vpn_openvpn_server.php 86.5 KB
Newer Older
1
<?php
2

Ad Schellevis's avatar
Ad Schellevis committed
3
/*
4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
    Copyright (C) 2014-2015 Deciso B.V.
    Copyright (C) 2008 Shrew Soft Inc.
    All rights reserved.

    Redistribution and use in source and binary forms, with or without
    modification, are permitted provided that the following conditions are met:

    1. Redistributions of source code must retain the above copyright notice,
       this list of conditions and the following disclaimer.

    2. Redistributions in binary form must reproduce the above copyright
       notice, this list of conditions and the following disclaimer in the
       documentation and/or other materials provided with the distribution.

    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
    POSSIBILITY OF SUCH DAMAGE.
Ad Schellevis's avatar
Ad Schellevis committed
28
*/
29

30
require_once("guiconfig.inc");
Ad Schellevis's avatar
Ad Schellevis committed
31
require_once("openvpn.inc");
32
require_once("services.inc");
33
require_once("interfaces.inc");
Ad Schellevis's avatar
Ad Schellevis committed
34

35
if (!isset($config['openvpn']['openvpn-server'])) {
36 37
    $config['openvpn']['openvpn-server'] = array();
}
Ad Schellevis's avatar
Ad Schellevis committed
38 39
$a_server = &$config['openvpn']['openvpn-server'];

40 41
$act = null;
if ($_SERVER['REQUEST_METHOD'] === 'GET') {
42
    // fetch id if provided
43 44 45 46 47 48 49
    if (isset($_GET['id']) && is_numericint($_GET['id'])) {
        $id = $_GET['id'];
    }
    if (isset($_GET['act'])) {
        $act = $_GET['act'];
    }
    $pconfig = array();
50
    // defaults
51 52 53 54 55 56 57 58 59
    $vpnid = 0;
    $pconfig['verbosity_level'] = 1;
    $pconfig['digest'] = "SHA1"; // OpenVPN Defaults to SHA1 if unset
    $pconfig['autokey_enable'] = "yes";
    $pconfig['autotls_enable'] = "yes";
    if ($act == "edit" && isset($id) && isset($a_server[$id])) {
        if ($a_server[$id]['mode'] != "p2p_shared_key") {
            $pconfig['cert_depth'] = 1;
        }
Ad Schellevis's avatar
Ad Schellevis committed
60

61 62
        // 1 on 1 copy of config attributes
        $copy_fields = "mode,protocol,authmode,dev_mode,interface,local_port
63 64 65 66 67 68 69 70 71 72
            ,description,custom_options,crypto,engine,tunnel_network
            ,tunnel_networkv6,remote_network,remote_networkv6,gwredir,local_network
            ,local_networkv6,maxclients,compression,passtos,client2client
            ,dynamic_ip,pool_enable,topology_subnet,serverbridge_dhcp
            ,serverbridge_interface,serverbridge_dhcp_start,serverbridge_dhcp_end
            ,dns_server1,dns_server2,dns_server3,dns_server4,ntp_server1
            ,ntp_server2,netbios_enable,netbios_ntype,netbios_scope,wins_server1
            ,wins_server2,no_tun_ipv6,push_register_dns,dns_domain
            ,client_mgmt_port,verbosity_level,caref,crlref,certref,dh_length
            ,cert_depth,strictusercn,digest,disable,duplicate_cn,vpnid";
Ad Schellevis's avatar
Ad Schellevis committed
73

74 75 76 77 78 79 80 81
        foreach (explode(",", $copy_fields) as $fieldname) {
            $fieldname = trim($fieldname);
            if (isset($a_server[$id][$fieldname])) {
                $pconfig[$fieldname] = $a_server[$id][$fieldname];
            } elseif (!isset($pconfig[$fieldname])) {
              // initialize element
                $pconfig[$fieldname] = null;
            }
Ad Schellevis's avatar
Ad Schellevis committed
82 83
        }

84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109
        // load / convert
        if (!empty($a_server[$id]['ipaddr'])) {
            $pconfig['interface'] = $pconfig['interface'] . '|' . $a_server[$id]['ipaddr'];
        }
        if (!empty($a_server[$id]['shared_key'])) {
            $pconfig['shared_key'] = base64_decode($a_server[$id]['shared_key']);
        } else {
            $pconfig['shared_key'] = null;
        }
        if (!empty($a_server[$id]['tls'])) {
            $pconfig['tlsauth_enable'] = "yes";
            $pconfig['tls'] = base64_decode($a_server[$id]['tls']);
        } else {
            $pconfig['tls'] = null;
            $pconfig['tlsauth_enable'] = null;
        }
    } elseif ($act == "new") {
        $pconfig['tlsauth_enable'] = "yes";
        $pconfig['dh_length'] = 1024;
        $pconfig['dev_mode'] = "tun";
        $pconfig['interface'] = "wan";
        $pconfig['local_port'] = openvpn_port_next('UDP');
        $pconfig['pool_enable'] = "yes";
        $pconfig['cert_depth'] = 1;
        // init all fields used in the form
        $init_fields = "mode,protocol,authmode,dev_mode,interface,local_port
110 111 112 113 114 115 116 117 118 119
            ,description,custom_options,crypto,engine,tunnel_network
            ,tunnel_networkv6,remote_network,remote_networkv6,gwredir,local_network
            ,local_networkv6,maxclients,compression,passtos,client2client
            ,dynamic_ip,pool_enable,topology_subnet,serverbridge_dhcp
            ,serverbridge_interface,serverbridge_dhcp_start,serverbridge_dhcp_end
            ,dns_server1,dns_server2,dns_server3,dns_server4,ntp_server1
            ,ntp_server2,netbios_enable,netbios_ntype,netbios_scope,wins_server1
            ,wins_server2,no_tun_ipv6,push_register_dns,dns_domain
            ,client_mgmt_port,verbosity_level,caref,crlref,certref,dh_length
            ,cert_depth,strictusercn,digest,disable,duplicate_cn,vpnid,shared_key,tls";
120 121 122 123 124
        foreach (explode(",", $init_fields) as $fieldname) {
            $fieldname = trim($fieldname);
            if (!isset($pconfig[$fieldname])) {
                $pconfig[$fieldname] = null;
            }
Ad Schellevis's avatar
Ad Schellevis committed
125 126
        }

