Revision 01ab50fd
Added by sbeaver about 10 years ago
| usr/local/www/vpn_openvpn_server.php | ||
|---|---|---|
| 1 |
<?php
|
|
| 1 |
<?php |
|
| 2 | 2 |
/* |
| 3 | 3 |
vpn_openvpn_server.php |
| 4 | 4 |
|
| 5 | 5 |
Copyright (C) 2008 Shrew Soft Inc. |
| 6 | 6 |
Copyright (C) 2013-2015 Electric Sheep Fencing, LP |
| 7 |
All rights reserved.
|
|
| 7 |
All rights reserved. |
|
| 8 | 8 |
|
| 9 | 9 |
Redistribution and use in source and binary forms, with or without |
| 10 | 10 |
modification, are permitted provided that the following conditions are met: |
| 11 |
|
|
| 11 |
|
|
| 12 | 12 |
1. Redistributions of source code must retain the above copyright notice, |
| 13 | 13 |
this list of conditions and the following disclaimer. |
| 14 |
|
|
| 14 |
|
|
| 15 | 15 |
2. Redistributions in binary form must reproduce the above copyright |
| 16 | 16 |
notice, this list of conditions and the following disclaimer in the |
| 17 | 17 |
documentation and/or other materials provided with the distribution. |
| 18 |
|
|
| 18 |
|
|
| 19 | 19 |
THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, |
| 20 | 20 |
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY |
| 21 | 21 |
AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE |
| ... | ... | |
| 58 | 58 |
|
| 59 | 59 |
$a_crl =& $config['crl']; |
| 60 | 60 |
|
| 61 |
foreach ($a_crl as $cid => $acrl) |
|
| 61 |
foreach ($a_crl as $cid => $acrl) {
|
|
| 62 | 62 |
if (!isset($acrl['refid'])) |
| 63 | 63 |
unset ($a_crl[$cid]); |
| 64 |
} |
|
| 64 | 65 |
|
| 65 | 66 |
if (is_numericint($_GET['id'])) |
| 66 | 67 |
$id = $_GET['id']; |
| 68 |
|
|
| 67 | 69 |
if (isset($_POST['id']) && is_numericint($_POST['id'])) |
| 68 | 70 |
$id = $_POST['id']; |
| 69 | 71 |
|
| 70 | 72 |
$act = $_GET['act']; |
| 73 |
|
|
| 71 | 74 |
if (isset($_POST['act'])) |
| 72 | 75 |
$act = $_POST['act']; |
| 73 | 76 |
|
| ... | ... | |
| 82 | 85 |
pfSenseHeader("vpn_openvpn_server.php");
|
| 83 | 86 |
exit; |
| 84 | 87 |
} |
| 88 |
|
|
| 85 | 89 |
if (!empty($a_server[$id])) |
| 86 | 90 |
openvpn_delete('server', $a_server[$id]);
|
| 91 |
|
|
| 87 | 92 |
unset($a_server[$id]); |
| 88 | 93 |
write_config(); |
| 89 | 94 |
$savemsg = gettext("Server successfully deleted")."<br />";
|
| ... | ... | |
| 113 | 118 |
$pconfig['authmode'] = $a_server[$id]['authmode']; |
| 114 | 119 |
$pconfig['dev_mode'] = $a_server[$id]['dev_mode']; |
| 115 | 120 |
$pconfig['interface'] = $a_server[$id]['interface']; |
| 121 |
|
|
| 116 | 122 |
if (!empty($a_server[$id]['ipaddr'])) {
|
| 117 | 123 |
$pconfig['interface'] = $pconfig['interface'] . '|' . $a_server[$id]['ipaddr']; |
| 118 | 124 |
} |
| 125 |
|
|
| 119 | 126 |
$pconfig['local_port'] = $a_server[$id]['local_port']; |
| 120 | 127 |
$pconfig['description'] = $a_server[$id]['description']; |
| 121 | 128 |
$pconfig['custom_options'] = $a_server[$id]['custom_options']; |
| ... | ... | |
| 125 | 132 |
$pconfig['tlsauth_enable'] = "yes"; |
| 126 | 133 |
$pconfig['tls'] = base64_decode($a_server[$id]['tls']); |
| 127 | 134 |
} |
| 135 |
|
|
| 128 | 136 |
$pconfig['caref'] = $a_server[$id]['caref']; |
| 129 | 137 |
$pconfig['crlref'] = $a_server[$id]['crlref']; |
| 130 | 138 |
$pconfig['certref'] = $a_server[$id]['certref']; |
| 131 | 139 |
$pconfig['dh_length'] = $a_server[$id]['dh_length']; |
| 140 |
|
|
| 132 | 141 |
if (isset($a_server[$id]['cert_depth'])) |
| 133 | 142 |
$pconfig['cert_depth'] = $a_server[$id]['cert_depth']; |
| 134 | 143 |
else |
| 135 | 144 |
$pconfig['cert_depth'] = 1; |
| 145 |
|
|
| 136 | 146 |
if ($pconfig['mode'] == "server_tls_user") |
| 137 | 147 |
$pconfig['strictusercn'] = $a_server[$id]['strictusercn']; |
| 138 | 148 |
} else |
| 139 | 149 |
$pconfig['shared_key'] = base64_decode($a_server[$id]['shared_key']); |
| 150 |
|
|
| 140 | 151 |
$pconfig['crypto'] = $a_server[$id]['crypto']; |
| 141 | 152 |
// OpenVPN Defaults to SHA1 if unset |
| 142 | 153 |
$pconfig['digest'] = !empty($a_server[$id]['digest']) ? $a_server[$id]['digest'] : "SHA1"; |
| ... | ... | |
| 165 | 176 |
$pconfig['serverbridge_dhcp_end'] = $a_server[$id]['serverbridge_dhcp_end']; |
| 166 | 177 |
|
| 167 | 178 |
$pconfig['dns_domain'] = $a_server[$id]['dns_domain']; |
| 179 |
|
|
| 168 | 180 |
if ($pconfig['dns_domain']) |
| 169 | 181 |
$pconfig['dns_domain_enable'] = true; |
| 170 | 182 |
|
| ... | ... | |
| 172 | 184 |
$pconfig['dns_server2'] = $a_server[$id]['dns_server2']; |
| 173 | 185 |
$pconfig['dns_server3'] = $a_server[$id]['dns_server3']; |
| 174 | 186 |
$pconfig['dns_server4'] = $a_server[$id]['dns_server4']; |
| 187 |
|
|
| 175 | 188 |
if ($pconfig['dns_server1'] || |
| 176 | 189 |
$pconfig['dns_server2'] || |
| 177 | 190 |
$pconfig['dns_server3'] || |
| ... | ... | |
| 180 | 193 |
|
| 181 | 194 |
$pconfig['ntp_server1'] = $a_server[$id]['ntp_server1']; |
| 182 | 195 |
$pconfig['ntp_server2'] = $a_server[$id]['ntp_server2']; |
| 196 |
|
|
| 183 | 197 |
if ($pconfig['ntp_server1'] || |
| 184 | 198 |
$pconfig['ntp_server2']) |
| 185 | 199 |
$pconfig['ntp_server_enable'] = true; |
| ... | ... | |
| 190 | 204 |
|
| 191 | 205 |
$pconfig['wins_server1'] = $a_server[$id]['wins_server1']; |
| 192 | 206 |
$pconfig['wins_server2'] = $a_server[$id]['wins_server2']; |
| 207 |
|
|
| 193 | 208 |
if ($pconfig['wins_server1'] || |
| 194 | 209 |
$pconfig['wins_server2']) |
| 195 | 210 |
$pconfig['wins_server_enable'] = true; |
| 196 | 211 |
|
| 197 | 212 |
$pconfig['client_mgmt_port'] = $a_server[$id]['client_mgmt_port']; |
| 213 |
|
|
| 198 | 214 |
if ($pconfig['client_mgmt_port']) |
| 199 | 215 |
$pconfig['client_mgmt_port_enable'] = true; |
| 200 | 216 |
|
| 201 | 217 |
$pconfig['nbdd_server1'] = $a_server[$id]['nbdd_server1']; |
| 218 |
|
|
| 202 | 219 |
if ($pconfig['nbdd_server1']) |
| 203 | 220 |
$pconfig['nbdd_server_enable'] = true; |
| 204 | 221 |
|
| ... | ... | |
| 207 | 224 |
$pconfig['autotls_enable'] = "yes"; |
| 208 | 225 |
|
| 209 | 226 |
$pconfig['duplicate_cn'] = isset($a_server[$id]['duplicate_cn']); |
| 210 |
|
|
| 227 |
|
|
| 211 | 228 |
$pconfig['no_tun_ipv6'] = $a_server[$id]['no_tun_ipv6']; |
| 229 |
|
|
| 212 | 230 |
if (isset($a_server[$id]['verbosity_level'])) |
| 213 | 231 |
$pconfig['verbosity_level'] = $a_server[$id]['verbosity_level']; |
| 214 | 232 |
else |
| 215 | 233 |
$pconfig['verbosity_level'] = 1; // Default verbosity is 1 |
| 216 |
|
|
| 234 |
|
|
| 217 | 235 |
$pconfig['push_register_dns'] = $a_server[$id]['push_register_dns']; |
| 218 | 236 |
} |
| 219 | 237 |
} |
| ... | ... | |
| 228 | 246 |
$vpnid = 0; |
| 229 | 247 |
|
| 230 | 248 |
list($iv_iface, $iv_ip) = explode ("|",$pconfig['interface']);
|
| 249 |
|
|
| 231 | 250 |
if (is_ipaddrv4($iv_ip) && (stristr($pconfig['protocol'], "6") !== false)) {
|
| 232 | 251 |
$input_errors[] = gettext("Protocol and IP address families do not match. You cannot select an IPv6 protocol and an IPv4 IP address.");
|
| 233 | 252 |
} elseif (is_ipaddrv6($iv_ip) && (stristr($pconfig['protocol'], "6") === false)) {
|
| ... | ... | |
| 269 | 288 |
$input_errors[] = $result; |
| 270 | 289 |
|
| 271 | 290 |
$portused = openvpn_port_used($pconfig['protocol'], $pconfig['interface'], $pconfig['local_port'], $vpnid); |
| 291 |
|
|
| 272 | 292 |
if (($portused != $vpnid) && ($portused != 0)) |
| 273 | 293 |
$input_errors[] = gettext("The specified 'Local port' is in use. Please select another value");
|
| 274 | 294 |
|
| 275 | 295 |
if ($pconfig['autokey_enable']) |
| 276 | 296 |
$pconfig['shared_key'] = openvpn_create_key(); |
| 277 | 297 |
|
| 278 |
if (!$tls_mode && !$pconfig['autokey_enable']) |
|
| 298 |
if (!$tls_mode && !$pconfig['autokey_enable']) {
|
|
| 279 | 299 |
if (!strstr($pconfig['shared_key'], "-----BEGIN OpenVPN Static key V1-----") || |
| 280 | 300 |
!strstr($pconfig['shared_key'], "-----END OpenVPN Static key V1-----")) |
| 281 | 301 |
$input_errors[] = gettext("The field 'Shared Key' does not appear to be valid");
|
| 302 |
} |
|
| 282 | 303 |
|
| 283 |
if ($tls_mode && $pconfig['tlsauth_enable'] && !$pconfig['autotls_enable']) |
|
| 304 |
if ($tls_mode && $pconfig['tlsauth_enable'] && !$pconfig['autotls_enable']) {
|
|
| 284 | 305 |
if (!strstr($pconfig['tls'], "-----BEGIN OpenVPN Static key V1-----") || |
| 285 | 306 |
!strstr($pconfig['tls'], "-----END OpenVPN Static key V1-----")) |
| 286 | 307 |
$input_errors[] = gettext("The field 'TLS Authentication Key' does not appear to be valid");
|
| 308 |
} |
|
| 287 | 309 |
|
| 288 | 310 |
if ($pconfig['dns_server_enable']) {
|
| 289 | 311 |
if (!empty($pconfig['dns_server1']) && !is_ipaddr(trim($pconfig['dns_server1']))) |
| ... | ... | |
| 343 | 365 |
} else {
|
| 344 | 366 |
if ($pconfig['serverbridge_dhcp'] && $pconfig['tunnel_network']) |
| 345 | 367 |
$input_errors[] = gettext("Using a tunnel network and server bridge settings together is not allowed.");
|
| 346 |
if (($pconfig['serverbridge_dhcp_start'] && !$pconfig['serverbridge_dhcp_end'])
|
|
| 368 |
if (($pconfig['serverbridge_dhcp_start'] && !$pconfig['serverbridge_dhcp_end']) |
|
| 347 | 369 |
|| (!$pconfig['serverbridge_dhcp_start'] && $pconfig['serverbridge_dhcp_end'])) |
| 348 | 370 |
$input_errors[] = gettext("Server Bridge DHCP Start and End must both be empty, or defined.");
|
| 349 | 371 |
if (($pconfig['serverbridge_dhcp_start'] && !is_ipaddrv4($pconfig['serverbridge_dhcp_start']))) |
| ... | ... | |
| 354 | 376 |
$input_errors[] = gettext("The Server Bridge DHCP range is invalid (start higher than end).");
|
| 355 | 377 |
} |
| 356 | 378 |
do_input_validation($_POST, $reqdfields, $reqdfieldsn, $input_errors); |
| 357 |
|
|
| 379 |
|
|
| 358 | 380 |
if (!$input_errors) {
|
| 359 | 381 |
|
| 360 | 382 |
$server = array(); |
| 361 | 383 |
|
| 362 |
if ($id && $pconfig['dev_mode'] <> $a_server[$id]['dev_mode'])
|
|
| 384 |
if ($id && $pconfig['dev_mode'] != $a_server[$id]['dev_mode'])
|
|
| 363 | 385 |
openvpn_delete('server', $a_server[$id]);// delete(rename) old interface so a new TUN or TAP interface can be created.
