OpenVPN is a robust, scalable and highly configurable VPN (Virtual Private
Network) daemon which can be used to securely link two or more private networks
using an encrypted tunnel over the internet. It can operate over UDP or TCP,
can use SSL or a pre-shared secret to authenticate peers, and in SSL mode, one
server can handle many clients.
===> The following configuration options are available for openvpn25-2.5.9:
ASYNC_PUSH=off: Enable async-push support
DOCS=on: Build and/or install documentation
EASYRSA=on: Install security/easy-rsa RSA helper package
EXAMPLES=on: Build and/or install examples
LZ4=on: LZ4 compression support
LZO=on: LZO compression (incompatible with LibreSSL)
PKCS11=on: Use security/pkcs11-helper, needs same SSL lib!
SMALL=off: Build a smaller executable with fewer features
TEST=on: Build and/or run tests
UNITTESTS=off: Enable unit tests
X509ALTUSERNAME=off: Enable --x509-username-field
===> Use 'make config' to modify these settings
Edit /etc/rc.conf[.local] to start OpenVPN automatically at system
startup. See /usr/local/etc/rc.d/openvpn for details.
Connect to VPN server as a client with this command to include
the client.up/down scripts in the initialization:
openvpn-client <spec>.ovpn
For compatibility notes when interoperating with older OpenVPN
versions, please see <http://openvpn.net/relnotes.html>
Note that OpenVPN does not officially support LibreSSL.
Note that OpenVPN configures a separate user and group "openvpn",
which should be used instead of the NFS user "nobody"
when an unprivileged user account is desired.
You may want to add user openvpn and group openvpn when creating your
configuration files, the example configuration shows this only as comments.
If upgrading
Note that OpenVPN now configures a separate user and group "openvpn",
which should be used instead of the NFS user "nobody"
when an unprivileged user account is desired.
It is advisable to review existing configuration files and
to consider adding/changing user openvpn and group openvpn.
security/openvpn*: update to 2.6.0, keep openvpn25
- copy openvpn to openvpn25, mark as deprecated and to expire March 31
- update openvpn to openvpn 2.6.0, highlights from Frank Lichtenheld's
release announcement e-mail, slightly edited:
* Data Channel Offload (DCO) kernel acceleration support for Windows,
Linux, and FreeBSD [14].
* OpenSSL 3 support
* Improved handling of tunnel MTU, including support for pushable MTU.
* Outdated cryptographic algorithms disabled by default, but there are
options to override if necessary.
* Reworked TLS handshake, making OpenVPN immune to replay-packet state
exhaustion attacks.
* Added --peer-fingerprint mode for a more simplistic certificate setup
and verification.
* Improved protocol negotiation, leading to faster connection setup.
ChangeLog: https://github.com/OpenVPN/openvpn/blob/v2.6.0/Changes.rst
