Ctrl K
ring2all.com

OpenVPN Server Module Documentation

Table of Contents

  1. Module Overview (Technical)
  2. Module Overview (Commercial/Business)
  3. Module Overview (End User/Administrator)
  4. Configuration Sections
  5. Settings Reference
  6. Common Scenarios & Examples
  7. Limitations & Important Notes
  8. Troubleshooting Tips
  9. Glossary

---

1. Module Overview (Technical)

What Is OpenVPN Server?

OpenVPN Server is a VPN management module that configures the OpenVPN server and manages client certificates. It enables secure remote access for IP phones, softphones, and users connecting from outside the LAN.

Architecture

Plaintext
┌─────────────────────────────────────────────────────────────────┐
│              OpenVPN Server Architecture                       │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  OpenVPN Configuration                                          │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │                                                          │   │
│  │  Server Settings:                                        │   │
│  │  ├─ Public Host: vpn.company.com                        │   │
│  │  ├─ Port: 1194                                          │   │
│  │  ├─ Protocol: UDP                                       │   │
│  │  └─ Device: TUN                                         │   │
│  │                                                          │   │
│  │  Network:                                                │   │
│  │  ├─ VPN Subnet: 10.8.0.0                               │   │
│  │  ├─ Netmask: 255.255.255.0                             │   │
│  │  └─ DNS: 8.8.8.8, 8.8.4.4                              │   │
│  │                                                          │   │
│  │  Security:                                               │   │
│  │  ├─ Cipher: AES-256-GCM                                 │   │
│  │  ├─ Auth: SHA256                                        │   │
│  │  └─ TLS Min: 1.2                                        │   │
│  │                                                          │   │
│  └──────────────────────────────────────────────────────────┘   │
│       │                                                         │
│       ▼ Generates client configs                               │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │        VPN Clients                                       │   │
│  │                                                          │   │
│  │  ┌─────────────┐ ┌─────────────┐ ┌─────────────┐        │   │
│  │  │ Phone-1     │ │ Yealink-T58│ │ User-Laptop │        │   │
│  │  │ 10.8.0.2    │ │ 10.8.0.3   │ │ 10.8.0.50   │        │   │
│  │  │ ● Connected │ │ ● Connected│ │ ○ Offline   │        │   │
│  │  └─────────────┘ └─────────────┘ └─────────────┘        │   │
│  │                                                          │   │
│  └──────────────────────────────────────────────────────────┘   │
│       │                                                         │
│       ▼ Remote phones connect                                  │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │        Remote Access                                     │   │
│  │                                                          │   │
│  │   Internet → VPN Tunnel → PBX → SIP Registration        │   │
│  │                                                          │   │
│  └──────────────────────────────────────────────────────────┘   │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Key Tables

TablePurpose
public.openvpn_configServer configuration
public.openvpn_clientsClient certificates

Key Files

FileDescription
modules/openvpn/Frontend module
/etc/openvpn/server.confServer config
/etc/openvpn/easy-rsa/PKI infrastructure
---

2. Module Overview (Commercial/Business)

Business Value

OpenVPN Server provides secure remote access:

Without VPNWith VPN
Port forward SIPEncrypted tunnel
NAT issuesDirect access
Exposed portsSecured network
SIP attacksProtected

Use Cases

  1. Remote Phones

- Home office phones

- Branch office devices

  1. Softphone Access

- Mobile workers

- Traveling users

  1. Secure Administration

- Remote management

- SSH over VPN

  1. Phone Provisioning

- IP phones with VPN

- Grandstream, Yealink, Fanvil

Feature Highlights

FeatureBenefit
Easy ClientsOne-click certificate generation
Phone FormatsGrandstream, Yealink, Fanvil support
Fixed IPsAssign specific IPs to clients
Certificate RevocationInstantly disable access
Traffic EncryptionAES-256 protection
Status MonitoringSee connected clients
---

3. Module Overview (End User/Administrator)

What Can You Do?