|
| 364 | 386 |
|
| 365 | 387 |
if ($vpnid) |
| ... | ... | |
| 369 | 391 |
|
| 370 | 392 |
if ($_POST['disable'] == "yes") |
| 371 | 393 |
$server['disable'] = true; |
| 394 |
|
|
| 372 | 395 |
$server['mode'] = $pconfig['mode']; |
| 373 | 396 |
if (!empty($pconfig['authmode']) && (($pconfig['mode'] == "server_user") || ($pconfig['mode'] == "server_tls_user"))) |
| 374 | 397 |
$server['authmode'] = implode(",", $pconfig['authmode']);
|
| 398 |
|
|
| 375 | 399 |
$server['protocol'] = $pconfig['protocol']; |
| 376 | 400 |
$server['dev_mode'] = $pconfig['dev_mode']; |
| 377 | 401 |
list($server['interface'], $server['ipaddr']) = explode ("|",$pconfig['interface']);
|
| ... | ... | |
| 390 | 414 |
$server['certref'] = $pconfig['certref']; |
| 391 | 415 |
$server['dh_length'] = $pconfig['dh_length']; |
| 392 | 416 |
$server['cert_depth'] = $pconfig['cert_depth']; |
| 417 |
|
|
| 393 | 418 |
if ($pconfig['mode'] == "server_tls_user") |
| 394 | 419 |
$server['strictusercn'] = $pconfig['strictusercn']; |
| 395 | 420 |
} else {
|
| 396 | 421 |
$server['shared_key'] = base64_encode($pconfig['shared_key']); |
| 397 | 422 |
} |
| 423 |
|
|
| 398 | 424 |
$server['crypto'] = $pconfig['crypto']; |
| 399 | 425 |
$server['digest'] = $pconfig['digest']; |
| 400 | 426 |
$server['engine'] = $pconfig['engine']; |
| ... | ... | |
| 441 | 467 |
$server['netbios_enable'] = $pconfig['netbios_enable']; |
| 442 | 468 |
$server['netbios_ntype'] = $pconfig['netbios_ntype']; |
| 443 | 469 |
$server['netbios_scope'] = $pconfig['netbios_scope']; |
| 444 |
|
|
| 470 |
|
|
| 445 | 471 |
$server['no_tun_ipv6'] = $pconfig['no_tun_ipv6']; |
| 446 | 472 |
$server['verbosity_level'] = $pconfig['verbosity_level']; |
| 447 | 473 |
|
| ... | ... | |
| 469 | 495 |
|
| 470 | 496 |
openvpn_resync('server', $server);
|
| 471 | 497 |
write_config(); |
| 472 |
|
|
| 498 |
|
|
| 473 | 499 |
header("Location: vpn_openvpn_server.php");
|
| 474 | 500 |
exit; |
| 475 | 501 |
} |
| 502 |
|
|
| 476 | 503 |
if (!empty($pconfig['authmode'])) |
| 477 | 504 |
$pconfig['authmode'] = implode(",", $pconfig['authmode']);
|
| 478 | 505 |
} |
| 506 |
|
|
| 479 | 507 |
$pgtitle = array(gettext("OpenVPN"), gettext("Server"));
|
| 480 | 508 |
$shortcut_section = "openvpn"; |
| 481 | 509 |
|
| 482 | 510 |
include("head.inc");
|
| 483 | 511 |
|
| 484 |
?> |
|
| 485 |
|
|
| 486 |
<body link="#0000CC" vlink="#0000CC" alink="#0000CC" onload="<?= $jsevents["body"]["onload"] ?>"> |
|
| 487 |
<?php include("fbegin.inc"); ?>
|
|
| 488 |
<script type="text/javascript"> |
|
| 489 |
//<![CDATA[ |
|
| 512 |
function build_mode_list() {
|
|
| 513 |
global $openvpn_server_modes; |
|
| 490 | 514 |
|
| 491 |
function mode_change() {
|
|
| 492 |
index = document.iform.mode.selectedIndex; |
|
| 493 |
value = document.iform.mode.options[index].value; |
|
| 494 |
switch(value) {
|
|
| 495 |
case "p2p_tls": |
|
| 496 |
case "server_tls": |
|
| 497 |
case "server_user": |
|
| 498 |
document.getElementById("tls").style.display="";
|
|
| 499 |
document.getElementById("tls_ca").style.display="";
|
|
| 500 |
document.getElementById("tls_crl").style.display="";
|
|
| 501 |
document.getElementById("tls_cert").style.display="";
|
|
| 502 |
document.getElementById("tls_dh").style.display="";
|
|
| 503 |
document.getElementById("cert_depth").style.display="";
|
|
| 504 |
document.getElementById("strictusercn").style.display="none";
|
|
| 505 |
document.getElementById("psk").style.display="none";
|
|
| 506 |
break; |
|
| 507 |
case "server_tls_user": |
|
| 508 |
document.getElementById("tls").style.display="";
|
|
| 509 |
document.getElementById("tls_ca").style.display="";
|
|
| 510 |
document.getElementById("tls_crl").style.display="";
|
|
| 511 |
document.getElementById("tls_cert").style.display="";
|
|
| 512 |
document.getElementById("tls_dh").style.display="";
|
|
| 513 |
document.getElementById("cert_depth").style.display="";
|
|
| 514 |
document.getElementById("strictusercn").style.display="";
|
|
| 515 |
document.getElementById("psk").style.display="none";
|
|
| 516 |
break; |
|
| 517 |
case "p2p_shared_key": |
|
| 518 |
document.getElementById("tls").style.display="none";
|
|
| 519 |
document.getElementById("tls_ca").style.display="none";
|
|
| 520 |
document.getElementById("tls_crl").style.display="none";
|
|
| 521 |
document.getElementById("tls_cert").style.display="none";
|
|
| 522 |
document.getElementById("tls_dh").style.display="none";
|
|
| 523 |
document.getElementById("cert_depth").style.display="none";
|
|
| 524 |
document.getElementById("strictusercn").style.display="none";
|
|
| 525 |
document.getElementById("psk").style.display="";
|
|
| 526 |
break; |
|
| 527 |
} |
|
| 528 |
switch(value) {
|
|
| 529 |
case "p2p_shared_key": |
|
| 530 |
document.getElementById("client_opts").style.display="none";
|
|
| 531 |
document.getElementById("remote_optsv4").style.display="";
|
|
| 532 |
document.getElementById("remote_optsv6").style.display="";
|
|
| 533 |
document.getElementById("gwredir_opts").style.display="none";
|
|
| 534 |
document.getElementById("local_optsv4").style.display="none";
|
|
| 535 |
document.getElementById("local_optsv6").style.display="none";
|
|
| 536 |
document.getElementById("authmodetr").style.display="none";
|
|
| 537 |
document.getElementById("inter_client_communication").style.display="none";
|
|
| 538 |
break; |
|
| 539 |
case "p2p_tls": |
|
| 540 |
document.getElementById("client_opts").style.display="none";
|
|
| 541 |
document.getElementById("remote_optsv4").style.display="";
|
|
| 542 |
document.getElementById("remote_optsv6").style.display="";
|
|
| 543 |
document.getElementById("gwredir_opts").style.display="";
|
|
| 544 |
document.getElementById("local_optsv4").style.display="";
|
|
| 545 |
document.getElementById("local_optsv6").style.display="";
|
|
| 546 |
document.getElementById("authmodetr").style.display="none";
|
|
| 547 |
document.getElementById("inter_client_communication").style.display="none";
|
|
| 548 |
break; |
|
| 549 |
case "server_user": |
|
| 550 |
case "server_tls_user": |
|
| 551 |
document.getElementById("authmodetr").style.display="";
|
|
| 552 |
document.getElementById("client_opts").style.display="";
|
|
| 553 |
document.getElementById("remote_optsv4").style.display="none";
|
|
| 554 |
document.getElementById("remote_optsv6").style.display="none";
|
|
| 555 |
document.getElementById("gwredir_opts").style.display="";
|
|
| 556 |
document.getElementById("local_optsv4").style.display="";
|
|
| 557 |
document.getElementById("local_optsv6").style.display="";
|
|
| 558 |
document.getElementById("inter_client_communication").style.display="";
|
|
| 559 |
break; |
|
| 560 |
case "server_tls": |
|
| 561 |
document.getElementById("authmodetr").style.display="none";
|
|
| 562 |
default: |
|
| 563 |
document.getElementById("client_opts").style.display="";
|
|
| 564 |
document.getElementById("remote_optsv4").style.display="none";
|
|
| 565 |
document.getElementById("remote_optsv6").style.display="none";
|
|
| 566 |
document.getElementById("gwredir_opts").style.display="";
|
|
| 567 |
document.getElementById("local_optsv4").style.display="";
|
|
| 568 |
document.getElementById("local_optsv6").style.display="";
|
|
| 569 |
document.getElementById("inter_client_communication").style.display="";
|
|
| 570 |
break; |
|
| 571 |
} |
|
| 572 |
gwredir_change(); |
|
| 573 |
} |
|
| 515 |
$list = array(); |
|
| 574 | 516 |
|
| 575 |
function autokey_change() {
|
|
| 517 |
foreach ($openvpn_server_modes as $name => $desc) |
|
| 518 |
$list[$name] = $desc; |
|
| 576 | 519 |
|
| 577 |
if ((document.iform.autokey_enable != null) && (document.iform.autokey_enable.checked)) |
|
| 578 |
document.getElementById("autokey_opts").style.display="none";
|
|
| 579 |
else |
|
| 580 |
document.getElementById("autokey_opts").style.display="";
|
|
| 520 |
return($list); |
|
| 581 | 521 |
