client dev mullvad dev-type tun proto udp remote {{ mullvad_country }}.mullvad.net 1300 cipher AES-256-CBC # Tunnel IPv6 traffic as well as IPv4 tun-ipv6 # Keep trying indefinitely to resolve the # host name of the OpenVPN server. Very useful # on machines which are not permanently connected # to the internet such as laptops. resolv-retry infinite # Most clients don't need to bind to # a specific local port number. nobind # Try to preserve some state across restarts. persist-key persist-tun # Enable compression on the VPN link. comp-lzo # Set log file verbosity. verb 3 remote-cert-tls server ping-restart 60 # Allow calling of built-in executables and user-defined scripts. script-security 2 # Parses DHCP options from openvpn to update resolv.conf #up /etc/openvpn/update-resolv-conf #down /etc/openvpn/update-resolv-conf ping 10 ca /etc/openvpn/client/ca.crt cert /etc/openvpn/client/mullvad.crt key /etc/openvpn/client/mullvad.key crl-verify /etc/openvpn/client/crl.pem # Limit range of possible TLS cipher-suites tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA:TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA:TLS-DHE-RSA-WITH-AES-128-CBC-SHA:TLS-DHE-RSA-WITH-SEED-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA # Update routing information. # Do not use standard configuration pushed via DHCP! route-noexec up /etc/openvpn/client/mullvad-up.sh