#!/bin/sh

export DATE="8.5.2010";SCRIPT=${0#/rom}
export TITLE="Admin:
OpenVPN"
. ${SCRIPT%/*}/cgi-bin-pre.sh

cat<<EOF
<H1>Admin:
OpenVPN</H1>
EOF

unset CFG
case ${QUERY_STRING#[2-9]} in "")
CFG=$QUERY_STRING
;;esac
QUERY_STRING=${QUERY_STRING#[1-9]}
case $REQUEST_METHOD in POST)
read QUERY_STRING
;;esac
case $QUERY_STRING in "")
#Speedups
ff_ovpn_count="$(nvram get ff_ovpn_count)"
ff_ovpn_mode="$(nvram get ff_ovpn_mode${CFG})"
ff_ovpn_cli="$(nvram get ff_ovpn_cli${CFG})"
ff_ovpn_tap="$(nvram get ff_ovpn_tap${CFG})"
ff_ovpn_gw="$(nvram get ff_ovpn_gw${CFG})"
ff_ovpn_dns="$(nvram get ff_ovpn_dns${CFG})"
ff_ovpn_nat="$(nvram get ff_ovpn_nat${CFG})"
ff_ovpn_policy="$(nvram get ff_ovpn_policy${CFG})"
ff_ovpn_range="$(nvram get ff_ovpn_range${CFG})"
ff_ovpn_remote="$(nvram get ff_ovpn_remote${CFG})"
ff_ovpn_port="$(nvram get ff_ovpn_port${CFG})"
ff_ovpn_tcp="$(nvram get ff_ovpn_tcp${CFG})"
ff_ovpn_lzo="$(nvram get ff_ovpn_lzo${CFG})"
ff_ovpn_ca_crt="$(nvram get ff_ovpn_ca_crt${CFG})"
ff_ovpn_crt_key="$(nvram get ff_ovpn_crt_key${CFG})"
ff_ovpn_dh="$(nvram get ff_ovpn_dh${CFG})"
ff_ovpn_psk="$(nvram get ff_ovpn_psk${CFG})"
;;*)
IFS=\&;set $QUERY_STRING;unset IFS;eval $*
case $post_genkey_ovpn in "");;*)
unset QUERY_STRING
ff_ovpn_ca_crt="$(unescape $ff_ovpn_ca_crt)"
ff_ovpn_crt_key="$(unescape $ff_ovpn_crt_key)"
ff_ovpn_dh="$(unescape $ff_ovpn_dh)"
ff_ovpn_psk=$(openvpn --genkey --secret /tmp/openvpn-psk.$$;sed '/^#/d' /tmp/openvpn-psk.$$;rm -f /tmp/openvpn-psk.$$)
ff_ovpn_range="$(unescape $ff_ovpn_range)"
ff_ovpn_remote="$(unescape $ff_ovpn_remote)"
ff_ovpn_port="$(unescape $ff_ovpn_port)"
;;esac
;;esac
SSL=no
openvpn --version 2>&1|grep -q '\[SSL\]' && SSL=yes
case $QUERY_STRING in "")

cat<<EOF
<FORM ACTION="openvpn.html${CFG:+?${CFG}}" METHOD="POST">
<TABLE CLASS="shadow0" CELLPADDING="0" CELLSPACING="0"><TR><TD><TABLE CLASS="shadow1" CELLPADDING="0" CELLSPACING="0"><TR><TD><TABLE CLASS="shadow2" CELLPADDING="0" CELLSPACING="0"><TR><TD><TABLE BORDER="0" CLASS="form"><TR
TITLE="This setting activates the current configuration and determines the topology. Setting up a point-to-point topology (one client connects to a server) is more easy. In a point-to-multipoint topology, multiple clients may connect to a server. Client and server need the same setting.">
<TD>Connection
Mode:</TD><TD COLSPAN="2">
EOF

case $SSL in yes)

