- move OpenVPN user/group "detection"/config to node
- remove
Binary
class - add missing
ext-json
dependency
- verify and trim
node.key
before using it (#100)
- major changes for 3.x
- also push
0.0.0.0/0
whendefaultGateway
istrue
to work around bug in Windows online detection
tlsProtection
is no longer an option, it is alwaystls-crypt
- update for
ProfileConfig
refactor - fix IP range check
- fix a bug where
max-clients
was one higher than available IPs in the OpenVPN client IP pool - also specify
keepalive
in TCP server config to work around obscure UDP/TCP failover client connection bug
- perform some checks on the profile configuration before writing the OpenVPN
server configuration:
- make sure
profileNumber
is not reused; - make sure the
listen
andvpnProtoPorts
combinations do not overlap between profiles - make sure there is no overlap in IP ranges (
range
/range6
option) assigned to VPN profiles (for now shows warning if there is a problem) - make sure
range
is/29
or lower per OpenVPN process (OpenVPN limitation) - make sure
range6
is/112
or lower per OpenVPN process (OpenVPN limitation)
- make sure
- implement changes for updated
Config
API - add support for pushing
DOMAIN-SEARCH
to VPN clients next toDOMAIN
- update for common HTTP client
- add
ECDSA
certificate support for TLSv1.2, already supported on TLSv1.3
- do not sort OpenVPN server configuration file to avoid having
DOMAIN
ordering also changed indhcp-option
. - no longer need to provide the
hostName
in the API call to generate a certificate, vpn-server-api takes care of that - no need to autoload anything in
bin/generate-firewall.php
- support adding
--up
to the server configuration file when/etc/openvpn/up
exists and is executable
- remove
certificate-info
script as it no longer worked
- the
vpn-server-node-generate-firewall
script is a dummy now. Current firewall is kept, but in order to modify firewalls you have to do this manually now or use your own tools. See documentation.
- renegotiate data channel key every 10 hours instead of every hour
- allow admin to disable installing/generating firewall rules when running
vpn-server-node-generate-firewall --install
for systems without firewall or custom firewall
- fix removal of "default gateway" push when also having routes configured
- fix IPv6 address splitting for >16 OpenVPN processes per profile (issue #43)
- even when
defaultGateway
istrue
push the routes as configured inroute
(issue #44)
- update for server API to handle per profile tls-crypt keys
- write all OpenVPN certificates / keys in the configuration file instead of in a separate directory
- support VPN daemon
- no longer specify
auth none
in server configuration
- use tun_n_ for OpenVPN tunnel interfaces (BSD compat)
- allow up to 64 processes per VPN profile now
- allow deploying only certain profiles on the node for "multi node" deployments
- implement
tlsOneThree
option for profiles to only allow TLSv1.3 connections
- fix IP network/subnet calculation (issue #38)
- support
dnsSuffix
option - include script to generate (reverse) DNS zones for VPN client IPs
- update tests to deal with updates internal API error messages (vpn-lib-common)
- better error when number of vpnProtoPorts is not 1,2,4,8 or 16
- remove 2FA verification through OpenVPN
- when using "split tunnel" configuration, also set a static route to the VPN server through the client's normal gateway to avoid problems when pushing routes that contain the VPN server's public IP address
- remove compression framing support
- remove tls-auth support
- remove "multi instance" support
- update firewalling
- add support for
blockLan
to block traffic to local LAN network when connected to the VPN - deal with
blockSmb
not necessarily being available as a configuration option
- support also 32 bit Fedora/CentOS for determining OpenVPN auth plugin path
- drop OpenVPN 2.3 client support, requires >= 2.4 now
- IPv6 default gateway routing fixes no longer pushed to clients
AES-256-GCM
is required cipher now
- only use
auth SHA256
withtls-auth
, not needed withAES-256-GCM
andtls-crypt
- when DNS servers are set, but VPN is not used as default gateway do send the DNS addresses
- empty
dns
field, i.e.[]
does no longer send any DNS servers, before it would send the IPv4 and IPv6 gateway addresses to the VPN clients - introduce
@GW4@
and@GW6@
macros that can be used indns
that will be replaced by the IPv4 and IPv6 gateway addresses
- implement detector for
auth-script-openvpn
plugin
- when setting
tlsProtection
tofalse
, no longer allowAES-256-CBC
cipher and do not push IPv6 route fix
- cleanup autoloader so Psalm will be able to verify the scripts in and bin and libexec folder
- additional Psalm fixes
- automatically provide IPv4 / IPv6 gateway address as DNS servers when none
specified, i.e.
dns
is[]
anddefaultGateway
istrue
- no longer use
DNS6
, useDNS
also for IPv6 DNS servers - always generate new server certificates when running
server-config
script
- many
vimeo/psalm
fixes
- now always issue an
/112
to OpenVPN processes no matter who many IP space is available (issue #23)
- fix IPv6 prefix when there is only one VPN process (issue #22)
- change the default
--auth-gen-token
lifetime to 12 hours when 2FA is used - support
tlsProtection
, allows disablingtls-auth
andtls-crypt
- update default config to use
enableNat4
andenableNat6
instead ofuseNat
to allow separate configuration of NAT for IPv4 and IPv6
- no longer push
bypass-dhcp
to clients - set
keepalive
to 25 seconds
- autodetect authPlugin instead of requiring configuration option. If plugin is installed, use it
- increase
keepalive
for UDP, remove it for TCP
- firewall config template change, a port is an integer, not a string
- remove hacks for supporting 2.3 clients when
tlsCrypt
is enabled
- autodetect RHEL/CentOS/Fedora or Debian/Ubuntu, no longer need the
--debian
flag forvpn-server-node-generate-firewall
- cleanup autoloading
- push
comp-lzo no
to client when compression is enabled to disable "adaptive compression" in the client - update
eduvpn/common
- support PHPUnit 6
- add
certificate-info
script to show when the OpenVPN server certificates will expire - restructure server configuration file generation
- Psalm fixes
- no longer push
comp-lzo no
, not needed as we don't actually use compression - use same IPv6 default gateway routes on 2.3 clients as are used for 2.4 clients
- add tests for testing server configuration generation
- support disabling compression
- remove
--profile
option for generating server configuration, generate for all profiles by default
- only push
explicit-exit-notify
when using UDP - support for "auth-script-openvpn" plugin for more efficient 2FA integration
- expire 2FA connections after 8 hours, i.e. require new OTP code (#15)
- allow specifying source IP range(s) for INPUT packet filter (#13)
- initial release