openvpn3-config-manage(1)

📦
version 27.1 · 5 versions
, in nixpkgs unstable, ubuntu stonking

💖 openvpn3-config-manage(1) — the OpenVPN 3 Linux girlies' guide to Configuration Profile Management 💖

okay bestie, so you've got a config profile imported into OpenVPN 3 Linux and now you wanna ✨tweak✨ it. That's literally what this page is. It lives in the OpenVPN 3 Linux manual set, so let's get into it 🫶

✨ SYNOPSIS ✨

openvpn3 config-manage -o DBUS-PATH | --path DBUS-PATH | --config CONFIG-NAME [OPTIONS]
openvpn3 config-manage -h | --help

🌸 DESCRIPTION 🌸

So this is the tool that manages settings for an already imported configuration profile. The whole vibe is: you take the original config profile and you override bits of it. 💅

🚨 important bestie: these overrides will not show up in the output of openvpn3 config-dump. Like, at all. If you wanna actually see the overrides you've stacked up, use openvpn3 config-manage --show. iykyk 💖

👑 OPTIONS 👑

  • -h, --help — prints usage and help details straight to your terminal. the classic cry-for-help flag 🎀
  • -o DBUS-PATH, --path DBUS-PATH — the D-Bus configuration path of the configuration to delete. You can find it with openvpn3 configs-list.
  • --config-path DBUS-PATH — bestie this is literally just an alias for --path. same thing, different outfit 💅
  • -c CONFIG-NAME, --config CONFIG-NAME — use this instead of --path when you've got the configuration profile name. Available names? openvpn3 configs-list has you covered 🔍
  • -r NEW-CONFIG-NAME, --rename NEW-CONFIG-NAME — renames the configuration profile. glow-up for your config 🦋
  • --tag TAG-VALUE — adds a tag value to a configuration profile 🏷️
  • --remove-tag TAG-VALUE — removes a tag value from a configuration profile. okay we're un-tagging, no hard feelings 🥲
  • -s, --show — shows the current profile settings 👀
  • --exists — checks if a configuration profile exists. Requires either --config or --path. It will exit with 0 if the configuration profile is found, otherwise 1. very pass/fail, very vibe check 💀
  • --quiet — don't display informative information when modifying the configuration profile. shhh 🤫
  • --dco BOOL — enables kernel based Data Channel Offload. This moves the tunnelled network traffic to be handled inside the kernel. It improves the processing of the network traffic and moves the encryption, decryption and packet authentication for the tunnelled network traffic to be handled inside the kernel instead of being passed via the OpenVPN client process in user space. 🔥
⚠️ This option is only available if openvpn3-linux has been built with this support. It will also require the ovpn-dco-v2 kernel module to be available.
  • --server-override HOST — override the remote server hostname/IP address to connect against 🌐
  • --port-override PORT — override the remote server port to connect against. Valid values: 1 to 65535. no funny business with the port numbers pls 🔢
  • --proto-override PROTO — override the connection protocol. Valid values are tcp and udp.
  • --ipv6 ARG — sets the IPv6 connect policy for the client. Valid values are yes, no and default.
  • --persist-tun BOOL — overrides the --persist-tun argument in the configuration profile. If set to true, the tun adapter will persist during the reconnect. If false, the tun adapter will be torn down before reconnects. Valid values are: true, false.
  • --log-level LEVEL — overrides the default log level. The default log level is 3 if the configuration file does not contain a --verb option. This override will take place over any other log verbosity settings. Valid values are between 1 and 6. 📝
  • --dns-fallback-google BOOL — if set to true, the DNS resolver settings will include Google DNS servers. Valid values are: true, false.
  • --dns-scope SCOPE — defines the DNS query scope. This is currently only supported when enabling the systemd-resolved(8) resolver support in openvpn3-service-netcfg(8). Supported values are:
    • global: (default) — the VPN service provided DNS server(s) will be used for all types of DNS queries.
    • tunnel: — the VPN service provided DNS server(s) will only be used for queries for DNS domains pushed by the VPN service.
📌 NOTE: The DNS domains pushed by the VPN service may be queried by DNS servers with systemd-resolved(8) service if their respective interfaces are configured to do global DNS queries. But other non-listed DNS domains will not be sent to this VPN service provider's DNS server.
  • --dns-setup-disabled BOOL — if set to true, DNS settings will not be configured on the system. Valid values are: true, false.
  • --dns-sync-lookup BOOL — if set to true, DNS lookups will happen synchronously. Valid values are: true, false.
  • --enterprise-profile PROFILE_NAME — this enables device posture checks if the server requests it. The profile name needs to match a device posture profile found in the @DEVPOSTURE_PROFILEDIR@ directory. The PROFILE_NAME is without any file extension. For a successful device posture check, the profile must match the protocol the server side expects. This information needs to be provided by your VPN server administrator. 🏢
  • --auth-fail-retry BOOL — if set to true, the client will try to reconnect instead of disconnecting if authentication fails. Valid values are: true, false. never give up bestie ✊
  • --allow-compression ARG — this controls whether the client wants to allow compression on traffic between the client to the server. Valid argument values:
    • no: — do not compress at all
    • asym: — only allow server to send compressed data
    • yes: — both client and server can use compression
  • --enable-legacy-algorithms BOOL — by default, OpenVPN 3 Linux only expects to work with servers capable of doing AEAD ciphers on the data channel, such as AES-GCM or ChaCha20-Poly1305 (if supported by the TLS library). To connect to legacy servers not capable of AEAD ciphers on the data channel, it might help to enable legacy cipher algorithms. 🦕
  • --tls-version-min ARG — sets the minimum TLS version for the control channel. For this to be functional, the SSL/TLS library in use needs to support this restriction on both server and client. Valid argument values are:
    • tls_1_0: — enforce minimum TLSv1.0
    • tls_1_1: — enforce minimum TLSv1.1
    • tls_1_2: — enforce minimum TLSv1.2
    • tls_1_3: — enforce minimum TLSv1.3. This is currently only supported by OpenSSL 1.1.1.
  • --tls-cert-profile ARG — this sets the acceptable certificate and key parameters. Valid argument values are:
    • legacy: — allows minimum 1024 bits RSA keys with certificates signed with SHA1.
    • preferred: — allows minimum 2048 bits RSA keys with certificates signed with SHA256 or higher. (default)
    • suiteb: — this follows the NSA Suite-B specification. 🕵️
  • --proxy-host PROXY-SERVER — HTTP proxy to establish the VPN connection via.
  • --proxy-port PROXY-PORT — port where the HTTP proxy is available.
  • --proxy-username PROXY-USER — username to use for the HTTP proxy connection.
  • --proxy-password PROXY-PASSWORD — password to use for the HTTP proxy connection.
  • --proxy-auth-cleartext BOOL — allow HTTP proxy authentication to happen in clear-text. Valid values are: true, false.
  • --automatic-restart MODE — instructs the Session Manager how to handle sessions if the OpenVPN 3 Client process disappears unexpectedly. The MODE argument can be either on-failure to enable this feature or no to disable it. The default is no. ♻️
  • --unset-override OVERRIDE — this removes an override setting from the configuration profile. The OVERRIDE value is the setting arguments enlisted here but without the leading --. For example, if --tls-cert-profile suiteb was set, it can be unset with --unset-override tls-cert-profile. undo, undo, undo ↩️

🦋 SEE ALSO 🦋

and that's the whole page bestie!! 💖 this was openvpn3-config-manage(1) from the OpenVPN 3 Linux manual set — go forth and override your config profiles, you absolute icon 👑✨🎀

📦 where this page comes from