cat<<EOF
<SELECT NAME="ff_ovpn_mode" ONCHANGE="this.form.ff_ovpn_range.readOnly=(0==this.value.indexOf('MULTI')&&this.form.ff_ovpn_cli[1].checked);this.form.ff_ovpn_ca_crt.readOnly=(0!=this.value.indexOf('MULTI'));this.form.ff_ovpn_crt_key.readOnly=(0!=this.value.indexOf('MULTI'));this.form.ff_ovpn_dh.readOnly=(0!=this.value.indexOf('MULTI')||this.form.ff_ovpn_cli[1].checked);this.form.ff_ovpn_psk.readOnly=(0!=this.value.indexOf('PTP'));">
<OPTION VALUE="">Disabled</OPTION>
<OPTION
VALUE='PTP' $(case $ff_ovpn_mode in PTP)echo "selected=selected";;esac)>Point-to-Point (PTP)</OPTION>
<OPTION
VALUE='MULTI' $(case $ff_ovpn_mode in MULTI)echo "selected=selected";;esac)>Point-to-Multipoint (MULTI)</OPTION></SELECT>
EOF

;;*)

cat<<EOF
<SELECT NAME="ff_ovpn_mode" ONCHANGE="this.form.ff_ovpn_range.readOnly=(0==this.value.indexOf('MULTI')&&this.form.ff_ovpn_cli[1].checked);this.form.ff_ovpn_ca_crt.readOnly=(0!=this.value.indexOf('MULTI'));this.form.ff_ovpn_crt_key.readOnly=(0!=this.value.indexOf('MULTI'));this.form.ff_ovpn_dh.readOnly=(0!=this.value.indexOf('MULTI')||this.form.ff_ovpn_cli[1].checked);this.form.ff_ovpn_psk.readOnly=(0!=this.value.indexOf('PTP'));">
<OPTION>Disabled</OPTION>
<OPTION
VALUE='PTP' $(case $ff_ovpn_mode in PTP)echo "selected=selected";;esac)>Point-to-Point (PTP)</OPTION></SELECT>
EOF

