예제 #1
0
파일: vpn_openvpn.c 프로젝트: PterX/rt-n56u
int
ovpn_server_expcli_main(int argc, char **argv)
{
	FILE *fp;
	int i, i_atls, rsa_bits, days_valid;
	char *wan_addr;
	const char *tmp_ovpn_path = "/tmp/export_ovpn";
	const char *tmp_ovpn_conf = "/tmp/client.ovpn";

	if (argc < 2 || strlen(argv[1]) < 1) {
		printf("Usage: %s common_name [rsa_bits] [days_valid]\n", argv[0]);
		return 1;
	}

	rsa_bits = 1024;
	if (argc > 2 && atoi(argv[2]) >= 1024)
		rsa_bits = atoi(argv[2]);

	days_valid = 365;
	if (argc > 3 && atoi(argv[3]) > 0)
		days_valid = atoi(argv[3]);

	i_atls = nvram_get_int("vpns_ov_atls");

	for (i=0; i<5; i++) {
		if (!i_atls && (i == 4))
			continue;
		if (!openvpn_check_key(openvpn_server_keys[i], 1)) {
			printf("Error: server file %s is not found\n", openvpn_server_keys[i]);
			return 1;
		}
	}

	/* Generate client cert and key */
	doSystem("rm -rf %s", tmp_ovpn_path);
	setenv("CRT_PATH_CLI", tmp_ovpn_path, 1);
	doSystem("/usr/bin/openvpn-cert.sh %s -n '%s' -b %d -d %d", "client", argv[1], rsa_bits, days_valid);
	unsetenv("CRT_PATH_CLI");

	fp = fopen(tmp_ovpn_conf, "w+");
	if (!fp) {
		doSystem("rm -rf %s", tmp_ovpn_path);
		printf("Error: unable to create file %s\n", tmp_ovpn_conf);
		return 1;
	}

	wan_addr = get_ddns_fqdn();
	if (!wan_addr) {
		wan_addr = get_wan_unit_value(0, "ipaddr");
		if (!is_valid_ipv4(wan_addr))
			wan_addr = NULL;
	}

	if (!wan_addr)
		wan_addr = "{wan_address}";

	fprintf(fp, "client\n");
	fprintf(fp, "dev %s\n", (nvram_get_int("vpns_ov_mode") == 1) ? "tun" : "tap");
	fprintf(fp, "proto %s\n", (nvram_get_int("vpns_ov_prot") > 0) ? "tcp-client" : "udp");
	fprintf(fp, "remote %s %d\n", wan_addr, nvram_safe_get_int("vpns_ov_port", 1194, 1, 65535));
	fprintf(fp, "resolv-retry %s\n", "infinite");
	fprintf(fp, "nobind\n");
	fprintf(fp, "persist-key\n");
	fprintf(fp, "persist-tun\n");
	openvpn_add_auth(fp, nvram_get_int("vpns_ov_mdig"));
	openvpn_add_cipher(fp, nvram_get_int("vpns_ov_ciph"));
	openvpn_add_lzo(fp, nvram_get_int("vpns_ov_clzo"), 0);
	fprintf(fp, "nice %d\n", 0);
	fprintf(fp, "verb %d\n", 3);
	fprintf(fp, "mute %d\n", 10);
	fprintf(fp, ";ns-cert-type %s\n", "server");
	openvpn_add_key(fp, SERVER_CERT_DIR, openvpn_server_keys[0], "ca");
	openvpn_add_key(fp, tmp_ovpn_path, openvpn_client_keys[1], "cert");
	openvpn_add_key(fp, tmp_ovpn_path, openvpn_client_keys[2], "key");
	if (i_atls) {
		openvpn_add_key(fp, SERVER_CERT_DIR, openvpn_server_keys[4], "tls-auth");
		fprintf(fp, "key-direction %d\n", 1);
	}
	fclose(fp);

	doSystem("rm -rf %s", tmp_ovpn_path);

