====== EdgeRouter + OpenVPN Road Warrior Example ======

===== Generate Certificates With EasyRSA 3 =====
You'll need to generate server, client, and DH certificates using the instructions [[https://community.openvpn.net/openvpn/wiki/EasyRSA3-OpenVPN-Howto|here]].

Once you do that, copy the server certs (ca.crt, server.crt, dh.pem, and server.key) to:

<code>/config/auth/openvpn/</code>

On the EdgeRouter.

Also generate some client certs either now or later.  You'll need them to put the contents inside of the client ovpn file.

===== EdgeRouter Configuration =====
On the EdgeRouter, make changes where appropriate.  Subnet 192.168.0.0/24 should be whatever your LAN subnet behind the EdgeRouter is.  If your subnet is one of the common ones that is by default (like 192.168.0.0/24), there's a good chance your clients may have issues if their LAN also matches yours.

You can use NAT rules to avoid having to change your LAN addressing scheme.

<code>set interfaces openvpn vtun0 firewall in name OpenVPN-Mobile
set interfaces openvpn vtun0 local-host xx.xx.xx.xx
set interfaces openvpn vtun0 local-port xxxxx
set interfaces openvpn vtun0 mode server
set interfaces openvpn vtun0 openvpn-option --mssfix
set interfaces openvpn vtun0 openvpn-option '--cipher AES-128-CBC'
set interfaces openvpn vtun0 openvpn-option '--auth SHA256'
set interfaces openvpn vtun0 openvpn-option --float
set interfaces openvpn vtun0 openvpn-option --duplicate-cn
set interfaces openvpn vtun0 openvpn-option '--fragment 1400'
set interfaces openvpn vtun0 protocol udp
set interfaces openvpn vtun0 server max-connections 10
set interfaces openvpn vtun0 server push-route 10.10.10.0/24
set interfaces openvpn vtun0 server push-route 192.168.0.0/24
set interfaces openvpn vtun0 server subnet 10.10.10.0/24
set interfaces openvpn vtun0 tls ca-cert-file /config/auth/openvpn/ca.crt
set interfaces openvpn vtun0 tls cert-file /config/auth/openvpn/server.crt
set interfaces openvpn vtun0 tls dh-file /config/auth/openvpn/dh.pem
set interfaces openvpn vtun0 tls key-file /config/auth/openvpn/server.key
</code>

===== OpenVPN .ovpn Config File For Clients =====
<code>
client
tls-client
remote remote.hostname.here
port xxxx
proto udp
dev tun
pull
cipher AES-128-CBC
auth SHA256
fragment 1400
mssfix
float
<ca>
ca certificate file contents here
</ca>
<cert>
pem certificate file contents here
</cert>
<key>
pem key file contents here
</key>
</code>

===== NAT Rules To Work Around Same Subnets On Both Ends =====
If you have a subnet on your LAN side that is one of the common default ones on most consumer networks (like 192.168.0.0/24), you'll need to use NAT rules to setup a NETMAP to work around conflicts.

Example:
<code>Server LAN: 192.168.0.0/24
Client Range: 10.10.10.0/24
NETMAP Range: 172.30.254.0/24
</code>

The NETMAP range is the IP range that will be directly mapped to your LAN range and the range your clients will use to connect to devices on your LAN (aka, if your clients need to access 192.168.0.5, they will use 172.30.254.5 instead).

<code>
set service nat rule 1000 description OpenVPN-Mobile-vtun0
set service nat rule 1000 destination address 172.30.254.0/24
set service nat rule 1000 inbound-interface vtun0
set service nat rule 1000 inside-address address 192.168.0.0/24
set service nat rule 1000 log disable
set service nat rule 1000 protocol all
set service nat rule 1000 type destination
</code>