b) 2.1.1 has the windows gui built in, http://www.openvpn.net/download
the .se link is no longer up to date

sorry for the doublepost, i had a typo to fix

b) 2.1.1 has the windows gui built in, http://www.openvpn.net/download
the .se link is no longer up to date

thx, vipera

I am working with FreeBSD 7.0R, and thought I’d mention one thing which tripped me up. In my case ‘tun’ did not come ‘up’ without manual intervention, and I didn’t notice it in ‘ifconfig -a’ for some time. In my case, I made my ‘server-up.sh’ script read:

#!/bin/sh
ifconfig bridge0 addm $dev
ifconfig $dev up

which addressed the problem. I had no need to specify any addresses for anything besides the standard for fxp0 (in my case.)

Another thing which caused me confusion was the ‘server-bridge’ setting. In my case, for the first parameter, I used the internal IP of my router (a different FreeBSD host in my case) which is the standard gateway for all machines in my internal network. I did not need any ‘push “route …”‘ items in my situation. I found myself wishing for a diagram of Angelo’s topology (but also, very happy for what he provided of course!)

I also found better luck pushing DNS entries to the TAP-Win32 interface on my XP client test host by adding the directive:

push "ip-win32 dynamic"

but the jury is still out on how well it really works in practice. I’m just adding these comments early on while things are still fresh in my mind in case others find them helpful.

It’s quite default, but the most important line it the ‘auth-user-pass’, which tells the client it should use username and password authentication instead of certificate based authentication.

On boot I create a bridge called bridge0, and I add the nic0 interface to it. That works. Then when OpenVPN starts, it adds the tap0 interface to the bridge. I guess this is just one of many ways it can work.

Nice info! But you don’t assign an adress to the tap-device? I assumed I didn’t need one, but it didn’t work (no routing) when I didn’t assign an address to the tap-device. I now handle that in the client-connect script.