	doSystem("unix2dos %s", tmp_ovpn_conf);
	chmod(tmp_ovpn_conf, 0600);

	return 0;
}
예제 #2
0
파일: vpn_openvpn.c 프로젝트: PterX/rt-n56u
static int
openvpn_create_client_conf(const char *conf_file, int is_tun)
{
	FILE *fp;
	int i, i_prot, i_auth, i_atls;

	i_auth = nvram_get_int("vpnc_ov_auth");
	i_atls = nvram_get_int("vpnc_ov_atls");

	for (i=0; i<4; i++) {
		if (i_auth == 1 && (i == 1 || i == 2))
			continue;
		if (!i_atls && (i == 3))
			continue;
		if (!openvpn_check_key(openvpn_client_keys[i], 0))
			return 1;
	}

	i_prot = nvram_get_int("vpnc_ov_prot");

	fp = fopen(conf_file, "w+");
	if (fp) {
		fprintf(fp, "client\n");
		if (i_prot > 0)
			fprintf(fp, "proto %s\n", "tcp-client");
		else
			fprintf(fp, "proto %s\n", "udp");
		
		fprintf(fp, "remote %s %d\n", nvram_safe_get("vpnc_peer"), nvram_safe_get_int("vpnc_ov_port", 1194, 1, 65535));
		fprintf(fp, "resolv-retry %s\n", "infinite");
		fprintf(fp, "nobind\n");
		fprintf(fp, "dev %s\n", (is_tun) ? IFNAME_CLIENT_TUN : IFNAME_CLIENT_TAP);
		
		fprintf(fp, "ca %s/%s\n", CLIENT_CERT_DIR, openvpn_client_keys[0]);
		if (i_auth == 0) {
			fprintf(fp, "cert %s/%s\n", CLIENT_CERT_DIR, openvpn_client_keys[1]);
			fprintf(fp, "key %s/%s\n", CLIENT_CERT_DIR, openvpn_client_keys[2]);
		}
		
		if (i_atls)
			fprintf(fp, "tls-auth %s/%s %d\n", CLIENT_CERT_DIR, openvpn_client_keys[3], 1);
		
		openvpn_add_auth(fp, nvram_get_int("vpnc_ov_mdig"));
		openvpn_add_cipher(fp, nvram_get_int("vpnc_ov_ciph"));
		openvpn_add_lzo(fp, nvram_get_int("vpnc_ov_clzo"), 0);
		
		if (i_auth == 1) {
			fprintf(fp, "auth-user-pass %s\n", "secret");
			openvpn_create_client_secret("secret");
		}
		
		if (nvram_match("vpnc_dgw", "1"))
			fprintf(fp, "redirect-gateway def1 bypass-dhcp\n");
		
		fprintf(fp, "persist-key\n");
		fprintf(fp, "script-security %d\n", 2);
		fprintf(fp, "writepid %s\n", CLIENT_PID_FILE);
		
		fprintf(fp, "up %s\n",  SCRIPT_OVPN_CLIENT);
		fprintf(fp, "down %s\n",  SCRIPT_OVPN_CLIENT);
		
		fprintf(fp, "\n### User params:\n");
		
		load_user_config(fp, CLIENT_CERT_DIR, "client.conf", forbidden_list);
		
		fclose(fp);
		
		chmod(conf_file, 0644);
		
		return 0;
	}

	return 1;
}
예제 #3
0
파일: vpn_openvpn.c 프로젝트: PterX/rt-n56u
static int
openvpn_create_server_conf(const char *conf_file, int is_tun)
{
	FILE *fp;
	int i, i_prot, i_atls, i_rdgw, i_dhcp, i_items, i_cli0, i_cli1;
	unsigned int laddr, lmask, lsnet;
	struct in_addr pool_in;
	char pooll[32], pool1[32], pool2[32];
	char *lanip, *lannm, *wins, *dns1, *dns2;

	i_atls = nvram_get_int("vpns_ov_atls");

