#################################################
#                                               #
# This file is for the server side              #
# of a many-clients <-> one-server              #
# OpenVPN configuration.                        #
#                                               #
# Nas konfigurak                                #
#                                               #
# Comments are preceded with '#' or ';'         #
#################################################

# Lokalni rozhrani nedefinovano (takze vsude)
;local a.b.c.d

# protokol a port -> zarizeni
port 1194 #defaultni
;proto tcp
proto udp
dev tun

# tajnosti
#!!!!!!!PODLE SKUTECNOSTI
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
crl-verify crl.pem

# Je to tunel
#!!!!!!!!!!!! IP SI ZVOL
server 10.8.0.0 255.255.255.0

# Maintain a record of client <-> virtual IP address
ifconfig-pool-persist ipp.txt

# nase sit
#!!!!!!!!!!! PODLE SKUTECNOSTI, ASI 192.168.1.0 255.255.255.0
push "route 192.168.5.0 255.255.255.0"

# Klienti veskery IP provoz pres VPN, DNS taky
# nutno pravidlo na FW, aby provoz na
# rozsahu z direktivy "server ..."
# smeroval sem
push "redirect-gateway def1 "

# Certain Windows-specific network settings
# can be pushed to clients, such as DNS
# or WINS server addresses.  CAVEAT:
# http://openvpn.net/faq.html#dhcpcaveats
# The addresses below refer to the public
# DNS servers provided by opendns.com.
#!!!!!!!!!!!!!!
push "dhcp-option DOMAIN vase.domena"
#!!!!!!!!!!!!!! POKUD TI NA UBUNTU BEZI DNS SERVER PRVNI IP Z ROZSAHU (r.30)
push "dhcp-option DNS 10.8.0.1" # ja sam...
#!!!!!!!!!!! PODLE SKUTECNOSTI, ASI 192.168.1.1
push "dhcp-option DNS dns_server"

client-to-client

duplicate-cn

keepalive 10 120

comp-lzo

user nobody
group nobody

persist-key
persist-tun

status /var/log/openvpn-status.log
;log         openvpn.log
log-append  /var/log/openvpn.log

# Set the appropriate level of log
# file verbosity.
#
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 3

# Priprava na podsit klienta
# klient ma klientovaip klientovamaska
# zakazat duplicate-cn (zpoznamkovat)
# pokud je treba, lze client-to-client a push "route klientovaip klientovamaska"
# pridat klientovaip klientovamaska na router
# route klientovaip klientovamaska
# client-config-dir ccd
# do ccd pro klienta KLI soubor KLI s obsahem
# iroute klientovaip klientovamaska


# For extra security beyond that provided
# by SSL/TLS, create an "HMAC firewall"
# to help block DoS attacks and UDP port flooding.
#
# Generate with:
#   openvpn --genkey --secret ta.key
#
# The server and each client must have
# a copy of this key.
# The second parameter should be '0'
# on the server and '1' on the clients.
;tls-auth ta.key 0 # This file is secret

# Select a cryptographic cipher.
# This config item must be copied to
# the client config file as well.
;cipher BF-CBC        # Blowfish (default)
;cipher AES-128-CBC   # AES
;cipher DES-EDE3-CBC  # Triple-DES

# The maximum number of concurrently connected
# clients we want to allow.
;max-clients 100

# Silence repeating messages.  At most 20
# sequential messages of the same message
# category will be output to the log.
;mute 20
