Configuration files versus the command line

Most recipes in this book can be carried out without using configuration files. However, in most real-life cases, a configuration file is much easier to use than a lengthy command line. It is important to know that OpenVPN actually treats configuration file entries and command-line parameters identically. The only difference is that all command-line parameters start with a double dash (--) whereas the configuration file entries do not. This makes it very easy to overrule the configuration file entries using an extra command-line parameter.

Getting ready

Install OpenVPN 2.3.9 or higher on two computers. Make sure the computers are connected over a network. For this recipe, the server computer was running CentOS 6 Linux and OpenVPN 2.3.9 and the client was running Windows 7 64 bit and OpenVPN 2.3.10. In this recipe, we'll use the secret.key file from the OpenVPN secret keys recipe.

How to do it...

1. Create a configuration file based on an earlier recipe:

          dev tun
          port 1194
          ifconfig 10.200.0.1 10.200.0.2
          secret secret.key 
          remote openvpnserver.example.com
          verb 3
   

2. Save this file as example1-6-client.conf.
3. Launch the server-side (listening) OpenVPN process on a non-standard port:

             [root@server]# openvpn \
               --ifconfig 10.200.0.1 10.200.0.2 \
               --dev tun --secret secret.key \
               --port 11000
   

4. Then launch the client-side OpenVPN process and add an extra command-line parameter:

             [WinClient] C:\>"\Program Files\OpenVPN\bin\openvpn.exe" \
               --config client.conf \
               --port 11000
   

The connection is established:

Jan 11 16:14:04 2016 UDPv4 link local (bound): [undef]
Jan 11 16:14:04 2016 UDPv4 link remote: [AF_INET]172.16.8.1:11000
Jan 11 16:14:06 2016 Peer Connection Initiated with [AF_INET]172.16.8.1:11000
Jan 11 16:14:12 2016 TEST ROUTES: 0/0 succeeded len=0 ret=1 a=0 u/d=up
Jan 11 16:14:12 2016 Initialization Sequence Completed

How it works...

The command line and the configuration file are read and parsed from left to right and top to bottom. This means that most options that are specified before the configuration file can be overruled by the entries in that file. Similarly, the options specified after the following directive overrule the entries in that file:

--config client.conf

Hence, the following option overruled the line "port 1194" from the configuration file:

--port 11000

However, some options can be specified multiple times, in which case, the first occurrence "wins." In such a case, it is also possible to specify the option before specifying the --config directive.

There's more...

Here is another example that shows the importance of the ordering of the command-line parameters:

C:\>"\Program Files\OpenVPN\bin\openvpn.exe" \
    --verb 0 \
    --config client.conf \
    --port 11000

This produces the exact same connection log as shown before. The verb 3 command from the client.conf configuration file overruled --verb 0, as specified on the command line. However, refer to the following command line:

C:\>"\Program Files\OpenVPN\bin\openvpn.exe" \
    --config client.conf \
    --port 11000 \
    --verb 0

Using this command line, the connection log will remain entirely empty, yet the VPN connection will be in functioning mode.

Exceptions to the rule

Some of the newer features of OpenVPN deviate slightly from this principle, most notably the <connection> blocks and the inline certificates. Some people prefer to write the following command:

remote openvpnserver.example.com 1194

They prefer this instead of the following command:

port 1194
remote openvpnserver.example.com

The downside of this notation is that this is translated as a connection block by OpenVPN. For connection blocks, it is not possible to overrule the port using --port 11000.