} |
| 582 | 522 |
|
| 583 |
function tlsauth_change() {
|
|
| 523 |
function build_if_list() {
|
|
| 524 |
$list = array(); |
|
| 584 | 525 |
|
| 585 |
<?php if (!$pconfig['tls']): ?> |
|
| 586 |
if (document.iform.tlsauth_enable.checked) |
|
| 587 |
document.getElementById("tlsauth_opts").style.display="";
|
|
| 588 |
else |
|
| 589 |
document.getElementById("tlsauth_opts").style.display="none";
|
|
| 590 |
<?php endif; ?> |
|
| 526 |
$interfaces = get_configured_interface_with_descr(); |
|
| 527 |
$carplist = get_configured_carp_interface_list(); |
|
| 591 | 528 |
|
| 592 |
autotls_change();
|
|
| 593 |
}
|
|
| 529 |
foreach ($carplist as $cif => $carpip)
|
|
| 530 |
$interfaces[$cif.'|'.$carpip] = $carpip." (".get_vip_descr($carpip).")";
|
|
| 594 | 531 |
|
| 595 |
function autotls_change() {
|
|
| 532 |
$aliaslist = get_configured_ip_aliases_list();
|
|
| 596 | 533 |
|
| 597 |
<?php if (!$pconfig['tls']): ?> |
|
| 598 |
autocheck = document.iform.autotls_enable.checked; |
|
| 599 |
<?php else: ?> |
|
| 600 |
autocheck = false; |
|
| 601 |
<?php endif; ?> |
|
| 534 |
foreach ($aliaslist as $aliasip => $aliasif) |
|
| 535 |
$interfaces[$aliasif.'|'.$aliasip] = $aliasip." (".get_vip_descr($aliasip).")";
|
|
| 602 | 536 |
|
| 603 |
if (document.iform.tlsauth_enable.checked && !autocheck) |
|
| 604 |
document.getElementById("autotls_opts").style.display="";
|
|
| 605 |
else |
|
| 606 |
document.getElementById("autotls_opts").style.display="none";
|
|
| 607 |
} |
|
| 537 |
$grouplist = return_gateway_groups_array(); |
|
| 608 | 538 |
|
| 609 |
function gwredir_change() {
|
|
| 539 |
foreach ($grouplist as $name => $group) {
|
|
| 540 |
if($group['ipprotocol'] != inet) |
|
| 541 |
continue; |
|
| 610 | 542 |
|
| 611 |
if (document.iform.gwredir.checked) {
|
|
| 612 |
document.getElementById("local_optsv4").style.display="none";
|
|
| 613 |
document.getElementById("local_optsv6").style.display="none";
|
|
| 614 |
} else {
|
|
| 615 |
document.getElementById("local_optsv4").style.display="";
|
|
| 616 |
document.getElementById("local_optsv6").style.display="";
|
|
| 543 |
if($group[0]['vip'] != "")
|
|
| 544 |
$vipif = $group[0]['vip'];
|
|
| 545 |
else
|
|
| 546 |
$vipif = $group[0]['int'];
|
|
| 547 |
|
|
| 548 |
$interfaces[$name] = "GW Group {$name}";
|
|
| 617 | 549 |
} |
| 618 |
} |
|
| 619 | 550 |
|
| 620 |
function dns_domain_change() {
|
|
| 551 |
$interfaces['lo0'] = "Localhost"; |
|
| 552 |
$interfaces['any'] = "any"; |
|
| 621 | 553 |
|
| 622 |
if (document.iform.dns_domain_enable.checked)
|
|
| 623 |
document.getElementById("dns_domain_data").style.display="";
|
|
| 624 |
else |
|
| 625 |
document.getElementById("dns_domain_data").style.display="none";
|
|
| 554 |
foreach ($interfaces as $iface => $ifacename)
|
|
| 555 |
$list[$iface] = $ifacename;
|
|
| 556 |
|
|
| 557 |
return($list);
|
|
| 626 | 558 |
} |
| 627 | 559 |
|
| 628 |
function dns_server_change() {
|
|
| 560 |
function build_crl_list() {
|
|
| 561 |
global $a_crl; |
|
| 629 | 562 |
|
| 630 |
if (document.iform.dns_server_enable.checked) |
|
| 631 |
document.getElementById("dns_server_data").style.display="";
|
|
| 632 |
else |
|
| 633 |
document.getElementById("dns_server_data").style.display="none";
|
|
| 634 |
} |
|
| 563 |
$list = array('' => 'None');
|
|
| 635 | 564 |
|
| 636 |
function wins_server_change() {
|
|
| 565 |
foreach ($a_crl as $crl) {
|
|
| 566 |
$caname = ""; |
|
| 567 |
$ca = lookup_ca($crl['caref']); |
|
| 637 | 568 |
|
| 638 |
if (document.iform.wins_server_enable.checked) |
|
| 639 |
document.getElementById("wins_server_data").style.display="";
|
|
| 640 |
else |
|
| 641 |
document.getElementById("wins_server_data").style.display="none";
|
|
| 642 |
} |
|
| 569 |
if ($ca) |
|
| 570 |
$caname = " (CA: {$ca['descr']})";
|
|
| 643 | 571 |
|
| 644 |
function client_mgmt_port_change() {
|
|
| 572 |
$list[$crl['refid']] = $crl['descr'] . $caname; |
|
| 573 |
} |
|
| 645 | 574 |
|
| 646 |
if (document.iform.client_mgmt_port_enable.checked) |
|
| 647 |
document.getElementById("client_mgmt_port_data").style.display="";
|
|
| 648 |
else |
|
| 649 |
document.getElementById("client_mgmt_port_data").style.display="none";
|
|
| 575 |
return($list); |
|
| 650 | 576 |
} |
| 651 | 577 |
|
| 652 |
function ntp_server_change() {
|
|
| 578 |
function build_cert_list() {
|
|
| 579 |
global $a_cert; |
|
| 653 | 580 |
|
| 654 |
if (document.iform.ntp_server_enable.checked) |
|
| 655 |
document.getElementById("ntp_server_data").style.display="";
|
|
| 656 |
else |
|
| 657 |
document.getElementById("ntp_server_data").style.display="none";
|
|
| 658 |
} |
|
| 581 |
$list = array(); |
|
| 659 | 582 |
|
| 660 |
function netbios_change() {
|
|
| 583 |
foreach ($a_cert as $cert) {
|
|
| 584 |
$caname = ""; |
|
| 585 |
$inuse = ""; |
|
| 586 |
$revoked = ""; |
|
| 587 |
$ca = lookup_ca($cert['caref']); |
|
| 661 | 588 |
|
| 662 |
if (document.iform.netbios_enable.checked) {
|
|
| 663 |
document.getElementById("netbios_data").style.display="";
|
|
| 664 |
document.getElementById("wins_opts").style.display="";
|
|
| 665 |
} else {
|
|
| 666 |
document.getElementById("netbios_data").style.display="none";
|
|
| 667 |
document.getElementById("wins_opts").style.display="none";
|
|
| 589 |
if ($ca) |
|
| 590 |
$caname = " (CA: {$ca['descr']})";
|
|
| 591 |
|
|
| 592 |
if ($pconfig['certref'] == $cert['refid']) |
|
| 593 |
$selected = "selected=\"selected\""; |
|
| 594 |
|
|
| 595 |
if (cert_in_use($cert['refid'])) |
|
| 596 |
$inuse = " *In Use"; |
|
| 597 |
|
|
| 598 |
if (is_cert_revoked($cert)) |
|
| 599 |
$revoked = " *Revoked"; |
|
| 600 |
|
|
| 601 |
$list[$cert['refid']] = $cert['descr'] . $caname . $inuse . $revoked; |
|
| 668 | 602 |
} |
| 603 |
|
|
| 604 |
return($list); |
|
| 669 | 605 |
} |
| 670 | 606 |
|
| 671 |
function tuntap_change() {
|
|
| 607 |
function build_bridge_list() {
|
|
| 608 |
$list = array(); |
|
| 672 | 609 |
|
| 673 |
mindex = document.iform.mode.selectedIndex; |
|
| 674 |
mvalue = document.iform.mode.options[mindex].value; |
|
| 610 |
$serverbridge_interface['none'] = "none"; |
|
| 611 |
$serverbridge_interface = array_merge($serverbridge_interface, get_configured_interface_with_descr()); |
|
| 612 |
$carplist = get_configured_carp_interface_list(); |
|
| 675 | 613 |
|
| 676 |
switch(mvalue) {
|
|
| 677 |
case "p2p_tls": |
|
| 678 |
case "p2p_shared_key": |
|
| 679 |
p2p = true; |
|
| 680 |
break; |
|
| 681 |
default: |
|
| 682 |
p2p = false; |
|
| 683 |
break; |
|
| 684 |
} |
|
| 614 |
foreach ($carplist as $cif => $carpip) |
|
| 615 |
$serverbridge_interface[$cif.'|'.$carpip] = $carpip." (".get_vip_descr($carpip).")";
|
|
| 685 | 616 |
|
| 686 |
index = document.iform.dev_mode.selectedIndex; |
|
| 687 |
value = document.iform.dev_mode.options[index].value; |
|
| 688 |
switch(value) {
|
|
| 689 |
case "tun": |
|
| 690 |
document.getElementById("chkboxNoTunIPv6").style.display="";
|
|
| 691 |
document.getElementById("ipv4_tunnel_network").className="vncellreq";
|
|
| 692 |
document.getElementById("serverbridge_dhcp").style.display="none";
|
|
| 693 |
document.getElementById("serverbridge_interface").style.display="none";
|
|
| 694 |
document.getElementById("serverbridge_dhcp_start").style.display="none";
|
|
| 695 |
document.getElementById("serverbridge_dhcp_end").style.display="none";
|
|
| 696 |
document.getElementById("topology_subnet_opt").style.display="";
|
|
| 697 |
break; |
|
| 698 |
case "tap": |
|
| 699 |
document.getElementById("chkboxNoTunIPv6").style.display="none";
|
|
| 700 |
document.getElementById("ipv4_tunnel_network").className="vncell";
|
|
| 701 |
if (!p2p) {
|
|
| 702 |
document.getElementById("serverbridge_dhcp").style.display="";
|
|
| 703 |
document.getElementById("serverbridge_interface").style.display="";
|
|
| 704 |
document.getElementById("serverbridge_dhcp_start").style.display="";
|
|
| 705 |
