3 --remote www.flypig.org.uk 1194
4 --resolv-retry infinite
10 --ca "/home/flypig/Documents/Configure/OpenVPN/ca.crt"
11 --cert "/home/flypig/Documents/Configure/OpenVPN/Montefalco.crt"
12 --key "/home/flypig/Documents/Configure/OpenVPN/Montefalco.key"
13 --tls-auth "/home/flypig/Documents/Configure/OpenVPN/ta.key" 1
18 OpenVPN 2.2.2 armv7l-unknown-linux-gnueabi [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Jan 20 2014
21 --config file : Read configuration options from file.
22 --help : Show options.
23 --version : Show copyright and version information.
26 --local host : Local host name or ip address. Implies --bind.
27 --remote host [port] : Remote host name or ip address.
28 --remote-random : If multiple --remote options specified, choose one randomly.
29 --remote-random-hostname : Add a random string to remote DNS name.
30 --mode m : Major mode, m = 'p2p' (default, point-to-point) or 'server'.
31 --proto p : Use protocol p for communicating with peer.
32 p = udp (default), tcp-server, or tcp-client
33 --proto-force p : only consider protocol p in list of connection profiles.
34 --connect-retry n : For --proto tcp-client, number of seconds to wait
35 between connection retries (default=5).
36 --connect-timeout n : For --proto tcp-client, connection timeout (in seconds).
37 --connect-retry-max n : Maximum connection attempt retries, default infinite.
38 --auto-proxy : Try to sense proxy settings (or lack thereof) automatically.
39 --show-proxy-settings : Show sensed proxy settings.
40 --http-proxy s p [up] [auth] : Connect to remote host
41 through an HTTP proxy at address s and port p.
42 If proxy authentication is required,
43 up is a file containing username/password on 2 lines, or
44 'stdin' to prompt from console. Add auth='ntlm' if
45 the proxy requires NTLM authentication.
46 --http-proxy s p 'auto[-nct]' : Like the above directive, but automatically
47 determine auth method and query for username/password
48 if needed. auto-nct disables weak proxy auth methods.
49 --http-proxy-retry : Retry indefinitely on HTTP proxy errors.
50 --http-proxy-timeout n : Proxy timeout in seconds, default=5.
51 --http-proxy-option type [parm] : Set extended HTTP proxy options.
52 Repeat to set multiple options.
53 VERSION version (default=1.0)
55 --socks-proxy s [p] [up] : Connect to remote host through a Socks5 proxy at
56 address s and port p (default port = 1080).
57 If proxy authentication is required,
58 up is a file containing username/password on 2 lines, or
59 'stdin' to prompt for console.
60 --socks-proxy-retry : Retry indefinitely on Socks proxy errors.
61 --resolv-retry n: If hostname resolve fails for --remote, retry
62 resolve for n seconds before failing (disabled by default).
63 Set n="infinite" to retry indefinitely.
64 --float : Allow remote to change its IP address/port, such as through
65 DHCP (this is the default if --remote is not used).
66 --ipchange cmd : Execute shell command cmd on remote ip address initial
67 setting or change -- execute as: cmd ip-address port#
68 --port port : TCP/UDP port # for both local and remote.
69 --lport port : TCP/UDP port # for local (default=1194). Implies --bind.
70 --rport port : TCP/UDP port # for remote (default=1194).
71 --bind : Bind to local address and port. (This is the default unless
72 --proto tcp-client or --http-proxy or --socks-proxy is used).
73 --nobind : Do not bind to local address and port.
74 --dev tunX|tapX : tun/tap device (X can be omitted for dynamic device.
75 --dev-type dt : Which device type are we using? (dt = tun or tap) Use
76 this option only if the tun/tap device used with --dev
77 does not begin with "tun" or "tap".
78 --dev-node node : Explicitly set the device node rather than using
79 /dev/net/tun, /dev/tun, /dev/tap, etc.
80 --lladdr hw : Set the link layer address of the tap device.
81 --topology t : Set --dev tun topology: 'net30', 'p2p', or 'subnet'.
82 --tun-ipv6 : Build tun link capable of forwarding IPv6 traffic.
