds an input firewall rule for the port when the input firewall would drop it — after the chain's accept rules, before the first rule that does anything else. |
A server also takes its Client network — clients are given addresses from it, and the router takes the first — the Routes for clients, the networks clients reach through the tunnel, and the DNS servers for clients.
A site-to-site end takes its Tunnel address, the Other end's tunnel address, a Subnet mask, and a Cipher both ends use. It authenticates with a Shared secret both routers hold — the router marks these as deprecated — or with Certificates and a TLS role: one end waits, the other opens the session.
Security#
Hash is the message digest, or Default.
Certificates come On the router — an authority and a certificate the store already holds — or are generated: the agent makes a certificate authority and a certificate signed by it, or signs a new certificate with an authority whose key is on the router. Paste takes material an authority elsewhere issued; the agent checks the certificate against the authority and the key against the certificate before anything is added.
TLS key protects the handshake before any certificate is shown: Encrypt (tls-crypt), the default, Authenticate (tls-auth), or None. The key is one the router holds, one you paste, or a new one the agent generates.
Continue has the agent check the plan and shows it: the certificates it will use or make, with their subjects, expiry and fingerprints, the keys by fingerprint, and Before you apply — anything the instance needs that it does not have yet. Add instance adds it to the pending changes; Back returns to the form, and any change there makes a new plan.
Changing an instance#
Selecting an instance opens its settings. Save changes adds only what differs.
- Settings: the transport and listen port; for a server its client networks, routes and DNS servers for clients; for a client or site-to-site end the server or other router and its port, and for a site-to-site end its tunnel addresses, subnet mask, cipher and TLS role; the hash; the description; Keep the tunnel up across restarts; and Turned off, which keeps the instance configured and stops it running.
- Certificates: the certificate authority and the certificate, from the router's store.
- TLS key: None, Encrypt (tls-crypt) or Authenticate (tls-auth), with a key the router holds, or Generate a new key — the agent makes the key and adds it to the pending changes without it reaching the page.
- Firewall: when the input firewall drops the listen port, the panel says so and Allow UDP port 1194 adds the rule.
A server shows Connected clients at the top of its settings: each client's name, the address it connected from, its address in the tunnel, the traffic sent and received, and when it connected.
Delete instance asks again — Delete vtun0? — and removes it. Certificates and keys stay in the store.
A server's clients#
A server that authenticates with certificates lists its clients under Clients: every certificate in the store signed by the server's authority for a client, with its expiry.
| Control | What it does |
|---|---|
| Address clients connect to | The router's public address, or a host name that points to it. It starts as the address last used for this server, or the router's WAN address. |
| New client and Add client | The agent signs a certificate for the client with the server's authority. Its private key goes straight into the pending changes and is never sent to the browser; the pending changes and the audit trail show [redacted] in its place. The authority's key has to be on the router. |
| Download | Administrators only. The client's configuration file, <client>.ovpn: the transport, the address and port to connect to, the ciphers and hash, the authority's certificate, the client's certificate and private key, and the server's TLS key. No other private key the router holds is ever in it. Every download is recorded in the audit trail, and a refused one too. |
| Revoke | Asks again — Revoke laptop? — then marks the certificate revoked and gives the authority a new revocation list naming it, which the server checks every client against. |
Download works once the new client's change is applied. The file holds the client's private key: store it the way you would a password.
Advanced mode#
With Advanced mode on (Account → Preferences) the page adds a CLI view — the instances as commands, and the router's own status text for each mode — and a preview of the commands each change adds. Keys in a plan's preview are withheld for every role.
See also#
- The VPN guides — which VPN fits which job.
- WireGuard — simpler for remote devices, with a QR code per device.
- IPsec — when the other end is not yours.
- Security, VPN and accounts — the rest of this section.