	for (i=0; i<5; i++) {
		if (!i_atls && (i == 4))
			continue;
		if (!openvpn_check_key(openvpn_server_keys[i], 1))
			return 1;
	}

	i_prot = nvram_get_int("vpns_ov_prot");
	i_rdgw = nvram_get_int("vpns_ov_rdgw");
	i_cli0 = nvram_safe_get_int("vpns_cli0", 245, 1, 254);
	i_cli1 = nvram_safe_get_int("vpns_cli1", 254, 2, 254);

	i_dhcp = is_dhcpd_enabled(0);

	lanip = nvram_safe_get("lan_ipaddr");
	lannm = nvram_safe_get("lan_netmask");

	laddr = ntohl(inet_addr(lanip));
	lmask = ntohl(inet_addr(lannm));
	lsnet = (~lmask) - 1;

	if (i_cli0 > (int)lsnet) i_cli0 = (int)lsnet;
	if (i_cli1 > (int)lsnet) i_cli1 = (int)lsnet;
	if (i_cli1 < i_cli0) i_cli1 = i_cli0;

	pool_in.s_addr = htonl(laddr & lmask);
	strcpy(pooll, inet_ntoa(pool_in));
	pool_in.s_addr = htonl((laddr & lmask) | (unsigned int)i_cli0);
	strcpy(pool1, inet_ntoa(pool_in));
	pool_in.s_addr = htonl((laddr & lmask) | (unsigned int)i_cli1);
	strcpy(pool2, inet_ntoa(pool_in));

	fp = fopen(conf_file, "w+");
	if (fp) {
		if (i_prot > 0)
			fprintf(fp, "proto %s\n", "tcp-server");
		else
			fprintf(fp, "proto %s\n", "udp");
		fprintf(fp, "port %d\n", nvram_safe_get_int("vpns_ov_port", 1194, 1, 65535));
		
		if (is_tun) {
			char *vnet, *vmsk;
			
			vnet = nvram_safe_get("vpns_vnet");
			vmsk = VPN_SERVER_SUBNET_MASK;
			laddr = ntohl(inet_addr(vnet));
			lmask = ntohl(inet_addr(vmsk));
			pool_in.s_addr = htonl(laddr & lmask);
			
			fprintf(fp, "dev %s\n", IFNAME_SERVER_TUN);
			fprintf(fp, "topology %s\n", "subnet");
			fprintf(fp, "server %s %s\n", inet_ntoa(pool_in), vmsk);
			fprintf(fp, "client-config-dir %s\n", "ccd");
			openvpn_create_server_acl(fp, "ccd");
			fprintf(fp, "push \"route %s %s\"\n", pooll, lannm);
		} else {
			fprintf(fp, "dev %s\n", IFNAME_SERVER_TAP);
			fprintf(fp, "server-bridge %s %s %s %s\n", lanip, lannm, pool1, pool2);
		}
		
		openvpn_add_auth(fp, nvram_get_int("vpns_ov_mdig"));
		openvpn_add_cipher(fp, nvram_get_int("vpns_ov_ciph"));
		openvpn_add_lzo(fp, nvram_get_int("vpns_ov_clzo"), 1);
		
		i_items = 0;
		if (i_rdgw) {
			fprintf(fp, "push \"redirect-gateway def1 %s\"\n", "bypass-dhcp");
			if (i_dhcp) {
				dns1 = nvram_safe_get("dhcp_dns1_x");
				dns2 = nvram_safe_get("dhcp_dns2_x");
				if (is_valid_ipv4(dns1) && (strcmp(dns1, lanip))) {
					i_items++;
					fprintf(fp, "push \"dhcp-option %s %s\"\n", "DNS", dns1);
				}
				if (is_valid_ipv4(dns2) && (strcmp(dns2, lanip)) && (strcmp(dns2, dns1))) {
					i_items++;
					fprintf(fp, "push \"dhcp-option %s %s\"\n", "DNS", dns2);
				}
			}
			
			if (i_items < 2)
				fprintf(fp, "push \"dhcp-option %s %s\"\n", "DNS", lanip);
		}
		
		i_items = 0;
		if (i_dhcp) {
			wins = nvram_safe_get("dhcp_wins_x");
			if (is_valid_ipv4(wins)) {
				i_items++;
				fprintf(fp, "push \"dhcp-option %s %s\"\n", "WINS", wins);
			}
		}
		
