There will be a follow-up article after this that gives some points of improvement for extra security depending on your organization’s needs, such as using physical tokens for authentication. Reading the background and rationale portions of each section can help you find the options in case they’re not named exactly the same way as in the community OpenVPN edition.Īt the end of the guide, you’ll have an OpenVPN configuration that uses all modern best practices (known at the time of this guide’s publication) while remaining compatible with all common platforms. If you’re using an appliance, consult the manual and the configuration interface to try and find equivalent options and configuration settings. If you’re using the OpenVPN community edition (the version that’s available in Linux package managers and on the website), you can copy and paste the directives (customizing as necessary) and build your configuration that way. Each section will include some background, an explanation of the rationale for the specific options it recommends, and a sample configuration snippet that implements it, culminating in a full sample configuration file at the end of the article. This article will cover a number of hardening options and general best practices broken down into related sections. This article aims to be a one stop, up-to-date hardening and configuration guide for OpenVPN in 2020. On top of that, OpenVPN is a pretty old project so there is a lot of advice hanging around on the Internet that is either out of date, incomplete, or just plain wrong. OpenVPN has a pretty staggering amount of them, some of which are deprecated or have subtle security impacts that are not well explained. This is the opposite of what you want on a corporate VPN since you’re in control of both ends of every connection, you can much more tightly control the clients and can therefore choose options that maximize security. Most OpenVPN configurations lean heavily on the OpenVPN defaults, which are designed to be widely compatible rather than maximally secure. Let’s clean up this mess Why Hardening OpenVPN is Necessary

Openvpn mac client add user profile auto login