87 lines
3.3 KiB
Plaintext
87 lines
3.3 KiB
Plaintext
# OpenVPN road-warrior endpoint — RackNerd hub
|
|
# Auth chain: AD user/pass -> PAM -> RADIUS
|
|
# -> Duo Auth Proxy (127.0.0.1:1812) -> LDAPS to the DCs.
|
|
# No individual client certs: identity is LDAP + Duo only. tls-crypt
|
|
# (shared key in the profile) still gates who can attempt a handshake.
|
|
|
|
port 1194
|
|
proto udp4
|
|
dev tun0
|
|
topology subnet
|
|
|
|
server 172.31.8.0 255.255.255.0
|
|
|
|
# Identity = AD username (username-as-common-name), and one user WILL
|
|
# connect from several devices (laptop + phone). duplicate-cn allows the
|
|
# concurrent sessions and gives each its own pool IP. Sticky per-user IPs
|
|
# (ifconfig-pool-persist) are incompatible with that — do not re-enable.
|
|
duplicate-cn
|
|
|
|
# Split tunnel: only the AD sites + transfer net ride the VPN.
|
|
push "route 192.168.20.0 255.255.255.0"
|
|
push "route 192.168.7.0 255.255.255.0"
|
|
push "route 172.31.255.0 255.255.255.0"
|
|
|
|
# ALL client DNS goes to Technitium. Deliberately NO "dhcp-option DOMAIN"
|
|
# or DOMAIN-SEARCH here: in OpenVPN3 clients (Connect on macOS/iOS/
|
|
# Android/Windows) those options MEAN split-DNS — pushing them scopes the
|
|
# VPN DNS to just those domains. With only DNS pushed, 172.31.8.1 becomes
|
|
# the default resolver for every query. ADAPTER_DOMAIN_SUFFIX sets the
|
|
# Windows connection-specific suffix (short names like "ahdc01" still
|
|
# resolve) without triggering split-DNS. block-outside-dns additionally
|
|
# stops Windows from leaking queries to the local LAN resolver.
|
|
push "dhcp-option DNS 172.31.8.1"
|
|
push "dhcp-option ADAPTER_DOMAIN_SUFFIX ad.atlashorizon.net"
|
|
push "block-outside-dns"
|
|
|
|
# PKI — server certificate only (offline CA, see pki/README.md);
|
|
# clients present no certificate.
|
|
ca /etc/openvpn/pki/ca.crt
|
|
cert /etc/openvpn/pki/server.crt
|
|
key /etc/openvpn/pki/server.key
|
|
dh none
|
|
tls-crypt /etc/openvpn/pki/ta.key
|
|
|
|
tls-version-min 1.2
|
|
data-ciphers AES-256-GCM:CHACHA20-POLY1305
|
|
auth SHA256
|
|
|
|
# User auth via Duo (password only = push; "password,123456" = passcode)
|
|
plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so openvpn
|
|
verify-client-cert none
|
|
username-as-common-name
|
|
hand-window 120 # allow time for the Duo push round-trip
|
|
# Hourly rekey + 12h auth token: renegotiations are satisfied silently by
|
|
# the pushed token (no mid-session Duo prompts); a fresh password + push
|
|
# is only required once the token expires. (auth-gen-token requires a
|
|
# non-zero reneg-sec — do not set reneg-sec 0 here.)
|
|
reneg-sec 3600
|
|
auth-gen-token 43200
|
|
|
|
keepalive 10 60
|
|
explicit-exit-notify 1
|
|
|
|
# wg0 MTU is 1420; keep the client tunnel small enough that client->site
|
|
# packets never fragment inside the WireGuard leg.
|
|
tun-mtu 1400
|
|
mssfix 1360
|
|
|
|
user nobody
|
|
group nogroup
|
|
persist-key
|
|
persist-tun
|
|
|
|
# Register each client as <username>.$VPN_DNS_ZONE (A + PTR) in Technitium
|
|
# on connect, clean up on disconnect. Invoked via sh so the mounted script
|
|
# needs no exec bit. NOTE: openvpn runs hooks with a clean environment, so
|
|
# the script sources /etc/openvpn/learn-address.env (written by the
|
|
# entrypoint from the container env) rather than reading env vars directly.
|
|
script-security 2
|
|
learn-address "/bin/sh /etc/openvpn/learn-address.sh"
|
|
|
|
status /var/lib/openvpn/status.log 30
|
|
# Unix socket (root-only) instead of a passwordless TCP port:
|
|
# docker compose exec openvpn sh -c "socat - UNIX:/var/lib/openvpn/mgmt.sock"
|
|
management /var/lib/openvpn/mgmt.sock unix
|
|
verb 3
|