83 --iproute cmd : Use this command instead of default /sbin/ip.
84 --ifconfig l rn : TUN: configure device to use IP address l as a local
85 endpoint and rn as a remote endpoint. l & rn should be
86 swapped on the other peer. l & rn must be private
87 addresses outside of the subnets used by either peer.
88 TAP: configure device to use IP address l as a local
89 endpoint and rn as a subnet mask.
90 --ifconfig-noexec : Don't actually execute ifconfig/netsh command, instead
91 pass --ifconfig parms by environment to scripts.
92 --ifconfig-nowarn : Don't warn if the --ifconfig option on this side of the
93 connection doesn't match the remote side.
94 --route network [netmask] [gateway] [metric] :
95 Add route to routing table after connection
96 is established. Multiple routes can be specified.
97 netmask default: 255.255.255.255
98 gateway default: taken from --route-gateway or --ifconfig
99 Specify default by leaving blank or setting to "nil".
100 --max-routes n : Specify the maximum number of routes that may be defined
101 or pulled from a server.
102 --route-gateway gw|'dhcp' : Specify a default gateway for use with --route.
103 --route-metric m : Specify a default metric for use with --route.
104 --route-delay n [w] : Delay n seconds after connection initiation before
105 adding routes (may be 0). If not specified, routes will
106 be added immediately after tun/tap open. On Windows, wait
107 up to w seconds for TUN/TAP adapter to come up.
108 --route-up cmd : Execute shell cmd after routes are added.
109 --route-noexec : Don't add routes automatically. Instead pass routes to
110 --route-up script using environmental variables.
111 --route-nopull : When used with --client or --pull, accept options pushed
112 by server EXCEPT for routes.
113 --allow-pull-fqdn : Allow client to pull DNS names from server for
114 --ifconfig, --route, and --route-gateway.
115 --redirect-gateway [flags]: Automatically execute routing
116 commands to redirect all outgoing IP traffic through the
117 VPN. Add 'local' flag if both OpenVPN servers are directly
118 connected via a common subnet, such as with WiFi.
119 Add 'def1' flag to set default route using using 0.0.0.0/1
120 and 128.0.0.0/1 rather than 0.0.0.0/0. Add 'bypass-dhcp'
121 flag to add a direct route to DHCP server, bypassing tunnel.
122 Add 'bypass-dns' flag to similarly bypass tunnel for DNS.
123 --redirect-private [flags]: Like --redirect-gateway, but omit actually changing
124 the default gateway. Useful when pushing private subnets.
125 --push-peer-info : (client only) push client info to server.
126 --setenv name value : Set a custom environmental variable to pass to script.
127 --setenv FORWARD_COMPATIBLE 1 : Relax config file syntax checking to allow
128 directives for future OpenVPN versions to be ignored.
129 --script-security level mode : mode='execve' (default) or 'system', level=
130 0 -- strictly no calling of external programs
131 1 -- (default) only call built-ins such as ifconfig
132 2 -- allow calling of built-ins and scripts
133 3 -- allow password to be passed to scripts via env
134 --shaper n : Restrict output to peer to n bytes per second.
135 --keepalive n m : Helper option for setting timeouts in server mode. Send
136 ping once every n seconds, restart if ping not received
138 --inactive n [bytes] : Exit after n seconds of activity on tun/tap device
139 produces a combined in/out byte count < bytes.
140 --ping-exit n : Exit if n seconds pass without reception of remote ping.
141 --ping-restart n: Restart if n seconds pass without reception of remote ping.
142 --ping-timer-rem: Run the --ping-exit/--ping-restart timer only if we have a
144 --ping n : Ping remote once every n seconds over TCP/UDP port.
145 --multihome : Configure a multi-homed UDP server.
146 --fast-io : (experimental) Optimize TUN/TAP/UDP writes.
147 --remap-usr1 s : On SIGUSR1 signals, remap signal (s='SIGHUP' or 'SIGTERM').
148 --persist-tun : Keep tun/tap device open across SIGUSR1 or --ping-restart.
149 --persist-remote-ip : Keep remote IP address across SIGUSR1 or --ping-restart.