#if defined(APP_SMBD) || defined(APP_NMBD)
		if ((i_items < 1) && nvram_get_int("wins_enable"))
			fprintf(fp, "push \"dhcp-option %s %s\"\n", "WINS", lanip);
#endif
		
		fprintf(fp, "ca %s/%s\n", SERVER_CERT_DIR, openvpn_server_keys[0]);
		fprintf(fp, "dh %s/%s\n", SERVER_CERT_DIR, openvpn_server_keys[1]);
		fprintf(fp, "cert %s/%s\n", SERVER_CERT_DIR, openvpn_server_keys[2]);
		fprintf(fp, "key %s/%s\n", SERVER_CERT_DIR, openvpn_server_keys[3]);
		
		if (i_atls)
			fprintf(fp, "tls-auth %s/%s %d\n", SERVER_CERT_DIR, openvpn_server_keys[4], 0);
		
		fprintf(fp, "persist-key\n");
		fprintf(fp, "persist-tun\n");
		fprintf(fp, "user %s\n", SYS_USER_NOBODY);
		fprintf(fp, "group %s\n", SYS_GROUP_NOGROUP);
		fprintf(fp, "script-security %d\n", 2);
		fprintf(fp, "tmp-dir %s\n", COMMON_TEMP_DIR);
		fprintf(fp, "writepid %s\n", SERVER_PID_FILE);
		
		fprintf(fp, "client-connect %s\n", SCRIPT_OVPN_SERVER);
		fprintf(fp, "client-disconnect %s\n", SCRIPT_OVPN_SERVER);
		
		fprintf(fp, "\n### User params:\n");
		
		load_user_config(fp, SERVER_CERT_DIR, "server.conf", forbidden_list);
		
		fclose(fp);
		
		chmod(conf_file, 0644);
		
		return 0;
	}

	return 1;
}
예제 #4
0
static int
openvpn_create_server_conf(const char *conf_file, int is_tun)
{
	FILE *fp;
	int i, i_prot, i_atls, i_rdgw, i_dhcp, i_dns, i_cli0, i_cli1;
	unsigned int laddr, lmask;
	struct in_addr pool_in;
	char pooll[32], pool1[32], pool2[32];
	char *lanip, *lannm, *wins, *dns1, *dns2;

	i_atls = nvram_get_int("vpns_ov_atls");

	for (i=0; i<5; i++) {
		if (!i_atls && (i == 4))
			continue;
		if (!openvpn_check_key(openvpn_server_keys[i], 1))
			return 1;
	}

	i_prot = nvram_get_int("vpns_ov_prot");
	i_rdgw = nvram_get_int("vpns_ov_rdgw");
	i_cli0 = nvram_get_int("vpns_cli0");
	i_cli1 = nvram_get_int("vpns_cli1");

	i_dns = 0;
	i_dhcp = nvram_get_int("dhcp_enable_x");

	lanip = nvram_safe_get("lan_ipaddr");
	lannm = nvram_safe_get("lan_netmask");

	if (i_cli0 <   2) i_cli0 =   2;
	if (i_cli0 > 254) i_cli0 = 254;
	if (i_cli1 <   2) i_cli1 =   2;
	if (i_cli1 > 254) i_cli1 = 254;
	if (i_cli1 < i_cli0) i_cli1 = i_cli0;