;;esac

cat<<EOF
</TD>
</TR>
<TR
TITLE="The current configuration may take the server role or the client role. A server has typically a fixed address or a DynDNS name. Behind a server, normally the larger network can be reached.">
<TD>Operation
Role:</TD><TD><INPUT CLASS="radio" NAME="ff_ovpn_cli" TYPE="RADIO" VALUE="0" ONCHANGE="this.form.ff_ovpn_range.readOnly=(0==this.form.ff_ovpn_mode.value.indexOf('MULTI')&&1==this.value);this.form.ff_ovpn_dh.readOnly=(0!=this.form.ff_ovpn_mode.value.indexOf('MULTI')||1==this.value);for(var i=0;i<2;i++){this.form.ff_ovpn_gw[i].readOnly=1==this.value;this.form.ff_ovpn_dns[i].readOnly=1==this.value;this.form.ff_ovpn_nat[i].readOnly=1!=this.value;this.form.ff_ovpn_policy[i].readOnly=1!=this.value;}"$(case $ff_ovpn_cli in 1);;*)echo ' checked="checked"';;esac)>Server</TD><TD><INPUT CLASS="radio" NAME="ff_ovpn_cli" TYPE="RADIO" VALUE="1" ONCHANGE="this.form.ff_ovpn_range.readOnly=(0==this.form.ff_ovpn_mode.value.indexOf('MULTI')&&1==this.value);this.form.ff_ovpn_dh.readOnly=(0!=this.form.ff_ovpn_mode.value.indexOf('MULTI')||1==this.value);for(var i=0;i<2;i++){this.form.ff_ovpn_gw[i].readOnly=1==this.value;this.form.ff_ovpn_dns[i].readOnly=1==this.value;this.form.ff_ovpn_nat[i].readOnly=1!=this.value;this.form.ff_ovpn_policy[i].readOnly=1!=this.value;}"$(case $ff_ovpn_cli in 1)echo ' checked="checked"';;esac)>Client</TD>
</TR><TR
TITLE="A tunnel (tun) connection on the IP layer. For this, IP packets are routed to the other network. A bridge (tap) connects on the Ethernet layer. With this, more information is transferred. For example untargeted broadcast packets will be sent over the bridge.">
<TD>Device:</TD>
<TD><INPUT CLASS="radio" NAME="ff_ovpn_tap" TYPE="RADIO" VALUE="0"$(case $ff_ovpn_tap in 1);;*)echo ' checked="checked"';;esac)>Tunnel (tun)</TD>
<TD><INPUT CLASS="radio" NAME="ff_ovpn_tap" TYPE="RADIO" VALUE="1"$(case $ff_ovpn_tap in 1)echo ' checked="checked"';;esac)>Bridge (tap)
</TD>
</TR><TR
TITLE="Server only: determines, that the 'Internet here!' announcement is sent to a client. A client will then redirect it's default route via the tunnel during connection setup.">
<TD>Internet
for Clients:</TD><TD><INPUT CLASS="radio" NAME="ff_ovpn_gw" TYPE="RADIO" VALUE="0"$(case $ff_ovpn_gw in 1);;*)echo ' checked="checked"';;esac)$(case $ff_ovpn_cli in 1)echo ' readonly="readonly"';;esac)>Unchanged
/ Not via Tunnel</TD><TD><INPUT CLASS="radio" NAME="ff_ovpn_gw" TYPE="RADIO" VALUE="1"$(case $ff_ovpn_gw in 1)echo ' checked="checked"';;esac)$(case $ff_ovpn_cli in 1)echo ' readonly="readonly"';;esac)>Redirect
via Tunnel</TD>
</TR><TR
TITLE="Server only: some DNS servers do not answer to requests from foreign networks. On the client, an exception for the DNS addresses can be configured ('Unchanged' setting). Or the server sends a new DNS configuration ('Via Tunnel' setting). Changeing the DNS setting works fine under Windows. With Linux, you need an additional script (Debian: 'resolvconf' package).">
<TD>DNS
for Clients:</TD><TD><INPUT CLASS="radio" NAME="ff_ovpn_dns" TYPE="RADIO" VALUE="0"$(case $ff_ovpn_dns in 1);;*)echo ' checked="checked"';;esac)$(case $ff_ovpn_cli in 1)echo ' readonly="readonly"';;esac)>Unchanged
/ Not via Tunnel</TD><TD><INPUT CLASS="radio" NAME="ff_ovpn_dns" TYPE="RADIO" VALUE="1"$(case $ff_ovpn_dns in 1)echo ' checked="checked"';;esac)$(case $ff_ovpn_cli in 1)echo ' readonly="readonly"';;esac)>Redirect
via Tunnel</TD>
</TR><TR
TITLE="Client on this router only: if there is a complete network behind the client (e.g.. the LAN attached to this router), the server needs the appropriate reverse route. Alternatively, the client can use Network Address Translation (NAT) to translate the traffic from the attached network to his client IP.">
<TD>Tunnel with
NAT:</TD><TD><INPUT CLASS="radio" NAME="ff_ovpn_nat" TYPE="RADIO" VALUE="0"$(case $ff_ovpn_nat in 1);;*)echo ' checked="checked"';;esac)$(case $ff_ovpn_cli in 1);;*)echo ' readonly="readonly"';;esac)>Disabled</TD>
<TD><INPUT CLASS="radio" NAME="ff_ovpn_nat" TYPE="RADIO" VALUE="1"$(case $ff_ovpn_nat in 1)echo ' checked="checked"';;esac)$(case $ff_ovpn_cli in 1);;*)echo ' readonly="readonly"';;esac)>Enabled</TD>
</TR><TR
TITLE="Client on this router only: You can redirect the complete Internet traffic of this router via an OpenVPN server e.g. in a foreign country. Alternatively, you can use policy routing to redirect only traffic from the OLSR network via the OpenVPN tunnel. With this, the WAN interface of this router can still be reached from the Internet. Also, the Internet for computers attached to the LAN interface is faster.">
<TD>Tunnel
for OLSR only:</TD><TD><INPUT CLASS="radio" NAME="ff_ovpn_policy" TYPE="RADIO" VALUE="0"$(case $ff_ovpn_policy in 1);;*)echo ' checked="checked"';;esac)$(case $ff_ovpn_cli in 1);;*)echo ' readonly="readonly"';;esac)>Standard
Routing</TD><TD><INPUT CLASS="radio" NAME="ff_ovpn_policy" TYPE="RADIO" VALUE="1"$(case $ff_ovpn_policy in 1)echo ' checked="checked"';;esac)$(case $ff_ovpn_cli in 1);;*)echo ' readonly="readonly"';;esac)>Policy Routing</TD>
</TR><TR
TITLE="Server or Point-to-Point client only: this setting determines the internal IP address range used by OpenVPN. Typically, a blank input field leads to a functional default. Alternatively, read the configuration examples below the input mask.">
<TD>Tunnel
IP Range:</TD><TD COLSPAN="2"><INPUT MAXLENGTH="48" NAME="ff_ovpn_range" SIZE="24" TYPE="TEXT" VALUE="$ff_ovpn_range"$(case $ff_ovpn_cli in 1)case $ff_ovpn_mode in MULTI)echo ' readonly="readonly"';;esac;;esac)>&nbsp;
(192.168.255.240/28
if empty) </TD>
</TR><TR
TITLE="A client always needs the IP address or the DNS name of the server. For a server, you can configure the IP address from with a client connection is expected. This may be useful for point-to-point connections, e.g. to tighten security for unauthorized/unencrypted connections.">
<TD>Remote
Station (IP&nbsp;or DNS-Name):</TD><TD COLSPAN="2"><INPUT MAXLENGTH="48" NAME="ff_ovpn_remote" SIZE="24" TYPE="TEXT" VALUE="$ff_ovpn_remote">
&nbsp;(Mandatory
if client)</TD>
</TR><TR
TITLE="For a client, this is the port number to connect to. For a server, this is the port number to listen for incoming connections. A server can only use free port numbers, e.g. the ports 53 (UDP) and 80/443 (TCP) are occupied by other services on this router.">
<TD>Port Number</TD>
<TD COLSPAN="2"><INPUT MAXLENGTH="8" NAME="ff_ovpn_port" SIZE="24" TYPE="TEXT" VALUE="$ff_ovpn_port">
&nbsp;(1194 if
empty)</TD>
</TR><TR
TITLE="The UDP protocol is generally faster. The TCP protocol is more flexible, e.g. it can be redirected via a proxy server. It is possible to run two OpenVPN servers on the same port number but with different protocols.">
<TD>Protocol:</TD>
<TD><INPUT CLASS="radio" NAME="ff_ovpn_tcp" TYPE="RADIO" VALUE="0"$(case $ff_ovpn_tcp in 1);;*)echo ' checked="checked"';;esac)>UDP </TD><TD><INPUT CLASS="radio" NAME="ff_ovpn_tcp" TYPE="RADIO" VALUE="1"$(case $ff_ovpn_tcp in 1)echo ' checked="checked"';;esac)>TCP</TD>
</TR><TR
TITLE="The data compression accelerates the traffic in some cases. You need the same setting on the server and on the client. If no ping: check this setting.">
<TD>LZO
Compression:</TD><TD><INPUT CLASS="radio" NAME="ff_ovpn_lzo" TYPE="RADIO" VALUE="0"$(case $ff_ovpn_lzo in 1);;*) echo ' checked="checked"';;esac)>Disabled
</TD><TD><INPUT CLASS="radio" NAME="ff_ovpn_lzo" TYPE="RADIO" VALUE="1"$(case $ff_ovpn_lzo in 1) echo ' checked="checked"';;esac)>Enabled
EOF