150 --persist-local-ip : Keep local IP address across SIGUSR1 or --ping-restart.
151 --persist-key : Don't re-read key files across SIGUSR1 or --ping-restart.
152 --passtos : TOS passthrough (applies to IPv4 only).
153 --tun-mtu n : Take the tun/tap device MTU to be n and derive the
154 TCP/UDP MTU from it (default=1500).
155 --tun-mtu-extra n : Assume that tun/tap device might return as many
156 as n bytes more than the tun-mtu size on read
157 (default TUN=0 TAP=32).
158 --link-mtu n : Take the TCP/UDP device MTU to be n and derive the tun MTU
160 --mtu-disc type : Should we do Path MTU discovery on TCP/UDP channel?
161 'no' -- Never send DF (Don't Fragment) frames
162 'maybe' -- Use per-route hints
163 'yes' -- Always DF (Don't Fragment)
164 --mtu-test : Empirically measure and report MTU.
165 --fragment max : Enable internal datagram fragmentation so that no UDP
166 datagrams are sent which are larger than max bytes.
167 Adds 4 bytes of overhead per datagram.
168 --mssfix [n] : Set upper bound on TCP MSS, default = tun-mtu size
169 or --fragment max value, whichever is lower.
170 --sndbuf size : Set the TCP/UDP send buffer size.
171 --rcvbuf size : Set the TCP/UDP receive buffer size.
172 --txqueuelen n : Set the tun/tap TX queue length to n (Linux only).
173 --mlock : Disable Paging -- ensures key material and tunnel
174 data will never be written to disk.
175 --up cmd : Shell cmd to execute after successful tun device open.
176 Execute as: cmd tun/tap-dev tun-mtu link-mtu \
177 ifconfig-local-ip ifconfig-remote-ip
178 (pre --user or --group UID/GID change)
179 --up-delay : Delay tun/tap open and possible --up script execution
180 until after TCP/UDP connection establishment with peer.
181 --down cmd : Shell cmd to run after tun device close.
182 (post --user/--group UID/GID change and/or --chroot)
183 (script parameters are same as --up option)
184 --down-pre : Call --down cmd/script before TUN/TAP close.
185 --up-restart : Run up/down scripts for all restarts including those
186 caused by --ping-restart or SIGUSR1
187 --user user : Set UID to user after initialization.
188 --group group : Set GID to group after initialization.
189 --chroot dir : Chroot to this directory after initialization.
190 --cd dir : Change to this directory before initialization.
191 --daemon [name] : Become a daemon after initialization.
192 The optional 'name' parameter will be passed
193 as the program name to the system logger.
194 --syslog [name] : Output to syslog, but do not become a daemon.
195 See --daemon above for a description of the 'name' parm.
196 --inetd [name] ['wait'|'nowait'] : Run as an inetd or xinetd server.
197 See --daemon above for a description of the 'name' parm.
198 --log file : Output log to file which is created/truncated on open.
199 --log-append file : Append log to file, or create file if nonexistent.
200 --suppress-timestamps : Don't log timestamps to stdout/stderr.
201 --writepid file : Write main process ID to file.
202 --nice n : Change process priority (>0 = lower, <0 = higher).
203 --echo [parms ...] : Echo parameters to log output.
204 --verb n : Set output verbosity to n (default=1):
205 (Level 3 is recommended if you want a good summary
206 of what's happening without being swamped by output).
207 : 0 -- no output except fatal errors
208 : 1 -- startup info + connection initiated messages +
209 non-fatal encryption & net errors
210 : 2,3 -- show TLS negotiations & route info
211 : 4 -- show parameters
212 : 5 -- show 'RrWw' chars on console for each packet sent
213 and received from TCP/UDP (caps) or tun/tap (lc)
214 : 6 to 11 -- debug messages of increasing verbosity
215 --mute n : Log at most n consecutive messages in the same category.
216 --status file n : Write operational status to file every n seconds.
217 --status-version [n] : Choose the status file format version number.
218 Currently, n can be 1, 2, or 3 (default=1).
219 --disable-occ : Disable options consistency check between peers.
