|
|
|
|
client
|
|
|
|
|
|
|
|
|
|
dev mullvad
|
|
|
|
|
dev-type tun
|
|
|
|
|
|
|
|
|
|
proto udp
|
|
|
|
|
|
|
|
|
|
remote {{ mullvad_country }}.mullvad.net 1300
|
|
|
|
|
cipher AES-256-CBC
|
|
|
|
|
|
|
|
|
|
# Tunnel IPv6 traffic as well as IPv4
|
|
|
|
|
tun-ipv6
|
|
|
|
|
|
|
|
|
|
# Keep trying indefinitely to resolve the
|
|
|
|
|
# host name of the OpenVPN server. Very useful
|
|
|
|
|
# on machines which are not permanently connected
|
|
|
|
|
# to the internet such as laptops.
|
|
|
|
|
resolv-retry infinite
|
|
|
|
|
|
|
|
|
|
# Most clients don't need to bind to
|
|
|
|
|
# a specific local port number.
|
|
|
|
|
nobind
|
|
|
|
|
|
|
|
|
|
# Try to preserve some state across restarts.
|
|
|
|
|
persist-key
|
|
|
|
|
persist-tun
|
|
|
|
|
|
|
|
|
|
# Enable compression on the VPN link.
|
|
|
|
|
comp-lzo
|
|
|
|
|
|
|
|
|
|
# Set log file verbosity.
|
|
|
|
|
verb 3
|
|
|
|
|
|
|
|
|
|
remote-cert-tls server
|
|
|
|
|
|
|
|
|
|
ping-restart 60
|
|
|
|
|
|
|
|
|
|
# Allow calling of built-in executables and user-defined scripts.
|
|
|
|
|
script-security 2
|
|
|
|
|
|
|
|
|
|
# Parses DHCP options from openvpn to update resolv.conf
|
|
|
|
|
#up /etc/openvpn/update-resolv-conf
|
|
|
|
|
#down /etc/openvpn/update-resolv-conf
|
|
|
|
|
|
|
|
|
|
ping 10
|
|
|
|
|
|
|
|
|
|
ca /etc/openvpn/client/ca.crt
|
|
|
|
|
cert /etc/openvpn/client/mullvad.crt
|
|
|
|
|
key /etc/openvpn/client/mullvad.key
|
|
|
|
|
|
|
|
|
|
crl-verify /etc/openvpn/client/crl.pem
|
|
|
|
|
|
|
|
|
|
# Limit range of possible TLS cipher-suites
|
|
|
|
|
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA:TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA:TLS-DHE-RSA-WITH-AES-128-CBC-SHA:TLS-DHE-RSA-WITH-SEED-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA
|
|
|
|
|
|
|
|
|
|
# Update routing information.
|
|
|
|
|
# Do not use standard configuration pushed via DHCP!
|
|
|
|
|
route-noexec
|
|
|
|
|
up-restart
|
|
|
|
|
up /etc/openvpn/client/mullvad-up.sh
|