document.getElementById("serverbridge_dhcp_end").style.display="";
|
|
| 706 |
document.getElementById("topology_subnet_opt").style.display="none";
|
|
| 707 |
document.iform.serverbridge_dhcp.disabled = false; |
|
| 708 |
if (document.iform.serverbridge_dhcp.checked) {
|
|
| 709 |
document.iform.serverbridge_interface.disabled = false; |
|
| 710 |
document.iform.serverbridge_dhcp_start.disabled = false; |
|
| 711 |
document.iform.serverbridge_dhcp_end.disabled = false; |
|
| 712 |
} else {
|
|
| 713 |
document.iform.serverbridge_interface.disabled = true; |
|
| 714 |
document.iform.serverbridge_dhcp_start.disabled = true; |
|
| 715 |
document.iform.serverbridge_dhcp_end.disabled = true; |
|
| 716 |
} |
|
| 717 |
} else {
|
|
| 718 |
document.getElementById("topology_subnet_opt").style.display="none";
|
|
| 719 |
document.iform.serverbridge_dhcp.disabled = true; |
|
| 720 |
document.iform.serverbridge_interface.disabled = true; |
|
| 721 |
document.iform.serverbridge_dhcp_start.disabled = true; |
|
| 722 |
document.iform.serverbridge_dhcp_end.disabled = true; |
|
| 723 |
} |
|
| 724 |
break; |
|
| 725 |
} |
|
| 617 |
$aliaslist = get_configured_ip_aliases_list(); |
|
| 618 |
|
|
| 619 |
foreach ($aliaslist as $aliasip => $aliasif) |
|
| 620 |
$serverbridge_interface[$aliasif.'|'.$aliasip] = $aliasip." (".get_vip_descr($aliasip).")";
|
|
| 621 |
|
|
| 622 |
foreach ($serverbridge_interface as $iface => $ifacename) |
|
| 623 |
$list[$iface] = htmlspecialchars($ifacename); |
|
| 624 |
|
|
| 625 |
return($list); |
|
| 726 | 626 |
} |
| 727 |
//]]> |
|
| 728 |
</script> |
|
| 729 |
<?php |
|
| 627 |
|
|
| 730 | 628 |
if (!$savemsg) |
| 731 | 629 |
$savemsg = ""; |
| 732 | 630 |
|
| 733 | 631 |
if ($input_errors) |
| 734 | 632 |
print_input_errors($input_errors); |
| 633 |
|
|
| 735 | 634 |
if ($savemsg) |
| 736 |
print_info_box_np($savemsg); |
|
| 635 |
print_info_box_np($savemsg, 'success'); |
|
| 636 |
|
|
| 637 |
$tab_array = array(); |
|
| 638 |
$tab_array[] = array(gettext("Server"), true, "vpn_openvpn_server.php");
|
|
| 639 |
$tab_array[] = array(gettext("Client"), false, "vpn_openvpn_client.php");
|
|
| 640 |
$tab_array[] = array(gettext("Client Specific Overrides"), false, "vpn_openvpn_csc.php");
|
|
| 641 |
$tab_array[] = array(gettext("Wizards"), false, "wizard.php?xml=openvpn_wizard.xml");
|
|
| 642 |
add_package_tabs("OpenVPN", $tab_array);
|
|
| 643 |
display_top_tabs($tab_array); |
|
| 644 |
|
|
| 645 |
require('classes/Form.class.php');
|
|
| 646 |
|
|
| 647 |
$form = new Form(); |
|
| 648 |
|
|
| 649 |
if($act=="new" || $act=="edit") : |
|
| 650 |
$section = new Form_Section('General Information');
|
|
| 651 |
|
|
| 652 |
$section->addInput(new Form_checkbox( |
|
| 653 |
'disable', |
|
| 654 |
'Disabled', |
|
| 655 |
'Disable this server', |
|
| 656 |
$pconfig['disable'] |
|
| 657 |
))->setHelp('Set this option to disable this server without removing it from the list');
|
|
| 658 |
|
|
| 659 |
$section->addInput(new Form_Select( |
|
| 660 |
'mode', |
|
| 661 |
'Server mode', |
|
| 662 |
$pconfig['mode'], |
|
| 663 |
build_mode_list() |
|
| 664 |
)); |
|
| 665 |
|
|
| 666 |
$section->addInput(new Form_Select( |
|
| 667 |
'dev_mode', |
|
| 668 |
'Device mode', |
|
| 669 |
empty($pconfig['dev_mode']) ? 'tun':$pconfig['dev_mode'], |
|
| 670 |
array_combine($openvpn_dev_mode, $openvpn_dev_mode) |
|
| 671 |
)); |
|
| 672 |
|
|
| 673 |
$section->addInput(new Form_Select( |
|
| 674 |
'interface', |
|
| 675 |
'Interface', |
|
| 676 |
$pconfig['interface'], |
|
| 677 |
build_if_list() |
|
| 678 |
)); |
|
| 679 |
|
|
| 680 |
$section->addInput(new Form_Input( |
|
| 681 |
'local_port', |
|
| 682 |
'Local port', |
|
| 683 |
'number', |
|
| 684 |
$pconfig['local_port'] |
|
| 685 |
)); |
|
| 686 |
|
|
| 687 |
$section->addInput(new Form_Input( |
|
| 688 |
'description', |
|
| 689 |
'Description', |
|
| 690 |
'text', |
|
| 691 |
$pconfig['description'] |
|
| 692 |
))->setHelp('You may enter a description here for your reference (not parsed).');
|
|
| 693 |
|
|
| 694 |
$form->add($section); |
|
| 695 |
|
|
| 696 |
$section = new Form_Section('Cryptographic settings');
|
|
| 697 |
|
|
| 698 |
$section->addInput(new Form_checkbox( |
|
| 699 |
'tlsauth_enable', |
|
| 700 |
'TLS authentication', |
|
| 701 |
'Enable authentication of TLS packets.', |
|
| 702 |
$pconfig['tlsauth_enable'] |
|
| 703 |
)); |
|
| 704 |
|
|
| 705 |
if (!$pconfig['tls']) {
|
|
| 706 |
$section->addInput(new Form_checkbox( |
|
| 707 |
'autotls_enable', |
|
| 708 |
null, |
|
| 709 |
'Automatically generate a shared TLS authentication key.', |
|
| 710 |
$pconfig['autotls_enable'] |
|
| 711 |
)); |
|
| 712 |
} |
|
| 713 |
|
|
| 714 |
$section->addInput(new Form_TextArea( |
|
| 715 |
'tls', |
|
| 716 |
'Key', |
|
| 717 |
$pconfig['tls'] |
|
| 718 |
))->setHelp('Paste your shared key here');
|
|
| 719 |
|
|
| 720 |
$section->addInput(new Form_Select( |
|
| 721 |
'caref', |
|
| 722 |
'Peer Certifiacte Authority', |
|
| 723 |
$pconfig['caref'], |
|
| 724 |
count($a_ca) ? array_combine($a_ca, $a_ca) : ['' => 'None'] |
|
| 725 |
))->setHelp(count($a_ca) ? '':sprintf('No Certificate Authorities defined. You may create one here: %s', '<a href="system_camanager.php">System > Cert Manager</a>'));
|
|
| 726 |
|
|
| 727 |
$section->addInput(new Form_Select( |
|
| 728 |
'crlref', |
|
| 729 |
'Peer Certifiacte Revocation list', |
|
| 730 |
$pconfig['crlref'], |
|
| 731 |
build_crl_list() |
|
| 732 |
))->setHelp(count($a_crl) ? '':sprintf('No Certificate Revocation Lists defined. You may create one here: %s', '<a href="system_camanager.php">System > Cert Manager</a>'));
|
|
| 733 |
|
|
| 734 |
$section->addInput(new Form_Select( |
|
| 735 |
'certref', |
|
| 736 |
'Peer Certifiacte Authority', |
|
| 737 |
$pconfig['certref'], |
|
| 738 |
build_cert_list() |
|
| 739 |
))->setHelp(count($a_cert) ? '':sprintf('No Certificates defined. You may create one here: %s', '<a href="system_camanager.php">System > Cert Manager</a>'));
|
|
| 740 |
|
|
| 741 |
$section->addInput(new Form_Select( |
|
| 742 |
'dh_length', |
|
| 743 |
'DH Parameter length (bits)', |
|
| 744 |
$pconfig['dh_length'], |
|
| 745 |
array_combine($openvpn_dh_lengths,$openvpn_dh_lengths) |
|
| 746 |
))->setHelp(count($a_cert) ? '':sprintf('No Certificates defined. You may create one here: %s', '<a href="system_camanager.php">System > Cert Manager</a>'));
|
|
| 747 |
|
|
| 748 |
if (!$pconfig['shared_key']) {
|
|
| 749 |
$section->addInput(new Form_checkbox( |
|
| 750 |
'autokey_enable', |
|
| 751 |
'Auto generate', |
|
| 752 |
'Automatically generate a shared key', |
|
| 753 |
$pconfig['autokey_enable'] |
|
| 754 |
)); |
|
| 755 |
} |
|
| 756 |
|
|
| 757 |
$section->addInput(new Form_TextArea( |
|
| 758 |
'shared_key', |
|
| 759 |
'Shared Key', |
|
| 760 |
$pconfig['shared_key'] |
|
| 761 |
))->setHelp('Paste your shared key here');
|
|
| 762 |
|
|
| 763 |
$section->addInput(new Form_Select( |
|
| 764 |
'crypto', |
|
| 765 |
'Encryption Algorithm', |
|
| 766 |
$pconfig['crypto'], |
|
| 767 |
openvpn_get_cipherlist() |
|
| 768 |
)); |
|
| 769 |
|
|
| 770 |
$section->addInput(new Form_Select( |
|
| 771 |
'digest', |
|
| 772 |
'Auth digest algorithm', |
|
| 773 |
$pconfig['digest'], |
|
| 774 |
openvpn_get_digestlist() |
|
| 775 |
))->setHelp('Leave this set to SHA1 unless all clients are set to match. SHA1 is the default for OpenVPN. ');
|
|
| 776 |
|
|
| 777 |
$section->addInput(new Form_Select( |
|
| 778 |
'engine', |
|
| 779 |
'Hardware Crypto', |
|
| 780 |
$pconfig['engine'], |
|
| 781 |
openvpn_get_engines() |
|
| 782 |
)); |
|
| 783 |
|
|
| 784 |
$section->addInput(new Form_Select( |
|
| 785 |
'cert_depth', |
|
| 786 |
'Certificate Depth', |
|
| 787 |
$pconfig['cert_depth'], |
|
| 788 |
$openvpn_cert_depths |
|
| 789 |
))->setHelp('When a certificate-based client logs in, do not accept certificates below this depth. ' .
