VPN1

Navigation: Configuration > VPN > OpenVPN > VPN1

This tab configures the first of ten independent OpenVPN tunnel instances. Each tunnel can operate as either a server or a client, with its own certificate, protocol, and addressing configuration. The settings on this tab are identical in structure to VPN2 through VPN10. For an overview of all configured tunnels and global OpenVPN settings, see the OpenVPN parent page. Changes take effect after clicking Apply settings, but must be saved persistently via the Save page to survive a reboot.

VPN1

Prerequisites

At least one certificate suitable for OpenVPN must be uploaded on the Certificates page. Both the server and client require valid certificates signed by the same Certificate Authority (CA).
The network topology and IP addressing for the VPN tunnel endpoints must be planned. Ensure that the tunnel IP subnets do not overlap with existing LAN or WAN subnets. For Layer 3 tunnels, assign a tunnel IP address on the IP configuration page.
If the device acts as an OpenVPN client, the address and port of the remote OpenVPN server must be known.

Settings

Basic settings

Enable VPN instance: Activates or deactivates this VPN tunnel instance. When disabled, the tunnel is not started and no connection is established.
Interface mode: Selects the connection mode, either Server or Client. In server mode the device runs a TCP/UDP server to which multiple clients can connect. In client mode the device establishes a connection to a remote server.
Permanent connection: When enabled on a server instance, the server is always active. When enabled on a client instance, the client automatically reconnects if the connection is lost. If disabled, the connection can be started using the VPN KEY, CUT or ALARM triggers, Modbus TCP, or the API.
Layer: Selects the network layer on which the OpenVPN interface operates. Layer 2 bridges the VPN interface with the LAN interface. Layer 3 assigns the VPN interface its own IP address, which must be configured on the IP configuration page.
OpenVPN device type: Selects the virtual network device type for Layer 3 tunnels. Available options are TUN and TAP. TAP is the default on this device type. TUN connections always use the OpenVPN topology mode subnet. If subnets behind clients must be reachable in TUN mode, iroute entries are required in the OpenVPN server configuration. These entries are only available when the routes to the subnets are configured in the client configuration table on the server. Both VPN endpoints must use the same device type setting.
Server address (client mode only): The address of the remote OpenVPN server. This can be a DNS name or an IP address.
Remote cert TLS type: server: Ensures that the server certificate possesses the TLS properties of a server certificate. This option helps prevent man-in-the-middle attacks by enabling the OpenVPN option remote-cert-tls server.
Server port: The TCP/UDP port number (e.g., 1194). If a server instance is enabled on TCP port 443, the HTTPS web server must be disabled manually on the Web server page. Any configured access restriction for the web server will also apply to the OpenVPN server in that case. Each OpenVPN server instance must use a unique TCP/UDP port.
Protocol: The transport protocol for this VPN connection. UDP offers slightly better performance and stability but cannot pass through HTTP proxies and may be blocked by some mobile network providers. TCP is the default on this device type.
Certificate: Selects the certificate for authentication at the remote peer. New certificates can be uploaded on the Certificates page. Certificates with Extended Key Usage (EKU) fields can only be used as a server certificate (EKU: TLS Web Server Authentication) or as a client certificate (EKU: TLS Web Client Authentication). All clients connected to one server and the server itself must use certificates from the same CA.
Authenticate with username and password: Enables additional authentication using username and password in addition to certificate-based authentication.
Username: The username for additional authentication. Only visible when username/password authentication is enabled.
Password: The password for additional authentication. Only visible when username/password authentication is enabled.
Pull routes from server (client mode only): Enables the OpenVPN pull option, which retrieves routes from the server if the server pushes them.
Use HTTP proxy (client mode only): Allows OpenVPN TCP clients to tunnel the VPN connection through an HTTP proxy. To the proxy, the traffic appears as HTTPS web traffic. The system-wide HTTP proxy must be configured on the HTTP Proxy page.

Server mode settings

The following settings are only visible when the interface mode is set to Server.

First IP address of pool: The starting IP address for the address pool used to assign IP addresses to connecting clients. The address range must lie within the IP subnet of the VPN interface and must not overlap with addresses already used by a DHCP server or any other interface.
Allow client-to-client communication: Enables or disables the OpenVPN client-to-client option, which controls whether traffic between clients connected to this server instance is permitted.
Push OpenVPN server as default gateway: Enables the OpenVPN option push redirect-gateway def1, which configures all connected clients to route their default gateway through the VPN connection. The route to the OpenVPN server itself is preserved.
Push route for LAN interface: Pushes a route for the network connected to the local LAN interface to all connected clients.
Push routes in static routing table: Pushes all entries from the static routing table (configured on the IP routing page) to connected clients.

TLS settings

minimum version: Sets the minimum TLS protocol version required for the VPN connection.
TLS protection: Adds an additional layer of HMAC authentication on top of the TLS control channel. Available options are tls-auth, tls-crypt, or disabled. When using tls-auth, the OpenVPN direction parameter is automatically set to 0 for server instances and 1 for client instances.
Static key: Selects the key file for TLS protection. This field is only visible when TLS protection is enabled. The key file can be uploaded on the Certificates page.

Additional settings

Log level: Controls the verbosity of OpenVPN log messages in the Eventlog.
LZO compression: Configures the OpenVPN LZO compression option. No disables compression (default). Yes always enables LZO compression. Adaptive uses an adaptive algorithm to dynamically determine whether compression is beneficial. All VPN endpoints must use the same compression setting.
Cipher: Selects the encryption cipher for the VPN connection. The default cipher is BF-CBC. All VPN endpoints must use the same cipher. The value none can be used for performance-critical Layer 2 tunnels on intranets.
Authentication method: Selects the HMAC authentication algorithm used for data channel packet authentication.
Keepalive interval: Time in seconds between keepalive ping messages sent to the VPN partner.
Keepalive timeout: Time in seconds after which the VPN connection is restarted if no ping packet has been received from the VPN partner.

ATTENTION

If a server instance is enabled on TCP port 443, the HTTPS web server must be disabled manually on the Web server page. Failure to do so will cause a port conflict. Each OpenVPN server instance must use a unique TCP/UDP port number.

Security

Use strong certificates with adequate key lengths for OpenVPN tunnels. Certificates with Extended Key Usage (EKU) fields provide an additional layer of protection by ensuring that server and client certificates cannot be interchanged. Enable the Remote cert TLS type: server option on client instances to prevent man-in-the-middle attacks. Enable TLS protection (tls-auth or tls-crypt) to add HMAC authentication on top of the TLS control channel, which helps mitigate denial-of-service attacks. Ensure that Packet filter rules restrict traffic through VPN tunnels to only the necessary protocols and destinations in accordance with IEC 62443 zone and conduit requirements.