Netgate is offering COVID-19 aid for pfSense software users, learn more.
Custom configuration options¶
OpenVPN offers dozens of configuration options, many beyond the most commonly used fields presented in the GUI. This is why the Advanced configuration box exists. Additional configuration options may be configured using this input area, separated by semicolons.
This section covers the most frequently used custom options individually. There are many more, though rarely needed. The OpenVPN man page details them all.
Exercise caution when adding custom options, there is no input validation applied to ensure the validity of options used. If an option is used incorrectly, the OpenVPN client or server may not start. View the OpenVPN logs under Status > System logs on the OpenVPN tab to ensure the options used are valid. Any invalid options will result in a log message, followed by the option that caused the error:
Options error: Unrecognized option or missing parameter(s)
To add additional routes for a particular OpenVPN client or server, use the Local Network and Remote Network boxes as needed, using a comma- separated list of networks.
route custom configuration option may also be used, but is no longer
necessary. Some users prefer this method, however. The following example adds a
route 10.50.0.0 255.255.255.0;
To add multiple routes, separate them with a semicolon:
route 10.50.0.0 255.255.255.0; route 10.254.0.0 255.255.255.0;
route configuration option is used to add routes locally for networks
that are reachable through the VPN. For an OpenVPN server configuration using
PKI, additional routes may also be pushed to clients. The GUI can configure
these using the Local Network field. To push the routes manually for
10.254.0.0/24 to all clients, use the following custom
push "route 10.50.0.0 255.255.255.0"; push "route 10.254.0.0 255.255.255.0";
Redirecting the default gateway¶
OpenVPN also allows the default gateway to be redirected across the VPN, so all non-local traffic from the client is sent through the VPN. This is great for untrusted local networks such as wireless hotspots, as it provides protection against numerous attacks that are a risk on untrusted networks. This is configurable in the GUI now, using the Redirect Gateway checkbox in the OpenVPN instance configuration. To do this manually, add the following custom option:
push "redirect-gateway def1"
The same value may be used as a custom option on the client side by entering
redirect-gateway def1 without specifying
push . (Note the option is the
letters “def” followed by the digit one, not the letter “L”.)