220 --gremlin mask : Special stress testing mode (for debugging only).
221 --comp-lzo : Use fast LZO compression -- may add up to 1 byte per
222 packet for uncompressible data.
223 --comp-noadapt : Don't use adaptive compression when --comp-lzo
225 --management ip port [pass] : Enable a TCP server on ip:port to handle
226 management functions. pass is a password file
227 or 'stdin' to prompt from console.
228 To listen on a unix domain socket, specific the pathname
229 in place of ip and use 'unix' as the port number.
230 --management-client : Management interface will connect as a TCP client to
231 ip/port rather than listen as a TCP server.
232 --management-query-passwords : Query management channel for private key
233 and auth-user-pass passwords.
234 --management-hold : Start OpenVPN in a hibernating state, until a client
235 of the management interface explicitly starts it.
236 --management-signal : Issue SIGUSR1 when management disconnect event occurs.
237 --management-forget-disconnect : Forget passwords when management disconnect
239 --management-log-cache n : Cache n lines of log file history for usage
240 by the management channel.
241 --management-client-user u : When management interface is a unix socket, only
242 allow connections from user u.
243 --management-client-group g : When management interface is a unix socket, only
244 allow connections from group g.
245 --management-client-auth : gives management interface client the responsibility
246 to authenticate clients after their client certificate
248 --management-client-pf : management interface clients must specify a packet
249 filter file for each connecting client.
250 --plugin m [str]: Load plug-in module m passing str as an argument
251 to its initialization function.
253 Multi-Client Server options (when --mode server is used):
254 --server network netmask : Helper option to easily configure server mode.
255 --server-bridge [IP netmask pool-start-IP pool-end-IP] : Helper option to
256 easily configure ethernet bridging server mode.
257 --push "option" : Push a config file option back to the peer for remote
258 execution. Peer must specify --pull in its config file.
259 --push-reset : Don't inherit global push list for specific
261 --ifconfig-pool start-IP end-IP [netmask] : Set aside a pool of subnets
262 to be dynamically allocated to connecting clients.
263 --ifconfig-pool-linear : Use individual addresses rather than /30 subnets
264 in tun mode. Not compatible with Windows clients.
265 --ifconfig-pool-persist file [seconds] : Persist/unpersist ifconfig-pool
266 data to file, at seconds intervals (default=600).
267 If seconds=0, file will be treated as read-only.
268 --ifconfig-push local remote-netmask : Push an ifconfig option to remote,
269 overrides --ifconfig-pool dynamic allocation.
270 Only valid in a client-specific config file.
271 --iroute network [netmask] : Route subnet to client.
272 Sets up internal routes only.
273 Only valid in a client-specific config file.
274 --disable : Client is disabled.
275 Only valid in a client-specific config file.
276 --client-cert-not-required : Don't require client certificate, client
277 will authenticate using username/password.
278 --username-as-common-name : For auth-user-pass authentication, use
279 the authenticated username as the common name,
280 rather than the common name from the client cert.
281 --auth-user-pass-verify cmd method: Query client for username/password and
282 run script cmd to verify. If method='via-env', pass
283 user/pass via environment, if method='via-file', pass
284 user/pass via temporary file.
285 --opt-verify : Clients that connect with options that are incompatible
286 with those of the server will be disconnected.
287 --auth-user-pass-optional : Allow connections by clients that don't
288 specify a username/password.
289 --no-name-remapping : Allow Common Name and X509 Subject to include
290 any printable character.
291 --client-to-client : Internally route client-to-client traffic.
292 --duplicate-cn : Allow multiple clients with the same common name to
293 concurrently connect.
294 --client-connect cmd : Run script cmd on client connection.
295 --client-disconnect cmd : Run script cmd on client disconnection.
296 --client-config-dir dir : Directory for custom client config files.
297 --ccd-exclusive : Refuse connection unless custom client config is found.
298 --tmp-dir dir : Temporary directory, used for --client-connect return file and plugin communication.
299 --hash-size r v : Set the size of the real address hash table to r and the
300 virtual address table to v.