case $SSL in yes)

cat<<EOF
</TD>
</TR>
<TR><TD COLSPAN="3">&nbsp;</TD>
</TR><TR
TITLE="Point-to-Multipoint only: Certifikate, that verifies all other certifikates and keys. Anybody may view a CA certificate. If you import it to your software, you trust the issuer.">
<TD VALIGN="TOP">CA
Certificate (ca.crt):</TD><TD COLSPAN="2" VALIGN="TOP">
<TEXTAREA NAME="ff_ovpn_ca_crt" ROWS="4" COLS="66" $(case $ff_ovpn_mode in MULTI);;*) echo ' readonly="readonly"';;esac)>$ff_ovpn_ca_crt</TEXTAREA>
</TD>
</TR>
<TR
TITLE="Point-to-Multipoint only: A pair of certificate and key which needs to match the counter-pair of the other side. Paste your pair of certificate and key into this input field one after another. Important are only the key lines including the marker lines ('---BEGIN' and '---END').">
<TD VALIGN="TOP">Certificate&nbsp;(*.crt)
&amp;<BR>
Key&nbsp;(*.key):</TD><TD COLSPAN="2" VALIGN="TOP">
<TEXTAREA NAME="ff_ovpn_crt_key" ROWS="4" COLS="66" $(case $ff_ovpn_mode in MULTI);;*) echo ' readonly="readonly"';;esac)>$ff_ovpn_crt_key</TEXTAREA>
</TD>
</TR>
<TR
TITLE="Point-to-Multipoint Server only: The 'Public Key Encryption' is relatively slow. For this reason, the server negotiates a symmetric data key using the Diffie-Hellman key exchange protocol. To speed up this (needs 15 min. on this router!), you can configure a static set of DH parameters on the server.">
<TD VALIGN="TOP">Diffie
Hellman Parameters:</TD><TD COLSPAN="2" VALIGN="TOP">
<TEXTAREA NAME="ff_ovpn_dh" ROWS="4" COLS="66" $(case $ff_ovpn_mode in MULTI)case $ff_ovpn_cli in 1) echo ' readonly="readonly"';;esac;;*) echo ' readonly="readonly"';;esac)>$ff_ovpn_dh</TEXTAREA>
</TD>
</TR>
<TR
TITLE="Point-to-Point only: Simply generate, then use the same key on the other side.">
<TD VALIGN="TOP">Shared
Key:</TD><TD COLSPAN="2" ROWSPAN="2" VALIGN="TOP">
<TEXTAREA NAME="ff_ovpn_psk" ROWS="4" COLS="66" $(case $ff_ovpn_mode in PTP);;*) echo ' readonly="readonly"';;esac)>$ff_ovpn_psk</TEXTAREA>
</TD>
</TR>
<TR><TD VALIGN="BOTTOM"><INPUT NAME="post_genkey_ovpn" VALUE="Generate" TYPE="submit">
EOF