|
|
| 790 |
'Useful for denying certificates made with intermediate CAs generated from the same CA as the server.'); |
|
| 791 |
|
|
| 792 |
$section->addInput(new Form_checkbox( |
|
| 793 |
'strictusercn', |
|
| 794 |
'Strict User-CN Matching', |
|
| 795 |
null, |
|
| 796 |
$pconfig['strictusercn'] |
|
| 797 |
))->setHelp('When authenticating users, enforce a match between the common name of the client certificate and the username given at login.');
|
|
| 798 |
|
|
| 799 |
$form->add($section); |
|
| 800 |
|
|
| 801 |
$section = new Form_Section('Tunnel settings');
|
|
| 802 |
|
|
| 803 |
$section->addInput(new Form_Input( |
|
| 804 |
'tunnel_network', |
|
| 805 |
'IPv4 Tunnel Network', |
|
| 806 |
'text', |
|
| 807 |
$pconfig['tunnel_network'] |
|
| 808 |
))->setHelp('This is the IPv4 virtual network used for private communications between this server and client ' .
|
|
| 809 |
'hosts expressed using CIDR (eg. 10.0.8.0/24). The first network address will be assigned to ' . |
|
| 810 |
'the server virtual interface. The remaining network addresses can optionally be assigned ' . |
|
| 811 |
'to connecting clients. (see Address Pool)'); |
|
| 812 |
|
|
| 813 |
$section->addInput(new Form_Input( |
|
| 814 |
'tunnel_networkv6', |
|
| 815 |
'IPv6 Tunnel Network', |
|
| 816 |
'text', |
|
| 817 |
$pconfig['tunnel_networkv6'] |
|
| 818 |
))->setHelp('This is the IPv6 virtual network used for private ' .
|
|
| 819 |
'communications between this server and client hosts expressed using CIDR (eg. fe80::/64). ' . |
|
| 820 |
'The first network address will be assigned to the server virtual interface. The remaining ' . |
|
| 821 |
'network addresses can optionally be assigned to connecting clients. (see Address Pool)'); |
|
| 822 |
|
|
| 823 |
$section->addInput(new Form_checkbox( |
|
| 824 |
'serverbridge_dhcp', |
|
| 825 |
'Bridge DHCP', |
|
| 826 |
'Allow clients on the bridge to obtain DHCP.', |
|
| 827 |
$pconfig['serverbridge_dhcp'] |
|
| 828 |
)); |
|
| 829 |
|
|
| 830 |
$section->addInput(new Form_Select( |
|
| 831 |
'serberbridge_inerface', |
|
| 832 |
'Bridge Interface', |
|
| 833 |
$pconfig['serberbridge_inerface'], |
|
| 834 |
build_bridge_list() |
|
| 835 |
))->setHelp('The interface to which this tap instance will be bridged. This is not done automatically. You must assign this ' .
|
|
| 836 |
'interface and create the bridge separately. This setting controls which existing IP address and subnet ' . |
|
| 837 |
'mask are used by OpenVPN for the bridge. Setting this to "none" will cause the Server Bridge DHCP settings below to be ignored.'); |
|
| 838 |
|
|
| 839 |
$section->addInput(new Form_Input( |
|
| 840 |
'serverbridge_dhcp_start', |
|
| 841 |
'Server Bridge DHCP Start', |
|
| 842 |
'text', |
|
| 843 |
$pconfig['serverbridge_dhcp_start'] |
|
| 844 |
))->setHelp('When using tap mode as a multi-point server, you may optionally supply a DHCP range to use on the ' .
|
|
| 845 |
'interface to which this tap instance is bridged. If these settings are left blank, DHCP will be passed ' . |
|
| 846 |
'through to the LAN, and the interface setting above will be ignored.'); |
|
| 847 |
|
|
| 848 |
$section->addInput(new Form_Input( |
|
| 849 |
'serverbridge_dhcp_end', |
|
| 850 |
'Server Bridge DHCP End', |
|
| 851 |
'text', |
|
| 852 |
$pconfig['serverbridge_dhcp_end'] |
|
| 853 |
)); |
|
| 854 |
|
|
| 855 |
$section->addInput(new Form_checkbox( |
|
| 856 |
'gwredir', |
|
| 857 |
'Redirect Gateway', |
|
| 858 |
'Force all client generated traffic through the tunnel.', |
|
| 859 |
$pconfig['gwredit'] |
|
| 860 |
)); |
|
| 861 |
|
|
| 862 |
$section->addInput(new Form_Input( |
|
| 863 |
'local_network', |
|
| 864 |
'IPv4 Local network(s)', |
|
| 865 |
'text', |
|
| 866 |
$pconfig['local_network'] |
|
| 867 |
))->setHelp('IPv4 networks that will be accessible from the remote endpoint. ' .
|
|
| 868 |
'Expressed as a comma-separated list of one or more CIDR ranges. ' . |
|
| 869 |
'You may leave this blank if you don\'t want to add a route to the local network through this tunnel on the remote machine. ' . |
|
| 870 |
'This is generally set to your LAN network.'); |
|
| 871 |
|
|
| 872 |
$section->addInput(new Form_Input( |
|
| 873 |
'local_networkv6', |
|
| 874 |
'IPv6 Local network(s)', |
|
| 875 |
'text', |
|
| 876 |
$pconfig['local_networkv6'] |
|
| 877 |
))->setHelp('IPv6 networks that will be accessible from the remote endpoint. ' .
|
|
| 878 |
'Expressed as a comma-separated list of one or more IP/PREFIX. You may leave this blank if you don\'t want to add a ' . |
|
| 879 |
'route to the local network through this tunnel on the remote machine. This is generally set to your LAN network.'); |
|
| 880 |
|
|
| 881 |
$section->addInput(new Form_Input( |
|
| 882 |
'remote_network', |
|
| 883 |
'IPv4 Remote network(s)', |
|
| 884 |
'text', |
|
| 885 |
$pconfig['remote_network'] |
|
| 886 |
))->setHelp('IPv4 networks that will be routed through the tunnel, so that a site-to-site VPN can be established without manually ' .
|
|
| 887 |
'changing the routing tables. Expressed as a comma-separated list of one or more CIDR ranges. ' . |
|
| 888 |
'If this is a site-to-site VPN, enter the remote LAN/s here. You may leave this blank if you don\'t want a site-to-site VPN.'); |
|
| 889 |
|
|
| 890 |
$section->addInput(new Form_Input( |
|
| 891 |
'remote_networkv6', |
|
| 892 |
'IPv6 Remote network(s)', |
|
| 893 |
'text', |
|
| 894 |
$pconfig['remote_networkv6'] |
|
| 895 |
))->setHelp('These are the IPv6 networks that will be routed through the tunnel, so that a site-to-site VPN can be established without manually ' .
|
|
| 896 |
'changing the routing tables. Expressed as a comma-separated list of one or more IP/PREFIX. ' . |
|
| 897 |
'If this is a site-to-site VPN, enter the remote LAN/s here. You may leave this blank if you don\'t want a site-to-site VPN.'); |
|
| 898 |
|
|
| 899 |
$section->addInput(new Form_Input( |
|
| 900 |
'maxclients', |
|
| 901 |
'Concurrent connections', |
|
| 902 |
'number', |
|
| 903 |
$pconfig['maxclients'] |
|
| 904 |
))->setHelp('Specify the maximum number of clients allowed to concurrently connect to this server.');
|
|
| 905 |
|
|
| 906 |
$section->addInput(new Form_Select( |
|
| 907 |
'compression', |
|
| 908 |
'Compression', |
|
| 909 |
$pconfig['compression'], |
|
| 910 |
$openvpn_compression_modes |
|
| 911 |
))->setHelp('Compress tunnel packets using the LZO algorithm. ' .
|
|
| 912 |
'Adaptive compression will dynamically disable compression for a period of time if OpenVPN detects that the data in the ' . |
|
| 913 |
'packets is not being compressed efficiently"'); |
|
| 914 |
|
|
| 915 |
$section->addInput(new Form_checkbox( |
|
| 916 |
'passtos', |
|
| 917 |
'Type-of-Service', |
|
| 918 |
'Set the TOS IP header value of tunnel packets to match the encapsulated packet value.', |
|
| 919 |
$pconfig['passtos'] |
|
| 920 |
)); |
|
| 921 |
|
|
| 922 |
$section->addInput(new Form_checkbox( |
|
| 923 |
'client2client', |
|
| 924 |
'Inter-client communication', |
|
| 925 |
'Allow communication between clients connected to this server', |
|
| 926 |
$pconfig['client2client'] |
|
| 927 |
)); |
|
| 928 |
|
|
| 929 |
$section->addInput(new Form_checkbox( |
|
| 930 |
'duplicate_cn', |
|
| 931 |
'Duplicate Connection', |
|
| 932 |
'Allow multiple concurrent connections from clients using the same Common Name.', |
|
| 933 |
$pconfig['duplicate_cn'] |
|
| 934 |
))->setHelp('(This is not generally recommended, but may be needed for some scenarios.)');
|
|
| 935 |
|
|
| 936 |
$section->addInput(new Form_checkbox( |
|
| 937 |
'no_tun_ipv6', |
|
| 938 |
'Disable IPv6', |
|
| 939 |
'Don\'t forward IPv6 traffic. ', |
|
| 940 |
$pconfig['no_tun_ipv6'] |
|
| 941 |
)); |
|
| 942 |
|
|
| 943 |
$form->add($section); |
|
| 944 |
|
|
| 945 |
$section = new Form_Section('Client Settings');
|
|
| 946 |
|
|
| 947 |
$section->addInput(new Form_checkbox( |
|
| 948 |
'dynamic_ip', |
|
| 949 |
'Dynamic IP', |
|
| 950 |
'Allow connected clients to retain their connections if their IP address changes', |
|
| 951 |
$pconfig['dynamic_ip'] |
|
| 952 |
)); |
|
| 953 |
|
|
| 954 |
$section->addInput(new Form_checkbox( |
|
| 955 |
'pool_enable', |
|
| 956 |
'Address Pool', |
|
| 957 |
'Provide a virtual adapter IP address to clients (see Tunnel Network)', |
|
| 958 |
$pconfig['pool_enable'] |
|
| 959 |
)); |
|
| 960 |
|
|
| 961 |
$section->addInput(new Form_checkbox( |
|
| 962 |
'topology_subnet', |
|
| 963 |
'Topology', |
|
| 964 |
'Allocate only one IP per client (topology subnet), rather than an isolated subnet per client (topology net30).', |
|
| 965 |
$pconfig['topology_subnet'] |
|
| 966 |
))->setHelp('Relevant when supplying a virtual adapter IP address to clients when using tun mode on IPv4.").' . '<br />' .