301 --bcast-buffers n : Allocate n broadcast buffers.
302 --tcp-queue-limit n : Maximum number of queued TCP output packets.
303 --tcp-nodelay : Macro that sets TCP_NODELAY socket flag on the server
304 as well as pushes it to connecting clients.
305 --learn-address cmd : Run script cmd to validate client virtual addresses.
306 --connect-freq n s : Allow a maximum of n new connections per s seconds.
307 --max-clients n : Allow a maximum of n simultaneously connected clients.
308 --max-routes-per-client n : Allow a maximum of n internal routes per client.
309 --port-share host port : When run in TCP mode, proxy incoming HTTPS sessions
310 to a web server at host:port.
312 Client options (when connecting to a multi-client server):
313 --client : Helper option to easily configure client mode.
314 --auth-user-pass [up] : Authenticate with server using username/password.
315 up is a file containing username/password on 2 lines,
316 or omit to prompt from console.
317 --pull : Accept certain config file options from the peer as if they
318 were part of the local config file. Must be specified
319 when connecting to a '--mode server' remote host.
320 --auth-retry t : How to handle auth failures. Set t to
321 none (default), interact, or nointeract.
322 --server-poll-timeout n : when polling possible remote servers to connect to
323 in a round-robin fashion, spend no more than n seconds
324 waiting for a response before trying the next server.
325 --explicit-exit-notify [n] : On exit/restart, send exit signal to
326 server/remote. n = # of retries, default=1.
328 Data Channel Encryption Options (must be compatible between peers):
329 (These options are meaningful for both Static Key & TLS-mode)
330 --secret f [d] : Enable Static Key encryption mode (non-TLS).
331 Use shared secret file f, generate with --genkey.
332 The optional d parameter controls key directionality.
333 If d is specified, use separate keys for each
334 direction, set d=0 on one side of the connection,
335 and d=1 on the other side.
336 --auth alg : Authenticate packets with HMAC using message
337 digest algorithm alg (default=SHA1).
338 (usually adds 16 or 20 bytes per packet)
339 Set alg=none to disable authentication.
340 --cipher alg : Encrypt packets with cipher algorithm alg
342 Set alg=none to disable encryption.
343 --prng alg [nsl] : For PRNG, use digest algorithm alg, and
344 nonce_secret_len=nsl. Set alg=none to disable PRNG.
345 --keysize n : Size of cipher key in bits (optional).
346 If unspecified, defaults to cipher-specific default.
347 --engine [name] : Enable OpenSSL hardware crypto engine functionality.
348 --no-replay : Disable replay protection.
349 --mute-replay-warnings : Silence the output of replay warnings to log file.
350 --replay-window n [t] : Use a replay protection sliding window of size n
351 and a time window of t seconds.
353 --no-iv : Disable cipher IV -- only allowed with CBC mode ciphers.
354 --replay-persist file : Persist replay-protection state across sessions
356 --test-crypto : Run a self-test of crypto features enabled.
359 TLS Key Negotiation Options:
360 (These options are meaningful only for TLS-mode)
361 --tls-server : Enable TLS and assume server role during TLS handshake.
362 --tls-client : Enable TLS and assume client role during TLS handshake.
363 --key-method m : Data channel key exchange method. m should be a method
364 number, such as 1 (default), 2, etc.
365 --ca file : Certificate authority file in .pem format containing
367 --capath dir : A directory of trusted certificates (CAs and CRLs).
368 --dh file : File containing Diffie Hellman parameters
369 in .pem format (for --tls-server only).
370 Use "openssl dhparam -out dh1024.pem 1024" to generate.
371 --cert file : Local certificate in .pem format -- must be signed
372 by a Certificate Authority in --ca file.
373 --key file : Local private key in .pem format.
374 --pkcs12 file : PKCS#12 file containing local private key, local certificate
375 and optionally the root CA certificate.
376 --tls-cipher l : A list l of allowable TLS ciphers separated by : (optional).
377 : Use --show-tls to see a list of supported TLS ciphers.
378 --tls-timeout n : Packet retransmit timeout on TLS control channel
379 if no ACK from remote within n seconds (default=2).
