66 lines
2.0 KiB
Plaintext
66 lines
2.0 KiB
Plaintext
# OpenVPN road-warrior endpoint — RackNerd hub
|
|
# Auth chain: client cert (offline CA) + user/pass -> PAM -> RADIUS
|
|
# -> Duo Auth Proxy (127.0.0.1:1812) -> LDAPS to the DCs.
|
|
|
|
port 1194
|
|
proto udp4
|
|
dev tun0
|
|
topology subnet
|
|
|
|
server 172.31.8.0 255.255.255.0
|
|
ifconfig-pool-persist /var/lib/openvpn/ipp.txt
|
|
|
|
# Split tunnel: only the AD sites + transfer net ride the VPN.
|
|
push "route 192.168.20.0 255.255.255.0"
|
|
push "route 192.168.7.0 255.255.255.0"
|
|
push "route 172.31.255.0 255.255.255.0"
|
|
|
|
# All client DNS goes to Technitium on this box (block-outside-dns stops
|
|
# Windows from leaking AD lookups to the local LAN resolver).
|
|
push "dhcp-option DNS 172.31.8.1"
|
|
push "dhcp-option DOMAIN ad.atlashorizon.net"
|
|
push "dhcp-option DOMAIN-SEARCH ad.atlashorizon.net"
|
|
push "dhcp-option DOMAIN-SEARCH ad.calliecorner.net"
|
|
push "dhcp-option DOMAIN-SEARCH ad.oswaldtheotter.net"
|
|
push "dhcp-option DOMAIN-SEARCH ad.trochalakis.net"
|
|
push "block-outside-dns"
|
|
|
|
# PKI — issued from the offline CA, see pki/README.md
|
|
ca /etc/openvpn/pki/ca.crt
|
|
cert /etc/openvpn/pki/server.crt
|
|
key /etc/openvpn/pki/server.key
|
|
dh none
|
|
tls-crypt /etc/openvpn/pki/ta.key
|
|
# Enable once you publish a CRL from the offline CA (revoked laptops etc.):
|
|
;crl-verify /etc/openvpn/pki/crl.pem
|
|
|
|
remote-cert-tls client
|
|
tls-version-min 1.2
|
|
data-ciphers AES-256-GCM:CHACHA20-POLY1305
|
|
auth SHA256
|
|
|
|
# User auth via Duo (password only = push; "password,123456" = passcode)
|
|
plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so openvpn
|
|
verify-client-cert require
|
|
username-as-common-name
|
|
hand-window 120 # allow time for the Duo push round-trip
|
|
reneg-sec 0 # no mid-session TLS renegotiation (would re-prompt Duo)
|
|
auth-gen-token 43200 # reconnects within 12h reuse a token instead of a new push
|
|
|
|
keepalive 10 60
|
|
explicit-exit-notify 1
|
|
|
|
# wg0 MTU is 1420; keep the client tunnel small enough that client->site
|
|
# packets never fragment inside the WireGuard leg.
|
|
tun-mtu 1400
|
|
mssfix 1360
|
|
|
|
user nobody
|
|
group nogroup
|
|
persist-key
|
|
persist-tun
|
|
|
|
status /var/lib/openvpn/status.log 30
|
|
management 127.0.0.1 7505
|
|
verb 3
|