	laddr = ntohl(inet_addr(lanip));
	lmask = ntohl(inet_addr(lannm));
	pool_in.s_addr = htonl(laddr & lmask);
	strcpy(pooll, inet_ntoa(pool_in));
	pool_in.s_addr = htonl((laddr & lmask) | (unsigned int)i_cli0);
	strcpy(pool1, inet_ntoa(pool_in));
	pool_in.s_addr = htonl((laddr & lmask) | (unsigned int)i_cli1);
	strcpy(pool2, inet_ntoa(pool_in));

	fp = fopen(conf_file, "w+");
	if (fp) {
		if (i_prot > 0)
			fprintf(fp, "proto %s\n", "tcp-server");
		else
			fprintf(fp, "proto %s\n", "udp");
		fprintf(fp, "port %d\n", nvram_safe_get_int("vpns_ov_port", 1194, 1, 65535));
		
		if (is_tun) {
			char *vnet, *vmsk;
			vnet = nvram_safe_get("vpns_vnet");
			vmsk = VPN_SERVER_SUBNET_MASK;
			laddr = ntohl(inet_addr(vnet));
			lmask = ntohl(inet_addr(vmsk));
			pool_in.s_addr = htonl(laddr & lmask);
			
			fprintf(fp, "dev %s\n", IFNAME_SERVER_TUN);
			fprintf(fp, "topology %s\n", "subnet");
			fprintf(fp, "server %s %s\n", inet_ntoa(pool_in), vmsk);
			fprintf(fp, "client-config-dir %s\n", "ccd");
			openvpn_create_server_acl(fp, "ccd");
			fprintf(fp, "push \"route %s %s\"\n", pooll, lannm);
		} else {
			fprintf(fp, "dev %s\n", IFNAME_SERVER_TAP);
			fprintf(fp, "server-bridge %s %s %s %s\n", lanip, lannm, pool1, pool2);
		}
		
		if (i_rdgw) {
			fprintf(fp, "push \"redirect-gateway def1 %s\"\n", "bypass-dhcp");
			if (i_dhcp == 1) {
				dns1 = nvram_safe_get("dhcp_dns1_x");
				dns2 = nvram_safe_get("dhcp_dns2_x");
				if ((inet_addr_(dns1) != INADDR_ANY) && (strcmp(dns1, lanip))) {
					i_dns++;
					fprintf(fp, "push \"dhcp-option %s %s\"\n", "DNS", dns1);
				}
				if ((inet_addr_(dns2) != INADDR_ANY) && (strcmp(dns2, lanip)) && (strcmp(dns2, dns1))) {
					i_dns++;
					fprintf(fp, "push \"dhcp-option %s %s\"\n", "DNS", dns2);
				}
			}
			
			if (i_dns < 2)
				fprintf(fp, "push \"dhcp-option %s %s\"\n", "DNS", lanip);
		}
		
		if (i_dhcp == 1)
		{
			wins = nvram_safe_get("dhcp_wins_x");
			if (inet_addr_(wins) != INADDR_ANY)
				fprintf(fp, "push \"dhcp-option %s %s\"\n", "WINS", wins);
		}
		
		fprintf(fp, "ca %s/%s\n", SERVER_CERT_DIR, openvpn_server_keys[0]);
		fprintf(fp, "dh %s/%s\n", SERVER_CERT_DIR, openvpn_server_keys[1]);
		fprintf(fp, "cert %s/%s\n", SERVER_CERT_DIR, openvpn_server_keys[2]);
		fprintf(fp, "key %s/%s\n", SERVER_CERT_DIR, openvpn_server_keys[3]);
		
		if (i_atls)
			fprintf(fp, "tls-auth %s/%s %d\n", SERVER_CERT_DIR, openvpn_server_keys[4], 0);
		
		fprintf(fp, "persist-key\n");
		fprintf(fp, "persist-tun\n");
		fprintf(fp, "user %s\n", "nobody");
		fprintf(fp, "group %s\n", "nogroup");
		fprintf(fp, "script-security %d\n", 2);
		fprintf(fp, "tmp-dir %s\n", COMMON_TEMP_DIR);
		fprintf(fp, "writepid %s\n", SERVER_PID_FILE);
		