  • Enable/disable VPN server
  • Configure server settings
  • Create client certificates
  • Download client configurations
  • Assign fixed IP addresses
  • Monitor connected clients
  • Revoke client certificates
  • Choose phone-specific formats

OpenVPN Server - Global Settings Tab

Plaintext
┌─────────────────────────────────────────────────────────────────┐
│              OpenVPN Server                                     │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Manage VPN server and client certificates                     │
│                                                                 │
│  [Global Settings] [Clients]                                    │
│                                                                 │
│  ▼ Server Settings                                              │
│    Basic server configuration                                   │
│                                                                 │
│  ┌─────────────────────────────────────────────────────────────┐│
│  │                                                             ││
│  │  Enabled: ✓                                                ││
│  │                                                             ││
│  │  Public Host: [vpn.company.com          ]                  ││
│  │    Public IP or hostname that clients connect to           ││
│  │                                                             ││
│  │  Server Port: [1194         ]   Protocol: [UDP ▼]          ││
│  │                                                             ││
│  │  Device Type: [TUN ▼]                                      ││
│  │    TUN for routing, TAP for bridging                        ││
│  │                                                             ││
│  └─────────────────────────────────────────────────────────────┘│
│                                                                 │
│  ▼ Network Settings                                             │
│    VPN network configuration                                    │
│                                                                 │
│  ┌─────────────────────────────────────────────────────────────┐│
│  │                                                             ││
│  │  VPN Subnet: [10.8.0.0              ]                      ││
│  │  VPN Netmask: [255.255.255.0        ]                      ││
│  │                                                             ││
│  │  DNS Server 1: [8.8.8.8             ]                      ││
│  │  DNS Server 2: [8.8.4.4             ]                      ││
│  │                                                             ││
│  └─────────────────────────────────────────────────────────────┘│
│                                                                 │
│  ▼ Security Settings                                            │
│    Encryption and authentication                                │
│                                                                 │
│  ┌─────────────────────────────────────────────────────────────┐│
│  │                                                             ││
│  │  Cipher: [AES-256-GCM ▼]                                   ││
│  │  Auth Algorithm: [SHA256 ▼]                                ││
│  │  TLS Min Version: [1.2 ▼]                                  ││
│  │                                                             ││
│  └─────────────────────────────────────────────────────────────┘│
│                                                                 │
│  ▼ Advanced Settings                                            │
│    Performance and limits                                       │
│                                                                 │
│  ┌─────────────────────────────────────────────────────────────┐│
│  │                                                             ││
│  │  Keepalive Interval: [10          ] seconds                ││
│  │  Keepalive Timeout: [120          ] seconds                ││
│  │  Max Clients: [100                ]                        ││
│  │  Compression: [Disabled (Recommended) ▼]                   ││
│  │                                                             ││
│  └─────────────────────────────────────────────────────────────┘│
│                                                                 │
│  [Save Configuration]                                           │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

OpenVPN Server - Clients Tab

Plaintext
┌─────────────────────────────────────────────────────────────────┐
│              OpenVPN Server                                     │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  [Global Settings] [Clients]                                    │
│                                                                 │
│  VPN Clients - Manage client certificates                       │
│                                                                 │
│  [+ Add Client]                                                 │
│                                                                 │
│  ┌───────────────────────────────────────────────────────────┐  │
│  │ Name      │ Format    │ Virtual IP│ Real IP   │ Status  │   │
│  ├───────────┼───────────┼───────────┼───────────┼─────────┤   │
│  │ homephone │ Yealink   │ 10.8.0.2  │ 74.x.x.12 │● Connected│  │
│  │ office-gxp│ Grandstream│10.8.0.3  │ 98.x.x.44 │● Connected│  │
│  │ user-vpn  │ Generic   │ 10.8.0.50 │ -         │○ Offline │   │
│  │ revoked-1 │ Generic   │ -         │ -         │⊘ Revoked │   │
│  └───────────────────────────────────────────────────────────┘  │
│                                                                 │
│  Actions: [⬇️ Download] [🔒 Revoke] [🗑️ Delete]                 │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Create VPN Client Modal

Plaintext
┌─────────────────────────────────────────────────────────────────┐
│              Create VPN Client                                  │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Client Name: [homephone                     ]                 │
│    Letters, numbers, hyphens, and underscores only             │
│                                                                 │
│  Format: [Yealink ▼]                                           │
│    Generic | Grandstream | Yealink | Fanvil                    │
│    Select based on device type                                  │
│                                                                 │
│  Fixed IP Address: [10.8.0.50                ]                 │
│    (Optional) Leave empty for automatic assignment             │
│                                                                 │
│  [Create] [Cancel]                                              │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Quick Tips

TIP
Phone Format: Select the correct format for phone-specific configs.
TIP
Fixed IP: Assign fixed IPs for consistent firewall rules.
WARNING
Revoke is Permanent: Revoked certificates cannot be restored.