|
|
| 967 |
'Some clients may require this even for IPv6, such as OpenVPN Connect (iOS/Android). ' . |
|
| 968 |
'Others may break if it is present, such as older versions of OpenVPN or clients such as Yealink phones.'); |
|
| 969 |
|
|
| 970 |
$section->addInput(new Form_checkbox( |
|
| 971 |
'dns_domain_enable', |
|
| 972 |
'DNS Default Domain', |
|
| 973 |
'Provide a default domain name to clients', |
|
| 974 |
$pconfig['dns_domain_enable'] |
|
| 975 |
)); |
|
| 976 |
|
|
| 977 |
$section->addInput(new Form_Input( |
|
| 978 |
'dns_domain', |
|
| 979 |
'DNS Default Domain', |
|
| 980 |
'text', |
|
| 981 |
$pconfig['dns_domain'] |
|
| 982 |
)); |
|
| 983 |
|
|
| 984 |
$section->addInput(new Form_checkbox( |
|
| 985 |
'dns_server_enable', |
|
| 986 |
'DNS Server enable', |
|
| 987 |
'Provide a DNS server list to clients', |
|
| 988 |
$pconfig['dns_server_enable'] |
|
| 989 |
)); |
|
| 990 |
|
|
| 991 |
$section->addInput(new Form_Input( |
|
| 992 |
'dns_server1', |
|
| 993 |
'DNS Server 1', |
|
| 994 |
'text', |
|
| 995 |
$pconfig['dns_server1'] |
|
| 996 |
)); |
|
| 997 |
|
|
| 998 |
$section->addInput(new Form_Input( |
|
| 999 |
'dns_server2', |
|
| 1000 |
'DNS Server 2', |
|
| 1001 |
'text', |
|
| 1002 |
$pconfig['dns_server2'] |
|
| 1003 |
)); |
|
| 1004 |
|
|
| 1005 |
$section->addInput(new Form_Input( |
|
| 1006 |
'dns_server3', |
|
| 1007 |
'DNS Server 3', |
|
| 1008 |
'text', |
|
| 1009 |
$pconfig['dns_server3'] |
|
| 1010 |
)); |
|
| 1011 |
|
|
| 1012 |
$section->addInput(new Form_Input( |
|
| 1013 |
'dns_server4', |
|
| 1014 |
'DNS Server 4', |
|
| 1015 |
'text', |
|
| 1016 |
$pconfig['dns_server4'] |
|
| 1017 |
)); |
|
| 1018 |
|
|
| 1019 |
$section->addInput(new Form_checkbox( |
|
| 1020 |
'push_register_dns', |
|
| 1021 |
'Force DNS cache update', |
|
| 1022 |
'Run "net stop dnscache", "net start dnscache", "ipconfig /flushdns" and "ipconfig /registerdns" on connection initiation.', |
|
| 1023 |
$pconfig['push_register_dns'] |
|
| 1024 |
))->setHelp('This is known to kick Windows into recognizing pushed DNS servers.');
|
|
| 1025 |
|
|
| 1026 |
$section->addInput(new Form_checkbox( |
|
| 1027 |
'ntp_server_enable', |
|
| 1028 |
'NTP Server enable', |
|
| 1029 |
'Provide an NTP server list to clients', |
|
| 1030 |
$pconfig['ntp_server_enable'] |
|
| 1031 |
)); |
|
| 1032 |
|
|
| 1033 |
$section->addInput(new Form_Input( |
|
| 1034 |
'ntp_server1', |
|
| 1035 |
'NTP Server 1', |
|
| 1036 |
'text', |
|
| 1037 |
$pconfig['ntp_server1'] |
|
| 1038 |
)); |
|
| 1039 |
|
|
| 1040 |
$section->addInput(new Form_Input( |
|
| 1041 |
'ntp_server2', |
|
| 1042 |
'NTP Server 2', |
|
| 1043 |
'text', |
|
| 1044 |
$pconfig['ntp_server2'] |
|
| 1045 |
)); |
|
| 1046 |
|
|
| 1047 |
$form->add($section); |
|
| 1048 |
|
|
| 1049 |
$section = new Form_Section('Netbios Options');
|
|
| 1050 |
|
|
| 1051 |
$section->addInput(new Form_checkbox( |
|
| 1052 |
'netbios_enable', |
|
| 1053 |
'Netbios enable', |
|
| 1054 |
'Enable NetBIOS over TCP/IP', |
|
| 1055 |
$pconfig['ntp_server_enable'] |
|
| 1056 |
))->setHelp('If this option is not set, all NetBIOS-over-TCP/IP options (including WINS) will be disabled');
|
|
| 1057 |
|
|
| 1058 |
$section->addInput(new Form_Select( |
|
| 1059 |
'netbios_ntype', |
|
| 1060 |
'Node Type', |
|
| 1061 |
$pconfig['nbios_ntype'], |
|
| 1062 |
$netbios_nodetypes |
|
| 1063 |
))->setHelp('Possible options: b-node (broadcasts), p-node (point-to-point name queries to a WINS server), ' .
|
|
| 1064 |
'm-node (broadcast then query name server), and h-node (query name server, then broadcast)'); |
|
| 1065 |
|
|
| 1066 |
$section->addInput(new Form_Input( |
|
| 1067 |
'netbios_scope', |
|
| 1068 |
'Scope ID', |
|
| 1069 |
'text', |
|
| 1070 |
$pconfig['netbios_scope'] |
|
| 1071 |
))->setHelp('A NetBIOS Scope ID provides an extended naming service for NetBIOS over TCP/IP. The NetBIOS ' .
|
|
| 1072 |
'scope ID isolates NetBIOS traffic on a single network to only those nodes with the same ' . |
|
| 1073 |
'NetBIOS scope ID'); |
|
| 1074 |
|
|
| 1075 |
$section->addInput(new Form_checkbox( |
|
| 1076 |
'wins_server_enable', |
|
| 1077 |
'WINS server enable', |
|
| 1078 |
'Provide a WINS server list to clients', |
|
| 1079 |
$pconfig['wins_server_enable'] |
|
| 1080 |
)); |
|
| 1081 |
|
|
| 1082 |
$section->addInput(new Form_Input( |
|
| 1083 |
'wins_server1', |
|
| 1084 |
'WINS Server 1', |
|
| 1085 |
'text', |
|
| 1086 |
$pconfig['wins_server1'] |
|
| 1087 |
)); |
|
| 1088 |
|
|
| 1089 |
$section->addInput(new Form_Input( |
|
| 1090 |
'wins_server2', |
|
| 1091 |
'WINS Server 2', |
|
| 1092 |
'text', |
|
| 1093 |
$pconfig['wins_server2'] |
|
| 1094 |
)); |
|
| 1095 |
|
|
| 1096 |
$section->addInput(new Form_checkbox( |
|
| 1097 |
'client_mgmt_port_enable', |
|
| 1098 |
'Enable custom port ', |
|
| 1099 |
'Use a different management port for clients.', |
|
| 1100 |
$pconfig['client_mgmt_port_enable'] |
|
| 1101 |
)); |
|
| 1102 |
|
|
| 1103 |
$section->addInput(new Form_Input( |
|
| 1104 |
'client_mgmt_port', |
|
| 1105 |
'Management port', |
|
| 1106 |
'number', |
|
| 1107 |
$pconfig['client_mgmt_port'] |
|
| 1108 |
))->setHelp('The default port is 166. Specify a different port if the client machines need to select from multiple OpenVPN links.');
|
|
| 1109 |
|
|
| 1110 |
|
|
| 1111 |
$form->add($section); |
|
| 1112 |
|
|
| 1113 |
$section = new Form_Section('Advanced Configuration');
|
|
| 1114 |
$section->addClass('advanced');
|
|
| 1115 |
|
|
| 1116 |
$section->addInput(new Form_TextArea( |
|
| 1117 |
'custom_options', |
|
| 1118 |
'Custom options', |
|
| 1119 |
$pconfig['custom_options'] |
|
| 1120 |
))->setHelp('Enter any additional options you would like to add to the OpenVPN server configuration here, separated by semicolon' . '<br />' .
|
|
| 1121 |
'EXAMPLE: push "route 10.0.0.0 255.255.255.0"'); |
|
| 1122 |
|
|
| 1123 |
$section->addInput(new Form_Select( |
|
| 1124 |
'verbosity_level', |
|
| 1125 |
'Verbosity level', |
|
| 1126 |
$pconfig['verbosity_level'], |
|
| 1127 |
$openvpn_verbosity_level |
|
| 1128 |
))->setHelp('Each level shows all info from the previous levels. Level 3 is recommended if you want a good summary of what\'s happening without being swamped by output' . '<br /><br />' .
