官术网_书友最值得收藏!

Configuration files versus the command-line

Most recipes in this book can be carried out without using configuration files. However, in most real-life cases a configuration file is much easier to use than a lengthy command-line. It is important to know that OpenVPN actually treats configuration file entries and command-line parameters identically. The only difference is that all command-line parameters start with a double dash ("--") whereas the configuration file entries do not. This makes it very easy to overrule the configuration file entries using an extra command-line parameter.

Getting ready

Install OpenVPN 2.0 or higher on two computers. Make sure the computers are connected over a network. For this recipe, the server computer was running CentOS 5 Linux and OpenVPN 2.1.1 and the client was running Windows XP SP3 and OpenVPN 2.1.1 In this recipe we'll use the secret.key file from the OpenVPN Secret keys recipe.

How to do it...

  1. Create a configuration file based on an earlier recipe:
           dev tun
           port 1194
           ifconfig 10.200.0.1 10.200.0.2
           secret secret.key 
           remote openvpnserver.example.com
           verb 3

    Save this file as example1-6-client.conf.

  2. We launch the server (listening)-side OpenVPN process on a non-standard port:
     [root@server]# openvpn \
     --ifconfig 10.200.0.1 10.200.0.2 \
     --dev tun --secret secret.key \
     --port 11000
    
  3. Then we launch the client-side OpenVPN process and add an extra command-line parameter:
     [WinClient] C:\>"\Program Files\OpenVPN\bin\openvpn.exe" \
     --config client.conf \
     --port 11000
    

The connection is established:

How to do it...

How it works...

The command-line and the configuration file are read and parsed from left to right. This means that most options that are specified before the configuration file can be overruled by entries in that file. Similarly, options specified after the following directive overrule the entries in that file:

--config client.conf

Hence, the following option overruled the line 'port 1194' from the configuration file:

--port 11000

However, some options can be specified multiple times, in which case the first occurrence "wins". In that case, it is also possible to specify the option before specifying the --config directive.

There's more...

Here is another example to show the importance of the ordering of the command-line parameters:

C:\>"\Program Files\OpenVPN\bin\openvpn.exe" \
 --verb 0 \
 --config client.conf \
 --port 11000

This produces the exact same connection log as shown before. The 'verb 3' from the client.conf configuration file overruled the --verb 0 as specified on the command line. However, with the following command line:

C:\>"\Program Files\OpenVPN\bin\openvpn.exe" \
 --config client.conf \
 --port 11000 \
 --verb 0

Then the connection log shows the following:

… NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables

This shows all the other messages that have been muted.

OpenVPN 2.1 specifics

Some of the newer features of OpenVPN 2.1 deviate slightly from this principle, notably the <connection> blocks and the inline certificates. SeeChapter 12, OpenVPN 2.1 specifics for more details.

主站蜘蛛池模板: 会理县| 望城县| 阳西县| 宕昌县| 小金县| 喜德县| 巫溪县| 内江市| 吉水县| 潜山县| 通许县| 南京市| 万荣县| 共和县| 马山县| 承德县| 镇雄县| 客服| 通山县| 屏边| 衡阳市| 凤山市| 通州市| 灵宝市| 潞西市| 永丰县| 利川市| 日土县| 岱山县| 鹤庆县| 龙泉市| 尤溪县| 嘉黎县| 五家渠市| 乾安县| 宝山区| 尚义县| 五峰| 五原县| 平湖市| 磐安县|