380 --reneg-bytes n : Renegotiate data chan. key after n bytes sent and recvd.
381 --reneg-pkts n : Renegotiate data chan. key after n packets sent and recvd.
382 --reneg-sec n : Renegotiate data chan. key after n seconds (default=3600).
383 --hand-window n : Data channel key exchange must finalize within n seconds
384 of handshake initiation by any peer (default=60).
385 --tran-window n : Transition window -- old key can live this many seconds
386 after new key renegotiation begins (default=3600).
387 --single-session: Allow only one session (reset state on restart).
388 --tls-exit : Exit on TLS negotiation failure.
389 --tls-auth f [d]: Add an additional layer of authentication on top of the TLS
390 control channel to protect against DoS attacks.
391 f (required) is a shared-secret passphrase file.
392 The optional d parameter controls key directionality,
393 see --secret option for more info.
394 --askpass [file]: Get PEM password from controlling tty before we daemonize.
395 --auth-nocache : Don't cache --askpass or --auth-user-pass passwords.
396 --crl-verify crl: Check peer certificate against a CRL.
397 --tls-verify cmd: Execute shell command cmd to verify the X509 name of a
398 pending TLS connection that has otherwise passed all other
399 tests of certification. cmd should return 0 to allow
400 TLS handshake to proceed, or 1 to fail. (cmd is
401 executed as 'cmd certificate_depth X509_NAME_oneline')
402 --tls-export-cert [directory] : Get peer cert in PEM format and store it
403 in an openvpn temporary file in [directory]. Peer cert is
404 stored before tls-verify script execution and deleted after.
405 --tls-remote x509name: Accept connections only from a host with X509 name
406 x509name. The remote host must also pass all other tests
408 --ns-cert-type t: Require that peer certificate was signed with an explicit
409 nsCertType designation t = 'client' | 'server'.
410 --remote-cert-ku v ... : Require that the peer certificate was signed with
411 explicit key usage, you can specify more than one value.
412 value should be given in hex format.
413 --remote-cert-eku oid : Require that the peer certificate was signed with
414 explicit extended key usage. Extended key usage can be encoded
415 as an object identifier or OpenSSL string representation.
416 --remote-cert-tls t: Require that peer certificate was signed with explicit
417 key usage and extended key usage based on RFC3280 TLS rules.
418 t = 'client' | 'server'.
421 --pkcs11-providers provider ... : PKCS#11 provider to load.
422 --pkcs11-protected-authentication [0|1] ... : Use PKCS#11 protected authentication
423 path. Set for each provider.
424 --pkcs11-private-mode hex ... : PKCS#11 private key mode mask.
425 0 : Try to determind automatically (default).
430 --pkcs11-cert-private [0|1] ... : Set if login should be performed before
431 certificate can be accessed. Set for each provider.
432 --pkcs11-pin-cache seconds : Number of seconds to cache PIN. The default is -1
433 cache until token is removed.
434 --pkcs11-id-management : Acquire identity from management interface.
435 --pkcs11-id serialized-id 'id' : Identity to use, get using standalone --show-pkcs11-ids
437 SSL Library information:
438 --show-ciphers : Show cipher algorithms to use with --cipher option.
439 --show-digests : Show message digest algorithms to use with --auth option.
440 --show-engines : Show hardware crypto accelerator engines (if available).
441 --show-tls : Show all TLS ciphers (TLS used only as a control channel).
443 Generate a random key (only for non-TLS static key encryption mode):
444 --genkey : Generate a random key to be used as a shared secret,
445 for use with the --secret option.
446 --secret file : Write key to file.
448 Tun/tap config mode (available with linux 2.4+):
449 --mktun : Create a persistent tunnel.
450 --rmtun : Remove a persistent tunnel.
451 --dev tunX|tapX : tun/tap device
452 --dev-type dt : Device type. See tunnel options above for details.
453 --user user : User to set privilege to.
454 --group group : Group to set privilege to.
456 PKCS#11 standalone options:
457 --show-pkcs11-ids provider [cert_private] : Show PKCS#11 available ids.
458 --verb option can be added *BEFORE* this.