# staff.conf (OpenVPN server configuration file) -- using TLS mode

# Use a dynamic tun device.
dev tun

# TLS mode
server 10.33.0.0 255.255.0.0    # 10.33.0.1 is reserved for server

# key and certificate details
ca keys/ca.crt
key keys/server.key
cert keys/server.crt

# Certificate Revokation List
crl-verify keys/banned_certs.crl

# Diffie-Hellman parameters
dh keys/dh2048.pem

# other options
keepalive 10 60

# client routes and config
## client-config-dir clients

# push routes to the client
push "route 192.168.0.0 255.255.255.0"

# enable routing in the kernel
script-security 2     # so that routing_on.up is allowed to run sysctl
up scripts/routing_on.up