		fprintf(fp, "client-connect %s\n", SCRIPT_OVPN_SERVER);
		fprintf(fp, "client-disconnect %s\n", SCRIPT_OVPN_SERVER);
		
		fprintf(fp, "\n### User params:\n");
		
		openvpn_load_user_config(fp, SERVER_CERT_DIR, "server.conf");
		
		fclose(fp);
		
		chmod(conf_file, 0644);
		
		return 0;
	}

	return 1;
}
예제 #5
0
static int
openvpn_create_client_conf(const char *conf_file, int is_tun)
{
    FILE *fp;
    int i, i_prot, i_prot_ori, i_auth, i_atls;
    const char *p_peer, *p_prot;

    i_auth = nvram_get_int("vpnc_ov_auth");
    i_atls = nvram_get_int("vpnc_ov_atls");

    for (i=0; i<4; i++) {
        if (i_auth == 1 && (i == 1 || i == 2))
            continue;
        if (!i_atls && (i == 3))
            continue;
        if (!openvpn_check_key(openvpn_client_keys[i], 0))
            return 1;
    }

    i_prot = nvram_get_int("vpnc_ov_prot");
    i_prot_ori = i_prot;
    if (i_prot > 1 && get_ipv6_type() == IPV6_DISABLED)
        i_prot &= 1;

    p_peer = nvram_safe_get("vpnc_peer");

    /* note: upcoming openvpn 2.4 will need direct set udp4/tcp4-client for ipv4 only */
#if defined (USE_IPV6)
    /* check peer address is direct ipv4/ipv6 */
    if (i_prot > 1 && is_valid_ipv4(p_peer))
        i_prot &= 1;
    else if (i_prot < 2 && is_valid_ipv6(p_peer))
        i_prot += 2;

    if (i_prot == 3)
        p_prot = "tcp6-client";
    else if (i_prot == 2)
        p_prot = "udp6";
    else
#endif
        if (i_prot == 1)
            p_prot = "tcp-client";
        else
            p_prot = "udp";

    /* fixup ipv4/ipv6 mismatch */
    if (i_prot != i_prot_ori)
        nvram_set_int("vpnc_ov_prot", i_prot);

    fp = fopen(conf_file, "w+");
    if (!fp)
        return 1;

    fprintf(fp, "client\n");
    fprintf(fp, "proto %s\n", p_prot);
    fprintf(fp, "remote %s %d\n", p_peer, nvram_safe_get_int("vpnc_ov_port", 1194, 1, 65535));
    fprintf(fp, "resolv-retry %s\n", "infinite");
    fprintf(fp, "nobind\n");

    fprintf(fp, "dev %s\n", (is_tun) ? IFNAME_CLIENT_TUN : IFNAME_CLIENT_TAP);

    fprintf(fp, "ca %s/%s\n", CLIENT_CERT_DIR, openvpn_client_keys[0]);
    if (i_auth == 0) {
        fprintf(fp, "cert %s/%s\n", CLIENT_CERT_DIR, openvpn_client_keys[1]);
        fprintf(fp, "key %s/%s\n", CLIENT_CERT_DIR, openvpn_client_keys[2]);
    }

    if (i_atls)
        fprintf(fp, "tls-auth %s/%s %d\n", CLIENT_CERT_DIR, openvpn_client_keys[3], 1);

    openvpn_add_auth(fp, nvram_get_int("vpnc_ov_mdig"));
    openvpn_add_cipher(fp, nvram_get_int("vpnc_ov_ciph"));
    openvpn_add_lzo(fp, nvram_get_int("vpnc_ov_clzo"), 0);

    if (i_auth == 1) {
        fprintf(fp, "auth-user-pass %s\n", "secret");
        openvpn_create_client_secret("secret");
    }

