Project

General

Profile

Actions

New Content #15812

closed

Recipe for OpenVPN Site-to-Site SSL/TLS with DCO

Added by Kris Phillips about 1 month ago. Updated 3 days ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
OpenVPN
Target version:
-
Start date:
Due date:
% Done:

100%

Estimated time:

Description

Currently, we have two S2S OpenVPN examples in our docs:

We have this one, which is a Site-to-Multi-site example:
https://docs.netgate.com/pfsense/en/latest/recipes/openvpn-s2s-tls.html

This one is great, but since it relies on iroute commands to work, it doesn't work with DCO.

This example is better for DCO, except it is an example with PSK, not TLS, so the big warnings drive people off:
https://docs.netgate.com/pfsense/en/latest/recipes/openvpn-s2s-psk.html

Basically, right now the best way to configure things for maximum throughput is a Single Site to Single Site, DCO enabled, TLS-based tunnel, which we don't have an example for. You can sort of piece good chunks from both of these existing documentation items and combine them, but customers are looking for a turnkey "best practice" doc and not wanting to sift through two different example docs to piece together the best options.

As such, I think we either need to add a third example or wipe the PSK one away and re-write it with TLS.

Actions #1

Updated by Jim Pingle about 1 month ago

  • Tracker changed from Todo to New Content
  • Subject changed from OpenVPN Site-to-Site Examples Need Updating to OpenVPN Site-to-Site with DCO Example

The existing recipes are OK, what's missing is a new/separate example dedicated to DCO.

Actions #2

Updated by Jim Pingle 25 days ago

  • Subject changed from OpenVPN Site-to-Site with DCO Example to Recipe for OpenVPN Site-to-Site SSL/TLS with DCO
  • Status changed from New to In Progress
  • Assignee set to Jim Pingle

I went through and tested a few scenarios and made some notes, and made sure it worked with static routing in OpenVPN, as well as with BGP or OSPF. I'll start on a new recipe for this soon.

Actions #5

Updated by Kris Phillips 3 days ago

  • Status changed from Feedback to Resolved

New documentation looks good. Provided it to a customer today, in fact.

Closing this one out. Thanks Jim!

Actions

Also available in: Atom PDF