|
|
| 1129 |
'None: Only fatal errors' . '<br />' . |
|
| 1130 |
'Default: Normal usage range' . '<br />' . |
|
| 1131 |
'5: Output R and W characters to the console for each packet read and write, uppercase is used for TCP/UDP packets and lowercase is used for TUN/TAP packets' .'<br />' . |
|
| 1132 |
'6: Debug info range'); |
|
| 1133 |
|
|
| 1134 |
$section->addInput(new Form_Input( |
|
| 1135 |
'act', |
|
| 1136 |
null, |
|
| 1137 |
'hidden', |
|
| 1138 |
$act |
|
| 1139 |
)); |
|
| 1140 |
|
|
| 1141 |
if (isset($id) && $a_server[$id]) {
|
|
| 1142 |
$section->addInput(new Form_Input( |
|
| 1143 |
'id', |
|
| 1144 |
null, |
|
| 1145 |
'hidden', |
|
| 1146 |
$id |
|
| 1147 |
)); |
|
| 1148 |
} |
|
| 1149 |
|
|
| 1150 |
$form->add($section); |
|
| 1151 |
print($form); |
|
| 1152 |
|
|
| 1153 |
else: |
|
| 737 | 1154 |
?> |
| 738 |
<table width="100%" border="0" cellpadding="0" cellspacing="0" summary="vpn openvpn server"> |
|
| 739 |
<tr> |
|
| 740 |
<td class="tabnavtbl"> |
|
| 741 |
<?php |
|
| 742 |
$tab_array = array(); |
|
| 743 |
$tab_array[] = array(gettext("Server"), true, "vpn_openvpn_server.php");
|
|
| 744 |
$tab_array[] = array(gettext("Client"), false, "vpn_openvpn_client.php");
|
|
| 745 |
$tab_array[] = array(gettext("Client Specific Overrides"), false, "vpn_openvpn_csc.php");
|
|
| 746 |
$tab_array[] = array(gettext("Wizards"), false, "wizard.php?xml=openvpn_wizard.xml");
|
|
| 747 |
add_package_tabs("OpenVPN", $tab_array);
|
|
| 748 |
display_top_tabs($tab_array); |
|
| 749 |
?> |
|
| 750 |
</td> |
|
| 751 |
</tr> |
|
| 752 |
<tr> |
|
| 753 |
<td class="tabcont"> |
|
| 754 |
|
|
| 755 |
<?php if($act=="new" || $act=="edit"): ?> |
|
| 756 |
|
|
| 757 |
<form action="vpn_openvpn_server.php" method="post" name="iform" id="iform" onsubmit="presubmit()"> |
|
| 758 |
<table width="100%" border="0" cellpadding="6" cellspacing="0" summary="general information"> |
|
| 759 |
<tr> |
|
| 760 |
<td colspan="2" valign="top" class="listtopic"><?=gettext("General information"); ?></td>
|
|
| 761 |
</tr> |
|
| 762 |
<tr> |
|
| 763 |
<td width="22%" valign="top" class="vncellreq"><?=gettext("Disabled"); ?></td>
|
|
| 764 |
<td width="78%" class="vtable"> |
|
| 765 |
<table border="0" cellpadding="0" cellspacing="0" summary="enable disable server"> |
|
| 766 |
<tr> |
|
| 767 |
<td> |
|
| 768 |
<?php set_checked($pconfig['disable'],$chk); ?> |
|
| 769 |
<input name="disable" type="checkbox" value="yes" <?=$chk;?> /> |
|
| 770 |
</td> |
|
| 771 |
<td> |
|
| 772 |
|
|
| 773 |
<span class="vexpl"> |
|
| 774 |
<strong><?=gettext("Disable this server"); ?></strong><br />
|
|
| 775 |
</span> |
|
| 776 |
</td> |
|
| 777 |
</tr> |
|
| 778 |
</table> |
|
| 779 |
<?=gettext("Set this option to disable this server without removing it from the list"); ?>.
|
|
| 780 |
</td> |
|
| 781 |
</tr> |
|
| 782 |
<tr> |
|
| 783 |
<td width="22%" valign="top" class="vncellreq"><?=gettext("Server Mode");?></td>
|
|
| 784 |
<td width="78%" class="vtable"> |
|
| 785 |
<select name='mode' id='mode' class="formselect" onchange='mode_change(); tuntap_change()'> |
|
| 786 |
<?php |
|
| 787 |
foreach ($openvpn_server_modes as $name => $desc): |
|
| 788 |
$selected = ""; |
|
| 789 |
if ($pconfig['mode'] == $name) |
|
| 790 |
$selected = "selected=\"selected\""; |
|
| 791 |
?> |
|
| 792 |
<option value="<?=$name;?>" <?=$selected;?>><?=$desc;?></option> |
|
| 793 |
<?php endforeach; ?> |
|
| 794 |
</select> |
|
| 795 |
</td> |
|
| 796 |
</tr> |
|
| 797 |
<tr id="authmodetr" style="display:none"> |
|
| 798 |
<td width="22%" valign="top" class="vncellreq"><?=gettext("Backend for authentication");?></td>
|
|
| 799 |
<td width="78%" class="vtable"> |
|
| 800 |
<select name='authmode[]' id='authmode' class="formselect" multiple="multiple" size="<?php echo count($auth_servers); ?>"> |
|
| 801 |
<?php |
|
| 802 |
$authmodes = explode(",", $pconfig['authmode']);
|
|
| 803 |
$auth_servers = auth_get_authserver_list(); |
|
| 804 |
// If no authmodes set then default to selecting the first entry in auth_servers |
|
| 805 |
if (empty($authmodes[0]) && !empty(key($auth_servers))) |
|
| 806 |
$authmodes[0] = key($auth_servers); |
|
| 807 |
|
|
| 808 |
foreach ($auth_servers as $auth_server_key => $auth_server): |
|
| 809 |
$selected = ""; |
|
| 810 |
if (in_array($auth_server_key, $authmodes)) |
|
| 811 |
$selected = "selected=\"selected\""; |
|
| 812 |
?> |
|
| 813 |
<option value="<?=$auth_server_key;?>" <?=$selected;?>><?=$auth_server['name'];?></option> |
|
| 814 |
<?php endforeach; ?> |
|
| 815 |
</select> |
|
| 816 |
</td> |
|
| 817 |
</tr> |
|
| 818 |
<tr> |
|
| 819 |
<td width="22%" valign="top" class="vncellreq"><?=gettext("Protocol");?></td>
|
|
| 820 |
<td width="78%" class="vtable"> |
|
| 821 |
<select name='protocol' class="formselect"> |
|
| 822 |
<?php |
|
| 823 |
foreach ($openvpn_prots as $prot): |
|
| 824 |
$selected = ""; |
|
| 825 |
if ($pconfig['protocol'] == $prot) |
|
| 826 |
$selected = "selected=\"selected\""; |
|
| 827 |
?> |
|
| 828 |
<option value="<?=$prot;?>" <?=$selected;?>><?=$prot;?></option> |
|
| 829 |
<?php endforeach; ?> |
|
| 830 |
</select> |
|
| 831 |
</td> |
|
| 832 |
</tr> |
|
| 833 |
<tr> |
|
| 834 |
<td width="22%" valign="top" class="vncellreq"><?=gettext("Device Mode"); ?></td>
|
|
| 835 |
<td width="78%" class="vtable"> |
|
| 836 |
<select name="dev_mode" class="formselect" onchange='tuntap_change()'> |
|
| 837 |
<?php |
|
| 838 |
foreach ($openvpn_dev_mode as $device): |
|
| 839 |
$selected = ""; |
|
| 840 |
if (! empty($pconfig['dev_mode'])) {
|
|
| 841 |
if ($pconfig['dev_mode'] == $device) |
|
| 842 |
$selected = "selected=\"selected\""; |
|
| 843 |
} else {
|
|
| 844 |
if ($device == "tun") |
|
| 845 |
$selected = "selected=\"selected\""; |
|
| 846 |
} |
|
| 847 |
?> |
|
| 848 |
<option value="<?=$device;?>" <?=$selected;?>><?=$device;?></option> |
|
| 849 |
<?php endforeach; ?> |
|
| 850 |
</select> |
|
| 851 |
</td> |
|
| 852 |
</tr> |
|
| 853 |
<tr> |
|
| 854 |
<td width="22%" valign="top" class="vncellreq"><?=gettext("Interface"); ?></td>
|
|
| 855 |
<td width="78%" class="vtable"> |
|
| 856 |
<select name="interface" class="formselect"> |
|
| 857 |
<?php |
|
| 858 |
$interfaces = get_configured_interface_with_descr(); |
|
| 859 |
$carplist = get_configured_carp_interface_list(); |
|
| 860 |
foreach ($carplist as $cif => $carpip) |
|
| 861 |
$interfaces[$cif.'|'.$carpip] = $carpip." (".get_vip_descr($carpip).")";
|
|
| 862 |
$aliaslist = get_configured_ip_aliases_list(); |
|
| 863 |
foreach ($aliaslist as $aliasip => $aliasif) |
|
| 864 |
$interfaces[$aliasif.'|'.$aliasip] = $aliasip." (".get_vip_descr($aliasip).")";
|
|
| 865 |
$grouplist = return_gateway_groups_array(); |
|
| 866 |
foreach ($grouplist as $name => $group) {
|
|
| 867 |
if($group['ipprotocol'] != inet) |
|
| 868 |
continue; |
|
| 869 |
if($group[0]['vip'] <> "") |
|
| 870 |
$vipif = $group[0]['vip']; |
|
| 871 |
else |
|
| 872 |
$vipif = $group[0]['int']; |
|
| 873 |
$interfaces[$name] = "GW Group {$name}";
|
|
| 874 |
} |
|
| 875 |
$interfaces['lo0'] = "Localhost"; |
|
| 876 |
$interfaces['any'] = "any"; |
|
| 877 |
foreach ($interfaces as $iface => $ifacename): |
|
| 878 |
$selected = ""; |
|
| 879 |
if ($iface == $pconfig['interface']) |
|
| 880 |
$selected = "selected=\"selected\""; |
|
| 881 |
?> |
|
| 882 |
<option value="<?=$iface;?>" <?=$selected;?>> |
|
| 883 |
<?=htmlspecialchars($ifacename);?> |
|
| 884 |
</option> |
|
| 885 |
<?php endforeach; ?> |
|
| 886 |
</select> <br /> |
|
| 887 |
</td> |
|
| 888 |
</tr> |
|
| 889 |
<tr> |
|
| 890 |
<td width="22%" valign="top" class="vncellreq"><?=gettext("Local port");?></td>
|
|
| 891 |
<td width="78%" class="vtable"> |
|
| 892 |
<input name="local_port" type="text" class="formfld unknown" size="5" value="<?=htmlspecialchars($pconfig['local_port']);?>" /> |
|
| 893 |
</td> |
|
| 894 |
</tr> |
|
| 895 |
<tr> |
|
| 896 |
<td width="22%" valign="top" class="vncell"><?=gettext("Description"); ?></td>
|
|
| 897 |
<td width="78%" class="vtable"> |
|
| 898 |
<input name="description" type="text" class="formfld unknown" size="30" value="<?=htmlspecialchars($pconfig['description']);?>" /> |
|
| 899 |
<br /> |
|
| 900 |
<?=gettext("You may enter a description here for your reference (not parsed)"); ?>.
|
|
| 901 |
</td> |
|
| 902 |
</tr> |
|
| 903 |
<tr> |
|
| 904 |
<td colspan="2" class="list" height="12"></td> |
|
| 905 |
</tr> |
|
| 906 |
<tr> |
|
| 907 |
<td colspan="2" valign="top" class="listtopic"><?=gettext("Cryptographic Settings"); ?></td>
|
|
| 908 |
</tr> |
|
| 909 |
<tr id="tls"> |
|
| 910 |
<td width="22%" valign="top" class="vncellreq"><?=gettext("TLS Authentication"); ?></td>
|
|
| 911 |
<td width="78%" class="vtable"> |
|
| 912 |
<table border="0" cellpadding="2" cellspacing="0" summary="tls authentication"> |
|
| 913 |
<tr> |
|
| 914 |
<td> |
|
| 915 |
<?php set_checked($pconfig['tlsauth_enable'],$chk); ?> |
|
| 916 |
<input name="tlsauth_enable" id="tlsauth_enable" type="checkbox" value="yes" <?=$chk;?> onclick="tlsauth_change()" /> |
|
| 917 |
</td> |
|
| 918 |
<td> |
|
| 919 |
<span class="vexpl"> |
|
| 920 |
<?=gettext("Enable authentication of TLS packets"); ?>.