;;esac #SSL
case $CFG in "")

cat<<EOF
</TD>
</TR>
<TR
TITLE="You can manage more than one OpenVPN configuration. Change the number, click 'Apply', then reload the admin page.">
<TD>OpenVPN
Configurations:</TD><TD COLSPAN="2"><SELECT NAME="ff_ovpn_count" SIZE="1">
<OPTION
VALUE='1' $(case $ff_ovpn_count in [2-4]);;*)echo "selected=selected";;esac)>1</OPTION>
<OPTION
VALUE='2' $(case $ff_ovpn_count in 2)echo "selected=selected";;esac)>2</OPTION>
<OPTION
VALUE='3' $(case $ff_ovpn_count in 3)echo "selected=selected";;esac)>3</OPTION>
<OPTION
VALUE='4' $(case $ff_ovpn_count in 4)echo "selected=selected";;esac)>4</OPTION>
</SELECT> (2-4:
additional OpenVPN tunnels)
EOF

;;esac

cat<<EOF
</TD>
</TR>
<TR><TD COLSPAN="3">&nbsp;</TD>
</TR><TR><TD COLSPAN="3">&nbsp;<INPUT NAME="post_ovpn" TITLE="Apply these settings. The settings are applied with the next restart." VALUE="Apply" TYPE="submit">
EOF

case $CFG in "")if pidof openvpn >&-;then

cat<<EOF
&nbsp;
<INPUT NAME="post_stop_ovpn" TITLE="Stop all running OpenVPN programs." VALUE="Stop OpenVPN" TYPE="submit">
EOF

else

cat<<EOF
&nbsp;
<INPUT NAME="post_start_ovpn" TITLE="Start all OpenVPN programs." VALUE="Start OpenVPN" TYPE="submit">
EOF

fi;;esac

cat<<EOF
&nbsp;
<INPUT NAME="post_abort" TITLE="Cancel dialog page." VALUE="Cancel" TYPE="submit">&nbsp;</TD>
</TR>
</TABLE></TD></TR></TABLE></TD></TR></TABLE></TD></TR></TABLE></FORM>
EOF

case $ff_ovpn_ca_crt in "")if [ ! -f /www/cgi-bin/openvpn-easyrsa.sh ];then

cat<<EOF
<TABLE BORDER="0" CLASS="note"><TR><TD><B>Tip</B>: Install the &quot;freifunk-openvpn-easyrsa-en&quot;
package to generate keys for a server in mode &quot;MULTI&quot;.</TD>
</TR>
</TABLE>
EOF

fi;;esac
case ${CFG} in "")

