port 443
proto udp
dev tun

topology subnet
server 10.10.0.0 255.255.255.0
ifconfig-pool-persist /etc/openvpn/server/ipp.txt

# Zertifikate/Keys
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server.crt
key /etc/openvpn/server/server.key
dh none
tls-crypt /etc/openvpn/server/ta.key

# TLS/crypto
cipher AES-256-GCM
data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305
auth SHA256
remote-cert-eku "TLS Web Client Authentication"
#verify-x509-name server name
mssfix 1400
tun-mtu 1500
fragment 1400

# Keepalive & Robustheit
keepalive 10 120
user nobody
group nogroup
persist-key
persist-tun
explicit-exit-notify 1
verb 3

# DNS/Routen:
# (Split-Tunnel = nichts pushen; Full-Tunnel = unten 3 Zeilen aktivieren)
#push "redirect-gateway def1 bypass-dhcp"
#push "dhcp-option DNS 1.1.1.1"
#push "dhcp-option DNS 8.8.8.8"

push "route 10.10.0.0 255.255.255.0"

status /var/log/openvpn-status.log