|
|
| 921 |
</span> |
|
| 922 |
</td> |
|
| 923 |
</tr> |
|
| 924 |
</table> |
|
| 925 |
<?php if (!$pconfig['tls']): ?> |
|
| 926 |
<table border="0" cellpadding="2" cellspacing="0" id="tlsauth_opts" summary="tls authentication options"> |
|
| 927 |
<tr> |
|
| 928 |
<td> |
|
| 929 |
<?php set_checked($pconfig['autotls_enable'],$chk); ?> |
|
| 930 |
<input name="autotls_enable" id="autotls_enable" type="checkbox" value="yes" <?=$chk;?> onclick="autotls_change()" /> |
|
| 931 |
</td> |
|
| 932 |
<td> |
|
| 933 |
<span class="vexpl"> |
|
| 934 |
<?=gettext("Automatically generate a shared TLS authentication key"); ?>.
|
|
| 935 |
</span> |
|
| 936 |
</td> |
|
| 937 |
</tr> |
|
| 938 |
</table> |
|
| 939 |
<?php endif; ?> |
|
| 940 |
<table border="0" cellpadding="2" cellspacing="0" id="autotls_opts" summary="tls authentication key"> |
|
| 941 |
<tr> |
|
| 942 |
<td> |
|
| 943 |
<textarea name="tls" cols="65" rows="7" class="formpre"><?=htmlspecialchars($pconfig['tls']);?></textarea> |
|
| 944 |
<br /> |
|
| 945 |
<?=gettext("Paste your shared key here"); ?>.
|
|
| 946 |
</td> |
|
| 947 |
</tr> |
|
| 948 |
</table> |
|
| 949 |
</td> |
|
| 950 |
</tr> |
|
| 951 |
<tr id="tls_ca"> |
|
| 952 |
<td width="22%" valign="top" class="vncellreq"><?=gettext("Peer Certificate Authority"); ?></td>
|
|
| 953 |
<td width="78%" class="vtable"> |
|
| 954 |
<?php if (count($a_ca)): ?> |
|
| 955 |
<select name='caref' class="formselect"> |
|
| 956 |
<?php |
|
| 957 |
foreach ($a_ca as $ca): |
|
| 958 |
$selected = ""; |
|
| 959 |
if ($pconfig['caref'] == $ca['refid']) |
|
| 960 |
$selected = "selected=\"selected\""; |
|
| 961 |
?> |
|
| 962 |
<option value="<?=$ca['refid'];?>" <?=$selected;?>><?=$ca['descr'];?></option> |
|
| 963 |
<?php endforeach; ?> |
|
| 964 |
</select> |
|
| 965 |
<?php else: ?> |
|
| 966 |
<b>No Certificate Authorities defined.</b> <br />Create one under <a href="system_camanager.php">System > Cert Manager</a>. |
|
| 967 |
<?php endif; ?> |
|
| 968 |
</td> |
|
| 969 |
</tr> |
|
| 970 |
<tr id="tls_crl"> |
|
| 971 |
<td width="22%" valign="top" class="vncellreq"><?=gettext("Peer Certificate Revocation List"); ?></td>
|
|
| 972 |
<td width="78%" class="vtable"> |
|
| 973 |
<?php if (count($a_crl)): ?> |
|
| 974 |
<select name='crlref' class="formselect"> |
|
| 975 |
<option value="">None</option> |
|
| 976 |
<?php |
|
| 977 |
foreach ($a_crl as $crl): |
|
| 978 |
$selected = ""; |
|
| 979 |
$caname = ""; |
|
| 980 |
$ca = lookup_ca($crl['caref']); |
|
| 981 |
if ($ca) {
|
|
| 982 |
$caname = " (CA: {$ca['descr']})";
|
|
| 983 |
if ($pconfig['crlref'] == $crl['refid']) |
|
| 984 |
$selected = "selected=\"selected\""; |
|
| 985 |
} |
|
| 986 |
?> |
|
| 987 |
<option value="<?=$crl['refid'];?>" <?=$selected;?>><?=$crl['descr'] . $caname;?></option> |
|
| 988 |
<?php endforeach; ?> |
|
| 989 |
</select> |
|
| 990 |
<?php else: ?> |
|
| 991 |
<b>No Certificate Revocation Lists (CRLs) defined.</b> <br />Create one under <a href="system_crlmanager.php">System > Cert Manager</a>. |
|
| 992 |
<?php endif; ?> |
|
| 993 |
</td> |
|
| 994 |
</tr> |
|
| 995 |
<tr id="tls_cert"> |
|
| 996 |
<td width="22%" valign="top" class="vncellreq"><?=gettext("Server Certificate"); ?></td>
|
|
| 997 |
<td width="78%" class="vtable"> |
|
| 998 |
<?php if (count($a_cert)): ?> |
|
| 999 |
<select name='certref' class="formselect"> |
|
| 1000 |
<?php |
|
| 1001 |
foreach ($a_cert as $cert): |
|
| 1002 |
$selected = ""; |
|
| 1003 |
$caname = ""; |
|
| 1004 |
$inuse = ""; |
|
| 1005 |
$revoked = ""; |
|
| 1006 |
$ca = lookup_ca($cert['caref']); |
|
| 1007 |
if ($ca) |
|
| 1008 |
$caname = " (CA: {$ca['descr']})";
|
|
| 1009 |
if ($pconfig['certref'] == $cert['refid']) |
|
| 1010 |
$selected = "selected=\"selected\""; |
|
| 1011 |
if (cert_in_use($cert['refid'])) |
|
| 1012 |
$inuse = " *In Use"; |
|
| 1013 |
if (is_cert_revoked($cert)) |
|
| 1014 |
$revoked = " *Revoked"; |
|
| 1015 |
?> |
|
| 1016 |
<option value="<?=$cert['refid'];?>" <?=$selected;?>><?=$cert['descr'] . $caname . $inuse . $revoked;?></option> |
|
| 1017 |
<?php endforeach; ?> |
|
| 1018 |
</select> |
|
| 1019 |
<?php else: ?> |
|
| 1020 |
<b>No Certificates defined.</b> <br />Create one under <a href="system_certmanager.php">System > Cert Manager</a>. |
|
| 1021 |
<?php endif; ?> |
|
| 1022 |
</td> |
|
| 1023 |
</tr> |
|
| 1024 |
<tr id="tls_dh"> |
|
| 1025 |
<td width="22%" valign="top" class="vncellreq"><?=gettext("DH Parameters Length"); ?></td>
|
|
| 1026 |
<td width="78%" class="vtable"> |
|
| 1027 |
<select name="dh_length" class="formselect"> |
|
| 1028 |
<?php |
|
| 1029 |
foreach ($openvpn_dh_lengths as $length): |
|
| 1030 |
$selected = ""; |
|
| 1031 |
if ($length == $pconfig['dh_length']) |
|
| 1032 |
$selected = " selected=\"selected\""; |
|
| 1033 |
?> |
|
| 1034 |
<option<?=$selected?>><?=$length;?></option> |
|
| 1035 |
<?php endforeach; ?> |
|
| 1036 |
</select> |
|
| 1037 |
<span class="vexpl"> |
|
| 1038 |
<?=gettext("bits"); ?>
|
|
| 1039 |
</span> |
|
| 1040 |
</td> |
|
| 1041 |
</tr> |
|
| 1042 |
<tr id="psk"> |
|
| 1043 |
<td width="22%" valign="top" class="vncellreq"><?=gettext("Shared Key"); ?></td>
|
|
| 1044 |
<td width="78%" class="vtable"> |
|
| 1045 |
<?php if (!$pconfig['shared_key']): ?> |
|
| 1046 |
<table border="0" cellpadding="2" cellspacing="0" summary="shared key"> |
|
| 1047 |
<tr> |
|
| 1048 |
<td> |
|
| 1049 |
<?php set_checked($pconfig['autokey_enable'],$chk); ?> |
|
| 1050 |
<input name="autokey_enable" type="checkbox" value="yes" <?=$chk;?> onclick="autokey_change()" /> |
|
| 1051 |
</td> |
|
| 1052 |
<td> |
|
| 1053 |
<span class="vexpl"> |
|
| 1054 |
<?=gettext("Automatically generate a shared key"); ?>.
|
|
| 1055 |
</span> |
|
| 1056 |
</td> |
|
| 1057 |
</tr> |
|
| 1058 |
</table> |
|
| 1059 |
<?php endif; ?> |
|
| 1060 |
<table border="0" cellpadding="2" cellspacing="0" id="autokey_opts" summary="shared key"> |
|
| 1061 |
<tr> |
|
| 1062 |
<td> |
|
| 1063 |
<textarea name="shared_key" cols="65" rows="7" class="formpre"><?=htmlspecialchars($pconfig['shared_key']);?></textarea> |
|
| 1064 |
<br /> |
|
| 1065 |
<?=gettext("Paste your shared key here"); ?>.
|
|
| 1066 |
</td> |
|
| 1067 |
</tr> |
|
| 1068 |
</table> |
|
| 1069 |
</td> |
|
| 1070 |
</tr> |
|
| 1071 |
<tr> |
|
| 1072 |
<td width="22%" valign="top" class="vncellreq"><?=gettext("Encryption algorithm"); ?></td>
|
|
| 1073 |
<td width="78%" class="vtable"> |
|
| 1074 |
<select name="crypto" class="formselect"> |
|
| 1075 |
<?php |
|
| 1076 |
$cipherlist = openvpn_get_cipherlist(); |
|
| 1077 |
foreach ($cipherlist as $name => $desc): |
|
| 1078 |
$selected = ""; |
|
| 1079 |
if ($name == $pconfig['crypto']) |
|
| 1080 |
$selected = " selected=\"selected\""; |
|
| 1081 |
?> |
|
| 1082 |
<option value="<?=$name;?>"<?=$selected?>> |
|
| 1083 |
<?=htmlspecialchars($desc);?> |
|
| 1084 |
</option> |
|
| 1085 |
<?php endforeach; ?> |
|
| 1086 |
</select> |
|
| 1087 |
</td> |
|
| 1088 |
</tr> |
|
| 1089 |
<tr> |
|
| 1090 |
<td width="22%" valign="top" class="vncellreq"><?=gettext("Auth Digest Algorithm"); ?></td>
|
|
| 1091 |
<td width="78%" class="vtable"> |
|
| 1092 |
<select name="digest" class="formselect"> |
|
| 1093 |
<?php |
|
| 1094 |
$digestlist = openvpn_get_digestlist(); |
|
| 1095 |
foreach ($digestlist as $name => $desc): |
|
| 1096 |
$selected = ""; |
|
| 1097 |
if ($name == $pconfig['digest']) |
|
| 1098 |
$selected = " selected=\"selected\""; |
|
| 1099 |
?> |
|
| 1100 |
<option value="<?=$name;?>"<?=$selected?>> |
|
| 1101 |
<?=htmlspecialchars($desc);?> |
|
| 1102 |
</option> |
|
| 1103 |
<?php endforeach; ?> |
|
Also available in: Unified diff
vpn_openvpn_server.php Conversion complete
Ready for review