##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to                          #
#      wlanin.informatik.hu-berlin.de        #
#               141.20.21.20                 #
#   or wlaninn.informatik.hu-berlin.de       #
#               141.20.21.22                 #
# modified by                                #
#      moritzra@informatik.hu-berlin.de      #
# Fri Nov 24 13:09:28 MET 2019               #
##############################################

client

auth-user-pass

# verhindert Speicherung der Passwoerter im Speicher - Passwoerter muessen dann regelmaessig neu eingegeben werden
auth-nocache

# daemon mode
#daemon

# Serverzertifikatstyp pruefen. Vorgezogen als Workaround fuer schlechtes Config-File Parsing vom Gnome NetworkManager
remote-cert-eku "TLS Web Server Authentication"

# Use the same setting as you are using on
# the server.
dev tun

# Are we connecting to a UDP 
proto udp
# proto tcp

# The hostname/IP and port of the server.
resolv-retry 60 # try resolving each remote DNS name for 60 seconds before moving on
remote 141.20.21.20 1194
remote 141.20.21.22 1194 #reserve

# Workaround for mtu issues
;mssfix 1300

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server.  Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Enable compression on the VPN link.
# ab openvpn 2.4.7
# compress lzo
# bis openvpn 2.4.7
comp-lzo

# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here.  See the man page
# if your proxy server requires
# authentication.
# http-proxy-retry # retry on connection failures
# http-proxy [proxy server] [proxy port #]

# Serverzertifikat pruefen (seit OpenVPN 2.3)
verify-x509-name "C=DE, ST=Berlin, O=Humboldt-Universitaet zu Berlin, CN=wlanin.informatik.hu-berlin.de"
# Serverzertifikat pruefen (fuer OpenVPN <2.3)
;tls-remote wlanin.informatik.hu-berlin.de

# Wireless networks often produce a lot
# of duplicate packets.  Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings

# If a tls-auth key is used on the server
# then every client must also have the key.
# tls-auth wlanin.key 1
key-direction 1

remote-cert-tls server

# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
# cipher x
#cipher AES-256-CBC
# cipher AES-128-CBC

data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC
data-ciphers-fallback AES-256-GCM

# Logfile
# create new file 
# log /var/log/openvpn
# append to a file
# log-append /var/log/openvpn

# Set log file verbosity.
verb 3

# Silence repeating messages
;mute 20

# DNS-Einstellungsuebernahme
# ab OpenVPN 2.1 notwendig
#script-security 2

# Routen
# route 192.168.199.0 255.255.255.0
# set the gateway
# redirect-gateway def1
redirect-gateway

# ns-cert-type server

# DNS
dhcp-option DOMAIN informatik.hu-berlin.de
dhcp-option DNS 141.20.20.50
dhcp-option DNS 141.20.1.3


# SSL/TLS parms.
# See the server config file for more
# description.
# cert mycert.crt
# key  mycert.key
# pkcs12 mycert.p12

# Verbindungsdaten fuer Server
# Wir verwenden Passwort-Authentifizierung statt Clientzertifikaten
<ca>
-----BEGIN CERTIFICATE-----
MIICVDCCAdugAwIBAgIQZ3SdjXfYO2rbIvT/WeK/zjAKBggqhkjOPQQDAzBsMQsw
CQYDVQQGEwJHUjE3MDUGA1UECgwuSGVsbGVuaWMgQWNhZGVtaWMgYW5kIFJlc2Vh
cmNoIEluc3RpdHV0aW9ucyBDQTEkMCIGA1UEAwwbSEFSSUNBIFRMUyBFQ0MgUm9v
dCBDQSAyMDIxMB4XDTIxMDIxOTExMDExMFoXDTQ1MDIxMzExMDEwOVowbDELMAkG
A1UEBhMCR1IxNzA1BgNVBAoMLkhlbGxlbmljIEFjYWRlbWljIGFuZCBSZXNlYXJj
aCBJbnN0aXR1dGlvbnMgQ0ExJDAiBgNVBAMMG0hBUklDQSBUTFMgRUNDIFJvb3Qg
Q0EgMjAyMTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDgI/rGgltJ6rK9JOtDA4MM7
KKrxcm1lAEeIhPyaJmuqS7psBAqIXhfyVYf8MLA04jRYVxqEU+kw2anylnTDUR9Y
STHMmE5gEYd103KUkE+bECUqqHgtvpBBWJAVcqeht6NCMEAwDwYDVR0TAQH/BAUw
AwEB/zAdBgNVHQ4EFgQUyRtTgRL+BNUW0aq8mm+3oJUZbsowDgYDVR0PAQH/BAQD
AgGGMAoGCCqGSM49BAMDA2cAMGQCMBHervjcToiwqfAircJRQO9gcS3ujwLEXQNw
SaSS6sUUiHCm0w2wqsosQJz76YJumgIwK0eaB8bRwoF8yguWGEEbo/QwCZ61IygN
nxS2PFOiTAZpffpskcYqSUXm7LcT4Tps
-----END CERTIFICATE-----
</ca>

tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384

<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
53ea6531556060cbfe5ca9c9d0c8b00e
5343b403a685b9fb815d1af3db35e470
a56645fd51ab3b2bae310b60abf6a4ae
c8ca7c6171593b241a3eff003d3961fb
6e07b81bc4b458c5e9213918e71ac2c6
21a62287230b085848c57a3949728472
b88bb9c2582bcd877a73c921266d9863
6edf624f831a7983fc7addf4ebc1af64
a0a6bbc2a6b4d9c25e61059e93e35d67
e4f2adfe2b12328818cb28df30a0f363
10738b18d31a720c9723189993166ea0
85f78ffec32f2ab4f94e4843bd91ab1c
504efc286c2d2d72e4c57125373963ce
5de92a42396cf2e7505015a89639559e
be79fa4a4e7ec2ffbe8fbd20cee17443
f07876bae5a76deec50f90dc42c95911
-----END OpenVPN Static key V1-----
</tls-auth>
