2026-02-10 00:37:00 +08:00 · 2018-03-21 12:14:41 +01:00
parent 7b4c1bae5a
commit 0de68ef4b1
3 changed files with 488 additions and 2 deletions
							
							
							
						
@@ -0,0 +1,421 @@
# User authentication method. Could be set multiple times and in that case
# all should succeed.
# Options: certificate, pam. 
auth = "certificate"
#auth = "plain[./data/test1.passwd]"
#auth = "pam"
# A banner to be displayed on clients
#banner = "Welcome"
# Use listen-host to limit to specific IPs or to the IPs of a provided hostname.
#listen-host = [IP|HOSTNAME]
use-dbus = no
# Limit the number of clients. Unset or set to zero for unlimited.
#max-clients = 1024
max-clients = 16
# Limit the number of client connections to one every X milliseconds 
# (X is the provided value). Set to zero for no limit.
#rate-limit-ms = 100
# Limit the number of identical clients (i.e., users connecting multiple times)
# Unset or set to zero for unlimited.
max-same-clients = 2
# TCP and UDP port number
tcp-port = 4513
udp-port = 4513
# Keepalive in seconds
keepalive = 32400
# Dead peer detection in seconds
dpd = 440
# MTU discovery (DPD must be enabled)
try-mtu-discovery = false
# The key and the certificates of the server
# The key may be a file, or any URL supported by GnuTLS (e.g., 
# tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user
# or pkcs11:object=my-vpn-key;object-type=private)
#
# There may be multiple certificate and key pairs and each key
# should correspond to the preceding certificate.
server-cert = ./certs/server-cert.pem
server-key = ./certs/server-key.pem
# Diffie-Hellman parameters. Only needed if you require support
# for the DHE ciphersuites (by default this server supports ECDHE).
# Can be generated using:
# certtool --generate-dh-params --outfile /path/to/dh.pem
#dh-params = /path/to/dh.pem
# If you have a certificate from a CA that provides an OCSP
# service you may provide a fresh OCSP status response within
# the TLS handshake. That will prevent the client from connecting
# independently on the OCSP server.
# You can update this response periodically using:
# ocsptool --ask --load-cert=your_cert --load-issuer=your_ca --outfile response
# Make sure that you replace the following file in an atomic way.
#ocsp-response = /path/to/ocsp.der
# In case PKCS #11 or TPM keys are used the PINs should be available
# in files. The srk-pin-file is applicable to TPM keys only (It's the storage
# root key).
#pin-file = /path/to/pin.txt
#srk-pin-file = /path/to/srkpin.txt
# The Certificate Authority that will be used
# to verify clients if certificate authentication
# is set.
ca-cert = ./certs/ca.pem
# The object identifier that will be used to read the user ID in the client certificate.
# The object identifier should be part of the certificate's DN
# Useful OIDs are: 
#  CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1
cert-user-oid = 0.9.2342.19200300.100.1.1
# The object identifier that will be used to read the user group in the client 
# certificate. The object identifier should be part of the certificate's DN
# Useful OIDs are: 
#  OU (organizational unit) = 2.5.4.11 
#cert-group-oid = 2.5.4.11
# A revocation list of ca-cert is set
#crl = /path/to/crl.pem
# GnuTLS priority string
tls-priorities = "PERFORMANCE:%SERVER_PRECEDENCE:%COMPAT"
# To enforce perfect forward secrecy (PFS) on the main channel.
#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA"
