VPN2

Navigation: Configuration > VPN > OpenVPN > VPN2

This tab configures one of the device's OpenVPN tunnel instances. It is shown here configured as an OpenVPN client, which connects to a remote OpenVPN server; VPN1 documents the same tab configured as a server. All OpenVPN instances are identical in structure — each can run as a server or a client with its own certificate, protocol, and addressing. For an overview of all configured tunnels and global OpenVPN settings, see the OpenVPN parent page. Changes take effect after clicking Apply, but must be saved persistently via the Save page to survive a reboot.

VPN2

Prerequisites

A client certificate suitable for OpenVPN must be uploaded on the Certificates page, signed by the same Certificate Authority (CA) as the remote server.
The address and port of the remote OpenVPN server must be known.
For Layer 3 tunnels, assign the tunnel IP address on the IP configuration page, ensuring the VPN subnet does not overlap with existing LAN or WAN subnets.

Settings

Basic settings

Enable VPN instance: Activates or deactivates this VPN tunnel instance. When disabled, the tunnel is not started.
Interface mode: Selects the connection mode. In this example it is set to Client: the device establishes a connection to a remote OpenVPN server. (In Server mode the device runs a server to which multiple clients connect — see VPN1.)
Permanent connection: When enabled on a client instance, the client automatically reconnects if the connection is lost. If disabled, the connection can be started using the VPN KEY, CUT or ALARM triggers, Modbus TCP, or the API.
Layer: Selects the network layer on which the OpenVPN interface operates. Layer 2 bridges the VPN interface with the LAN interface. Layer 3 assigns the VPN interface its own IP address, configured on the IP configuration page.
OpenVPN device type: Selects the virtual network device type for Layer 3 tunnels, either TUN or TAP (TAP is the default on this device). Both VPN endpoints must use the same device type.
Server address: The address of the remote OpenVPN server to connect to. This can be a DNS name or an IP address.
Remote cert TLS type: server: Ensures that the remote server's certificate possesses the TLS properties of a server certificate, by enabling the OpenVPN option remote-cert-tls server. This helps prevent man-in-the-middle attacks and should be enabled on client instances.
Server port: The TCP/UDP port of the remote OpenVPN server (e.g., 1194).
Protocol: The transport protocol for the connection. UDP offers slightly better performance but cannot pass through HTTP proxies and may be blocked by some mobile networks. TCP is the default on this device. The setting must match the server.
Certificate: Selects the client certificate used to authenticate at the server, uploaded on the Certificates page. Certificates with Extended Key Usage (EKU) fields can be used only as a client certificate (EKU: TLS Web Client Authentication) or only as a server certificate. The client and the server must use certificates from the same CA.
Authenticate with username and password: Enables additional username/password authentication in addition to the certificate. The Username and Password fields appear when this option is enabled.
Pull routes from server: Enables the OpenVPN pull option, which retrieves routes from the server if the server pushes them.
Use HTTP proxy: Allows the OpenVPN TCP client to tunnel the VPN connection through an HTTP proxy. To the proxy, the traffic appears as HTTPS web traffic. The system-wide HTTP proxy must be configured on the HTTP Proxy page.

TLS settings

minimum version: Sets the minimum TLS protocol version required for the connection.
TLS protection: Adds an HMAC layer on top of the TLS control channel. Available options are tls-auth, tls-crypt, or disabled. When using tls-auth, the OpenVPN direction parameter is set to 1 for client instances. The Static key field appears when this is enabled; the key file is uploaded on the Certificates page and must match the server.

Additional settings

Log level: Controls the verbosity of OpenVPN log messages in the Eventlog.
LZO compression: Configures the OpenVPN LZO compression option. No disables compression (default), Yes always enables it, and Adaptive decides dynamically whether compression is beneficial. All VPN endpoints must use the same setting.
Cipher: Selects the encryption cipher for the connection. All VPN endpoints must use the same cipher.
Authentication method: Selects the HMAC algorithm used for data-channel packet authentication.
Keepalive interval: Time in seconds between keepalive ping messages sent to the VPN partner.
Keepalive timeout: Time in seconds after which the connection is restarted if no ping packet has been received from the VPN partner.

Server-mode fields

The Client configuration and authentication options (address pool, RADIUS, client-to-client communication) and the route-push options are shown only when the interface mode is set to Server. They are documented on VPN1.

Security

Enable Remote cert TLS type: server so the client only connects to a peer presenting a genuine server certificate, preventing man-in-the-middle attacks. Use strong certificates with adequate key lengths, and certificates with Extended Key Usage (EKU) fields so client and server certificates cannot be interchanged. Enable TLS protection (tls-auth or tls-crypt) to add HMAC authentication on the control channel. Restrict traffic through the tunnel with Packet filter rules to only the necessary protocols and destinations, in accordance with IEC 62443 zone and conduit requirements.