    if (nvram_match("vpnc_dgw", "1"))
        fprintf(fp, "redirect-gateway def1 bypass-dhcp\n");

    fprintf(fp, "persist-key\n");
    fprintf(fp, "script-security %d\n", 2);
    fprintf(fp, "writepid %s\n", CLIENT_PID_FILE);

    fprintf(fp, "up %s\n",  SCRIPT_OVPN_CLIENT);
    fprintf(fp, "down %s\n",  SCRIPT_OVPN_CLIENT);

    fprintf(fp, "\n### User params:\n");

    load_user_config(fp, CLIENT_CERT_DIR, "client.conf", forbidden_list);

    fclose(fp);

    chmod(conf_file, 0644);

    return 0;
}
예제 #6
0
static int
openvpn_create_server_conf(const char *conf_file, int is_tun)
{
    FILE *fp;
    int i, i_prot, i_prot_ori, i_atls, i_rdgw, i_dhcp, i_items;
    unsigned int laddr, lmask;
    char *lanip, *lannm, *wins, *dns1, *dns2;
    const char *p_prot;
    struct in_addr pool_in;

    i_atls = nvram_get_int("vpns_ov_atls");

    for (i=0; i<5; i++) {
        if (!i_atls && (i == 4))
            continue;
        if (!openvpn_check_key(openvpn_server_keys[i], 1))
            return 1;
    }

    i_prot = nvram_get_int("vpns_ov_prot");
    i_rdgw = nvram_get_int("vpns_ov_rdgw");

    i_dhcp = is_dhcpd_enabled(0);

    lanip = nvram_safe_get("lan_ipaddr");
    lannm = nvram_safe_get("lan_netmask");

    laddr = ntohl(inet_addr(lanip));
    lmask = ntohl(inet_addr(lannm));

    i_prot_ori = i_prot;
    if (i_prot > 1 && get_ipv6_type() == IPV6_DISABLED)
        i_prot &= 1;

    /* note: upcoming openvpn 2.4 will need direct set udp4/tcp4-server for ipv4 only */
#if defined (USE_IPV6)
    if (i_prot == 3)
        p_prot = "tcp6-server";
    else if (i_prot == 2)
        p_prot = "udp6";
    else
#endif
        if (i_prot == 1)
            p_prot = "tcp-server";
        else
            p_prot = "udp";

    /* fixup ipv4/ipv6 mismatch */
    if (i_prot != i_prot_ori)
        nvram_set_int("vpns_ov_prot", i_prot);

    fp = fopen(conf_file, "w+");
    if (!fp)
        return 1;

    fprintf(fp, "proto %s\n", p_prot);
    fprintf(fp, "port %d\n", nvram_safe_get_int("vpns_ov_port", 1194, 1, 65535));

    if (is_tun) {
        unsigned int vnet, vmsk;

        vnet = ntohl(inet_addr(nvram_safe_get("vpns_vnet")));
        vmsk = ntohl(inet_addr(VPN_SERVER_SUBNET_MASK));
        pool_in.s_addr = htonl(vnet & vmsk);

        fprintf(fp, "dev %s\n", IFNAME_SERVER_TUN);
        fprintf(fp, "topology %s\n", "subnet");
        fprintf(fp, "server %s %s\n", inet_ntoa(pool_in), VPN_SERVER_SUBNET_MASK);
        fprintf(fp, "client-config-dir %s\n", "ccd");

        openvpn_create_server_acl(fp, "ccd", vnet, vmsk);

        pool_in.s_addr = htonl(laddr & lmask);
        fprintf(fp, "push \"route %s %s\"\n", inet_ntoa(pool_in), lannm);
    } else {
        char sp_b[INET_ADDRSTRLEN], sp_e[INET_ADDRSTRLEN];
        unsigned int vp_b, vp_e, lnet;