# The time (in seconds) that a client is allowed to stay connected prior
# to authentication
auth-timeout = 40
# The time (in seconds) that a client is not allowed to reconnect after 
# a failed authentication attempt.
#min-reauth-time = 2
# Cookie validity time (in seconds)
# Once a client is authenticated he's provided a cookie with
# which he can reconnect. This option sets the maximum lifetime
# of that cookie.
cookie-validity = 172800
# Script to call when a client connects and obtains an IP
# Parameters are passed on the environment.
# REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client), 
# DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP
# in the P-t-P connection), IP_REMOTE (the VPN IP of the client). REASON
# may be "connect" or "disconnect".
#connect-script = /usr/bin/myscript
#disconnect-script = /usr/bin/myscript
# UTMP
use-utmp = true
# PID file
pid-file = /var/run/ocserv.pid
# The default server directory. Does not require any devices present.
#chroot-dir = /path/to/chroot
# socket file used for IPC, will be appended with .PID
# It must be accessible within the chroot environment (if any)
socket-file = /var/run/ocserv-socket
# The user the worker processes will be run as. It should be
# unique (no other services run as this user).
run-as-user = nobody
run-as-group = daemon
# Network settings
device = vpns
# The default domain to be advertised
default-domain = example.com
ipv4-network = 192.168.5.0
ipv4-netmask = 255.255.255.0
# Use the keywork local to advertize the local P-t-P address as DNS server
ipv4-dns = 192.168.5.1
# The NBNS server (if any)
#ipv4-nbns = 192.168.2.3
#ipv6-address = 
#ipv6-mask = 
#ipv6-dns = 
# Prior to leasing any IP from the pool ping it to verify that
# it is not in use by another (unrelated to this server) host.
ping-leases = false
# Leave empty to assign the default MTU of the device
# mtu = 
no-route = 192.168.98.0/255.255.255.0
route = 10.10.0.0/24
route = 10.10.1.0/24
route = 10.10.2.0/24
route = 10.10.3.0/24
route = 10.10.4.0/24
route = 10.10.5.0/24
route = 10.10.6.0/24
route = 10.10.7.0/24
route = 10.10.8.0/24
route = 10.10.9.0/24
route = 10.10.10.0/24
route = 10.10.11.0/24
route = 10.10.12.0/24
route = 10.10.13.0/24
route = 10.10.14.0/24
route = 10.10.15.0/24
route = 10.10.16.0/24
route = 10.10.17.0/24
route = 10.10.18.0/24
route = 10.10.19.0/24
route = 10.10.20.0/24
route = 10.10.21.0/24
route = 10.10.22.0/24
route = 10.10.23.0/24
route = 10.10.24.0/24
route = 10.10.25.0/24
route = 10.10.26.0/24
route = 10.10.27.0/24
route = 10.10.28.0/24
route = 10.10.29.0/24
route = 10.10.30.0/24
route = 10.10.31.0/24
route = 10.10.32.0/24
route = 10.10.33.0/24
route = 10.10.34.0/24
route = 10.10.35.0/24
route = 10.10.36.0/24
route = 10.10.37.0/24
route = 10.10.38.0/24
route = 10.10.39.0/24
route = 10.10.40.0/24
route = 10.10.41.0/24
route = 10.10.42.0/24
route = 10.10.43.0/24
route = 10.10.44.0/24
route = 10.10.45.0/24
route = 10.10.46.0/24
route = 10.10.47.0/24
route = 10.10.48.0/24
route = 10.10.49.0/24
route = 10.10.50.0/24
route = 10.10.51.0/24
route = 10.10.52.0/24
route = 10.10.53.0/24
route = 10.10.54.0/24
route = 10.10.55.0/24
route = 10.10.56.0/24
route = 10.10.57.0/24
route = 10.10.58.0/24
route = 10.10.59.0/24
route = 10.10.60.0/24
route = 10.10.61.0/24
route = 10.10.62.0/24
route = 10.10.63.0/24
route = 10.10.64.0/24
route = 10.10.65.0/24
route = 10.10.66.0/24
route = 10.10.67.0/24
route = 10.10.68.0/24
route = 10.10.69.0/24
route = 10.10.70.0/24
route = 10.10.71.0/24
route = 10.10.72.0/24
route = 10.10.73.0/24
route = 10.10.74.0/24
route = 10.10.75.0/24
route = 10.10.76.0/24
route = 10.10.77.0/24
route = 10.10.78.0/24
route = 10.10.79.0/24
route = 10.10.80.0/24
route = 10.10.81.0/24
route = 10.10.82.0/24
route = 10.10.83.0/24
route = 10.10.84.0/24
route = 10.10.85.0/24
route = 10.10.86.0/24
route = 10.10.87.0/24