cat<<EOF
<H2>Example
1: Internet for Clients in Mesh</H2>
<P>To route
Internet access for OpenVPN clients via an OpenVPN server in the mesh, you
can switch on the <B>Internet for Clients</B> option on the server. After
the OpenVPN connection is established, the default route for the client
will be changed accordingly. This works fine, as long as the client has
it's own Internet access or if the client is, for example, a PC connected
via Ethernet to a Freifunk router.</P>
<P>On a PC with OLSR or on a
Freifunk router and if a foreign Internet gateway via the Freifunk network
is used, things are a bit more complex. The changed default route will
automatically trigger the &quot;Internet here!&quot; announcement resp.
the changed default route will prevent third parties from accessing the
Internet. If you want to operate the OpenVPN client on the Freifunk router
and redirect the router's Internet access via the OpenVPN tunnel, you need
to switch on the <B>Policy Routing</B> option on the <A HREF="olsrd.html">OLSR</A>
page.</P>
<P><B>Tip</B>: For an
OpenVPN server in the mesh, the <B>Policy Routing</B> option on the
<A HREF="olsrd.html">OLSR</A> page may work as well. Only people with a
valid OpenVPN key can use the Internet gateway.</P>
<H2>Example
2: Internet Gateway in Other Country</H2>
<P>If
you offer Internet access within a Freifunk network, you may want to
redirect Internet access via an OpenVPN gateway in a foreign country. You
can place a Freifunk router in the foreign country, rent a server (e.g.
XEN based Linux VPS with &quot;iptables -j SNAT&quot; are available from
\$7,--/month <A TARGET="_new" HREF="http://www.webhostingtalk.com/">in
the USA</A>), or you have OpenVPN access provider account.</P>
<P>Typically,
you receive the IP address of the server, a CA certificate, a client
certificate and a client key. Change the <B>Connection Mode</B> to &quot;MULTI&quot;,
the <B>Operation Role</B> to &quot;Client&quot;, and the <B>Device</B>
to &quot;Tunnel (tun)&quot;. Configure the <B>Remote Station</B> and copy
the contents of the CA certificate file into the <B>CA Certificate</B>
input field. Copy the contents of the client certificate and the client
key directly one after the other into the <B>Certificate &amp; Key</B>
input field. Click the <B>Apply</B> button. Re-open this page and click
the <B>Start OpenVPN</B> button.</P>
<P><B>Tip</B>: The <B>Tunnel
for OLSR only</B> option deterimes, that only the OLSR mesh based internet
traffic is routed via the tunnel.</P>
<H2>Example
3: Connect two Mesh Networks</H2>
<P>To
interconnect two OLSR mesh networks via Internet, you can use an OpenVPN
tunnel (device: &quot;tun&quot;). One side is the server (default for
tunnel IP: 192.168.255.240), the other side is the client (default for
tunnel IP: 192.168.255.241). The connection is secured via a pre-shared
key (PSK). For this, click the <B>Generate</B> button. After this, copy
the input field contents to the other side. Add the &quot;tun0&quot;
device to the /etc/local.olsr.conf file. Example for the server side:</P>
<PRE>Interface &quot;tun0&quot;
{
IP4Broadcast 192.168.255.241 # unicast to client tunnel IP
}</PRE>
<P><B>Tip</B>:
The tunnel interface needs to be added to the OLSR configuration manually,
even if the tunnel is configured with IP addresses from the OLSR IP range.</P>
<H2>Example
4: Connection to the Company</H2>
<P>To
give multiple clients access e.g. to a company LAN, you can use a bridge
(tap) in mode MULTI. Configure a subrange of the LAN adresses in the <B>Tunnel
IP Range</B> setting. Example: if the LAN interface of the server is
configured with 192.168.1.1/24, a Tunnel IP Range of 192.168.1.240/28
gives up to 13 clients concurrent access (241 for the server, 242-254 for
clients). In most use cases, it is not necessary to redirect Internet
access for clients via the company LAN.</P>
<P><B>Tip</B>:
In stubborn cases (e.g. you are sitting in another company with a
restrictive Internet access policy) you can configure the server for the
<B>Protocol</B> &quot;TCP&quot;. With this, it is possible to change the
OpenVPN client configuration to use an indirect connection via a web
proxy.</P>
<H2>Additional
Configuration Hints</H2>
<UL>
<LI>
EOF

case $SSL in yes)

