rc/servers
2
0
Fork 0
Code Issues Pull requests Actions Packages Projects 1 Releases Wiki Activity
servers/roles/ocserv/README.md
Timotej Lazar cf6b682cf8 Add ocserv role 
Create a self-signed CA, set up group configs, add script to allow new
connections through the firewall.

In the base debian role, drop the default nftables forward chain with
drop policy because it clashes with this. If you enable forwarding on
a debian host, make sure to configure the firewall.
2025-04-12 18:38:48 +02:00

444 B
Raw Permalink Blame History

Install and configure ocserv with a script to configure nftables on (dis)connection.

Create a self‐signed CA authority for issuing user certificates. User and group are read from the CN and OU certificate subject fields, respectively. To configure VPN groups, define the variable vpn as follows:

"vpn": {
    "network": "<VPN network>"
    "routes": {
        "<group>": [ "<route>", … ]
        …
    }
}