route = 10.10.88.0/24
route = 10.10.89.0/24
route = 10.10.90.0/24
route = 10.10.91.0/24
route = 10.10.92.0/24
route = 10.10.93.0/24
route = 10.10.94.0/24
route = 10.10.95.0/24
route = 10.10.96.0/24
route = 10.10.97.0/24
route = 10.10.98.0/24
route = 10.10.99.0/24
route = 10.10.100.0/24
route = 10.10.101.0/24
route = 10.10.102.0/24
route = 10.10.103.0/24
route = 10.10.104.0/24
route = 10.10.105.0/24
route = 10.10.106.0/24
route = 10.10.107.0/24
route = 10.10.108.0/24
route = 10.10.109.0/24
route = 10.10.110.0/24
route = 10.10.111.0/24
route = 10.10.112.0/24
route = 10.10.113.0/24
route = 10.10.114.0/24
route = 10.10.115.0/24
route = 10.10.116.0/24
route = 10.10.117.0/24
route = 10.10.118.0/24
route = 10.10.119.0/24
route = 10.10.120.0/24
route = 10.10.121.0/24
route = 10.10.122.0/24
route = 10.10.123.0/24
route = 10.10.124.0/24
route = 10.10.125.0/24
route = 10.10.126.0/24
route = 10.10.127.0/24
route = 10.10.128.0/24
route = 10.10.129.0/24
route = 10.10.130.0/24
route = 10.10.131.0/24
route = 10.10.132.0/24
route = 10.10.133.0/24
route = 10.10.134.0/24
route = 10.10.135.0/24
route = 10.10.136.0/24
route = 10.10.137.0/24
route = 10.10.138.0/24
route = 10.10.139.0/24
route = 10.10.140.0/24
route = 10.10.141.0/24
route = 10.10.142.0/24
route = 10.10.143.0/24
route = 10.10.144.0/24
route = 10.10.145.0/24
route = 10.10.146.0/24
route = 10.10.147.0/24
route = 10.10.148.0/24
route = 10.10.149.0/24
route = 10.10.150.0/24
route = 10.10.151.0/24
route = 10.10.152.0/24
route = 10.10.153.0/24
route = 10.10.154.0/24
route = 10.10.155.0/24
route = 10.10.156.0/24
route = 10.10.157.0/24
route = 10.10.158.0/24
route = 10.10.159.0/24
route = 10.10.160.0/24
route = 10.10.161.0/24
route = 10.10.162.0/24
route = 10.10.163.0/24
route = 10.10.164.0/24
route = 10.10.165.0/24
route = 10.10.166.0/24
route = 10.10.167.0/24
route = 10.10.168.0/24
route = 10.10.169.0/24
route = 10.10.170.0/24
route = 10.10.171.0/24
route = 10.10.172.0/24
route = 10.10.173.0/24
route = 10.10.174.0/24
route = 10.10.175.0/24
route = 10.10.176.0/24
route = 10.10.177.0/24
route = 10.10.178.0/24
route = 10.10.179.0/24
route = 10.10.180.0/24
route = 10.10.181.0/24
route = 10.10.182.0/24
route = 10.10.183.0/24
route = 10.10.184.0/24
route = 10.10.185.0/24
route = 10.10.186.0/24
route = 10.10.187.0/24
route = 10.10.188.0/24
route = 10.10.189.0/24
route = 10.10.190.0/24
route = 10.10.191.0/24
route = 10.10.192.0/24
route = 10.10.193.0/24
route = 10.10.194.0/24
route = 10.10.195.0/24
route = 10.10.196.0/24
route = 10.10.197.0/24
route = 10.10.198.0/24
route = 10.10.199.0/24
route = 10.10.200.0/24
route = 10.10.201.0/24
route = 10.10.202.0/24
route = 10.10.203.0/24
route = 10.10.204.0/24
route = 10.10.205.0/24
route = 10.10.206.0/24
route = 10.10.207.0/24
route = 10.10.208.0/24
route = 10.10.209.0/24
route = 10.10.210.0/24
route = 10.10.211.0/24
route = 10.10.212.0/24
route = 10.10.213.0/24
route = 10.10.214.0/24
route = 10.10.215.0/24
route = 10.10.216.0/24
route = 10.10.217.0/24
route = 10.10.218.0/24
route = 10.10.219.0/24
route = 10.10.220.0/24
route = 10.10.221.0/24
route = 10.10.222.0/24
route = 10.10.223.0/24
route = 10.10.224.0/24
route = 10.10.225.0/24
route = 10.10.226.0/24
route = 10.10.227.0/24
route = 10.10.228.0/24
route = 10.10.229.0/24
route = 10.10.230.0/24
route = 10.10.231.0/24
route = 10.10.232.0/24
route = 10.10.233.0/24
route = 10.10.234.0/24
route = 10.10.235.0/24
route = 10.10.236.0/24
route = 10.10.237.0/24
route = 10.10.238.0/24
route = 10.10.239.0/24
route = 10.10.240.0/24
route = 10.10.241.0/24
route = 10.10.242.0/24
route = 10.10.243.0/24
route = 10.10.244.0/24
route = 10.10.245.0/24
route = 10.10.246.0/24
route = 10.10.247.0/24
route = 10.10.248.0/24
route = 10.10.249.0/24
route = 10.10.250.0/24
route = 10.10.251.0/24
route = 10.10.252.0/24
route = 10.10.253.0/24
route = 10.10.254.0/24
route = 10.10.255.0/24