        lnet = ~(lmask) - 1;
        vp_b = (unsigned int)nvram_safe_get_int("vpns_cli0", 245, 1, 254);
        vp_e = (unsigned int)nvram_safe_get_int("vpns_cli1", 254, 2, 254);
        if (vp_b > lnet)
            vp_b = lnet;
        if (vp_e > lnet)
            vp_e = lnet;
        if (vp_e < vp_b)
            vp_e = vp_b;

        pool_in.s_addr = htonl((laddr & lmask) | vp_b);
        strcpy(sp_b, inet_ntoa(pool_in));

        pool_in.s_addr = htonl((laddr & lmask) | vp_e);
        strcpy(sp_e, inet_ntoa(pool_in));

        fprintf(fp, "dev %s\n", IFNAME_SERVER_TAP);
        fprintf(fp, "server-bridge %s %s %s %s\n", lanip, lannm, sp_b, sp_e);
    }

    openvpn_add_auth(fp, nvram_get_int("vpns_ov_mdig"));
    openvpn_add_cipher(fp, nvram_get_int("vpns_ov_ciph"));
    openvpn_add_lzo(fp, nvram_get_int("vpns_ov_clzo"), 1);

    i_items = 0;
    if (i_rdgw) {
        fprintf(fp, "push \"redirect-gateway def1 %s\"\n", "bypass-dhcp");

        if (i_dhcp) {
            dns1 = nvram_safe_get("dhcp_dns1_x");
            dns2 = nvram_safe_get("dhcp_dns2_x");
            if (is_valid_ipv4(dns1)) {
                i_items++;
                fprintf(fp, "push \"dhcp-option %s %s\"\n", "DNS", dns1);
            }
            if (is_valid_ipv4(dns2) && strcmp(dns2, dns1)) {
                i_items++;
                fprintf(fp, "push \"dhcp-option %s %s\"\n", "DNS", dns2);
            }
        }

        if (i_items < 1)
            fprintf(fp, "push \"dhcp-option %s %s\"\n", "DNS", lanip);
    }

    i_items = 0;
    if (i_dhcp) {
        wins = nvram_safe_get("dhcp_wins_x");
        if (is_valid_ipv4(wins)) {
            i_items++;
            fprintf(fp, "push \"dhcp-option %s %s\"\n", "WINS", wins);
        }
    }

#if defined(APP_SMBD) || defined(APP_NMBD)
    if ((i_items < 1) && nvram_get_int("wins_enable"))
        fprintf(fp, "push \"dhcp-option %s %s\"\n", "WINS", lanip);
#endif

    fprintf(fp, "ca %s/%s\n", SERVER_CERT_DIR, openvpn_server_keys[0]);
    fprintf(fp, "dh %s/%s\n", SERVER_CERT_DIR, openvpn_server_keys[1]);
    fprintf(fp, "cert %s/%s\n", SERVER_CERT_DIR, openvpn_server_keys[2]);
    fprintf(fp, "key %s/%s\n", SERVER_CERT_DIR, openvpn_server_keys[3]);

    if (i_atls)
        fprintf(fp, "tls-auth %s/%s %d\n", SERVER_CERT_DIR, openvpn_server_keys[4], 0);

    fprintf(fp, "persist-key\n");
    fprintf(fp, "persist-tun\n");
    fprintf(fp, "user %s\n", SYS_USER_NOBODY);
    fprintf(fp, "group %s\n", SYS_GROUP_NOGROUP);
    fprintf(fp, "script-security %d\n", 2);
    fprintf(fp, "tmp-dir %s\n", COMMON_TEMP_DIR);
    fprintf(fp, "writepid %s\n", SERVER_PID_FILE);

    fprintf(fp, "client-connect %s\n", SCRIPT_OVPN_SERVER);
    fprintf(fp, "client-disconnect %s\n", SCRIPT_OVPN_SERVER);

    fprintf(fp, "\n### User params:\n");

    load_user_config(fp, SERVER_CERT_DIR, "server.conf", forbidden_list);

    fclose(fp);

    chmod(conf_file, 0644);

    return 0;
}