cat<<EOF
The <B>PTP</B> connection mode can
be used for a connection between one server and one client. For this,
the same key is configured on the client and the server.</LI>
<LI>The <B>MULTI</B> connection mode can be
used for a connection between one server and multiple clients. The
server and all clients will get the same CA certificate. Every client
and the server will need their own keys and their own certificates. The
server additionally needs the &quot;Diffie Hellman&quot; parameters. To
generate keys and certificates, you typically run the &quot;easy-rsa&quot;
scripts available in the OpenVPN source package on a PC. Alternatively,
install the &quot;freifunk-openvpn-easyrsa-en&quot; package. Generated
keys are distinguished by the &quot;Common Name&quot; information field.
All other key parameters are informal. Additionally, the date/time on
the server and the client needs to match, otherwise initiating a
connection will fail with &quot;TLS Error: Unroutable control packet&quot;.</LI>
<LI>The input field <B>Certificate &amp;
Key</B> holds a pair of a certificate and a key. Paste both files
including the &quot;------BEGIN&quot; and &quot;------END&quot; markers
into this input field. Lines before or behind those markers can be
omitted. In the server role, this setting holds the server pair, in the
client role the client pair.</LI>
<LI>This user interface does not support
keys with passwords. To remove the password from a key, run the &quot;openssl
rsa -in pass.key -out nopass.key&quot; command on a PC.</LI>
<LI>
EOF

;;esac #SSL

cat<<EOF
The LZO compression is not
negotiated. This setting needs to be consistent on the client and on the
server. No ping? Check LZO!</LI>
<LI>The tunnel device in mode &quot;Bridge
(tap)&quot; will automatically be added to the LAN bridge (br0) if the
tunnel device uses an IP address from the LAN. This is true for the
OpenVPN server and for connected clients.</LI>
<LI>The
OpenSSL library occupies much flash memory. Fot that reason, a &quot;freifunk-openvpn-nossl&quot;
package is available which only supports an un-encrypted connection in
the <B>PTP</B> connection mode. Without encryption you should configure
the remote station's IP or DNS-Name for security reasons.</LI>
<LI>The &quot;route-nopull&quot; option is
omitted from the OpenVPN config file for clients only if policy routing
on the <A HREF="olsr.html">OLSR page</A> is active, if a default route
with metric=0 exists or if the tunnel default route is valid only for
mesh users (Option: <B>Tunnel for OLSR only</B>).</LI>
<LI>Include
additional parameters to the /etc/local.ovpn and /etc/local-client.ovpn
files.</LI>
</UL>
EOF

;;esac #CFG
;;*)
DIRTY=
case $post_start_ovpn in "");;*)
DIRTY=start
;;esac
case $post_stop_ovpn in "");;*)
DIRTY=stop
;;esac
case $post_ovpn in "");;*)
VARS="ff_ovpn_count ff_ovpn_mode ff_ovpn_cli ff_ovpn_tap ff_ovpn_gw ff_ovpn_dns ff_ovpn_nat ff_ovpn_policy ff_ovpn_range ff_ovpn_remote ff_ovpn_port ff_ovpn_tcp ff_ovpn_lzo"
case $SSL in yes)
VARS="$VARS ff_ovpn_ca_crt ff_ovpn_crt_key ff_ovpn_dh ff_ovpn_psk"
;;esac
for V in $VARS; do
eval C=\"\$$V\"
C="$(unescape $C)"
case "$(nvram get $V${CFG})" in "$C");;*)
DIRTY=1
nvram set $V${CFG}="$C"
;;esac
done
;;esac
case $DIRTY in "")

cat<<EOF
<TABLE BORDER="0" CLASS="note"><TR><TD>No settings are
changed.</TD>
</TR>
</TABLE>
EOF

;;1)
nvram commit>&- 2>&-

cat<<EOF
<TABLE BORDER="0" CLASS="note"><TR><TD> The
changed settings are committed. The settings are active after the next
<A HREF="reset.html">Restart</A>.   </TD>
</TR>
</TABLE>
EOF

;;*)
echo -n '<PRE>'
/etc/init.d/S91openvpn $DIRTY
mark=$(logread|sed -n '$s/(.*//p')
case $DIRTY in start)
cat<<EOF
---begin config---
$(cat /etc/openvpn/freifunk${CFG}.conf)
---end config---
EOF
sleep 10
;;*)
sleep 5
;;esac
logread|sed -n "/^$mark/,\$s/^.*]: //p"
echo -n '</PRE>'
;;esac
;;esac

. ${SCRIPT%/*}/cgi-bin-post.sh