---

4. Configuration Sections

Server Settings

FieldDescription
EnabledServer on/off
Public HostExternal hostname/IP
Server PortVPN port (default 1194)
ProtocolUDP (recommended) or TCP
Device TypeTUN (routing) or TAP (bridging)

Network Settings

FieldDescription
VPN SubnetClient IP range
VPN NetmaskSubnet mask
DNS Server 1Primary DNS
DNS Server 2Secondary DNS

Security Settings

FieldDescription
CipherEncryption algorithm
Auth AlgorithmHMAC authentication
TLS Min VersionMinimum TLS version

Advanced Settings

FieldDescription
Keepalive IntervalPing interval (seconds)
Keepalive TimeoutConnection timeout
Max ClientsConcurrent limit
CompressionTraffic compression
---

5. Settings Reference

Protocols

ProtocolDescriptionUse Case
UDPFaster, recommendedMost deployments
TCPReliable, slowerFirewall restrictions

Device Types

TypeDescriptionUse Case
TUNLayer 3, routingStandard VPN
TAPLayer 2, bridgingLAN extension

Cipher Options

CipherSecurityPerformance
AES-256-GCMHighestGood
AES-128-GCMHighBetter
AES-256-CBCHighGood

Compression Options

OptionDescription
DisabledRecommended (secure)
LZ4-v2Fast compression
LZ4Standard LZ4
LZOLegacy compression

Client Formats

FormatDeviceNotes
GenericStandard clientsOpenVPN format
GrandstreamGXP, GRP phonesPhone-specific
YealinkT4x, T5x phonesPhone-specific
FanvilX series phonesPhone-specific
---

6. Common Scenarios & Examples

Scenario 1: Enable VPN Server

  1. Go to Global Settings
  2. Enable = ✓
  3. Public Host = vpn.company.com
  4. Port = 1194, Protocol = UDP
  5. VPN Subnet = 10.8.0.0
  6. Cipher = AES-256-GCM
  7. Save Configuration

Scenario 2: Create Phone Client

  1. Go to Clients tab
  2. Click Add Client
  3. Name = "homephone"
  4. Format = Yealink
  5. Fixed IP = (leave empty)
  6. Create
  7. Download configuration
  8. Upload to phone

Scenario 3: Assign Fixed IP

  1. Add Client
  2. Name = "admin-vpn"
  3. Format = Generic
  4. Fixed IP = 10.8.0.50
  5. Create
  6. Use for consistent access rules

Scenario 4: Revoke Compromised Client

  1. Go to Clients tab
  2. Find compromised client
  3. Click Revoke
  4. Confirm action
  5. Client immediately disconnected
  6. Cannot reconnect

---

7. Limitations & Important Notes

Technical Notes

NOTE
Port 1194: Default OpenVPN port, open in firewall.
NOTE
Public Host: Must be accessible from internet.
WARNING
Compression: Disabled recommended for security (VORACLE attack).

Best Practices

  1. Use UDP: Better performance for VoIP
  2. Strong Cipher: AES-256-GCM recommended
  3. Unique Names: Descriptive client names
  4. Revoke Promptly: Disable lost devices immediately
  5. Fixed IPs: For devices needing firewall rules

Client Name Rules

RuleValidInvalid
Lettershomephonehome phone
Numbersphone123-
Hyphenshome-phone-
Underscoreshome_phone-
Spaces-home phone
Special-phone@home
---

8. Troubleshooting Tips

Common Issues

SymptomPossible CauseSolution
Can't connectPort blockedOpen 1194/UDP
Connection dropsTimeout too shortIncrease keepalive
Wrong formatWrong phone typeRegenerate config
Access deniedRevoked certCreate new client

Check Server Status

Bash
# Check OpenVPN service
systemctl status openvpn@server

# View connected clients
cat /var/log/openvpn/openvpn-status.log

# Check server log
tail -f /var/log/openvpn/openvpn.log

Test Connection

Bash
# Test port connectivity
nc -zvu vpn.company.com 1194

# Connect with client
openvpn --config client.ovpn

# Check assigned IP
ip addr show tun0

---

9. Glossary

TermDefinition
VPNVirtual Private Network
TUNNetwork tunnel device
TAPNetwork tap device
PKIPublic Key Infrastructure
CertificateClient identity
RevokeInvalidate certificate
---

Lua Script Status ℹ️

Infrastructure Module

ComponentStatus
OpenVPN Serverℹ️ VPN management - no Lua handler required
OpenVPN Server is an infrastructure configuration module. It manages VPN server settings and client certificates. No Lua handlers are used - VPN configuration is applied to OpenVPN by the backend service.

---

Documentation last updated: January 2026
AI Assistant

👋 Hello! I'm your Ring2All documentation assistant. I can help you find information about configuring and using the Ring2All PBX platform.

How can I help you today?