127
    }
128
} elseif ($_SERVER['REQUEST_METHOD'] === 'POST') {
129
    if (isset($_POST['id']) && isset($a_server[$_POST['id']])) {
Ad Schellevis's avatar
Ad Schellevis committed
130 131 132 133 134 135 136 137
        $id = $_POST['id'];
    }
    if (isset($_POST['act'])) {
        $act = $_POST['act'];
    }

    if ($act == "del") {
        // action delete
138
        if (isset($a_server[$id])) {
Ad Schellevis's avatar
Ad Schellevis committed
139
            openvpn_delete('server', $a_server[$id]);
140 141 142 143 144 145 146 147 148 149 150 151 152 153
            unset($a_server[$id]);
            write_config();
        }
        header("Location: vpn_openvpn_server.php");
        exit;
    } elseif ($act == "toggle") {
        if (isset($id)) {
            if (isset($a_server[$id]['disable'])) {
                unset($a_server[$id]['disable']);
            } else {
                $a_server[$id]['disable'] = true;
            }
            openvpn_resync('server', $a_server[$id]);
            write_config();
Ad Schellevis's avatar
Ad Schellevis committed
154
        }
155 156
        header("Location: vpn_openvpn_server.php");
        exit;
Ad Schellevis's avatar
Ad Schellevis committed
157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176
    } else {
        // action add/update
        $input_errors = array();
        $pconfig = $_POST;

        if (isset($id) && $a_server[$id]) {
            $vpnid = $a_server[$id]['vpnid'];
        } else {
            $vpnid = 0;
        }
        if ($pconfig['mode'] != "p2p_shared_key") {
            $tls_mode = true;
        } else {
            $tls_mode = false;
        }
        if (!empty($pconfig['autokey_enable'])) {
            $pconfig['shared_key'] = openvpn_create_key();
        }

        // all input validators
177 178
        if (strpos($pconfig['interface'], '|') !== false) {
            list($iv_iface, $iv_ip) = explode("|", $pconfig['interface']);
Ad Schellevis's avatar
Ad Schellevis committed
179
        } else {
180 181
            $iv_iface = $pconfig['interface'];
            $iv_ip = null;
Ad Schellevis's avatar
Ad Schellevis committed
182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332
        }

        if (is_ipaddrv4($iv_ip) && (stristr($pconfig['protocol'], "6") !== false)) {
            $input_errors[] = gettext("Protocol and IP address families do not match. You cannot select an IPv6 protocol and an IPv4 IP address.");
        } elseif (is_ipaddrv6($iv_ip) && (stristr($pconfig['protocol'], "6") === false)) {
            $input_errors[] = gettext("Protocol and IP address families do not match. You cannot select an IPv4 protocol and an IPv6 IP address.");
        } elseif ((stristr($pconfig['protocol'], "6") === false) && !get_interface_ip($iv_iface) && ($pconfig['interface'] != "any")) {
            $input_errors[] = gettext("An IPv4 protocol was selected, but the selected interface has no IPv4 address.");
        } elseif ((stristr($pconfig['protocol'], "6") !== false) && !get_interface_ipv6($iv_iface) && ($pconfig['interface'] != "any")) {
            $input_errors[] = gettext("An IPv6 protocol was selected, but the selected interface has no IPv6 address.");
        }

        if (empty($pconfig['authmode']) && (($pconfig['mode'] == "server_user") || ($pconfig['mode'] == "server_tls_user"))) {
            $input_errors[] = gettext("You must select a Backend for Authentication if the server mode requires User Auth.");
        }

        if ($result = openvpn_validate_port($pconfig['local_port'], 'Local port')) {
            $input_errors[] = $result;
        }

        if ($result = openvpn_validate_cidr($pconfig['tunnel_network'], 'IPv4 Tunnel Network', false, "ipv4")) {
            $input_errors[] = $result;
        }

        if ($result = openvpn_validate_cidr($pconfig['tunnel_networkv6'], 'IPv6 Tunnel Network', false, "ipv6")) {
            $input_errors[] = $result;
        }

        if ($result = openvpn_validate_cidr($pconfig['remote_network'], 'IPv4 Remote Network', true, "ipv4")) {
            $input_errors[] = $result;
        }

        if ($result = openvpn_validate_cidr($pconfig['remote_networkv6'], 'IPv6 Remote Network', true, "ipv6")) {
            $input_errors[] = $result;
        }

        if ($result = openvpn_validate_cidr($pconfig['local_network'], 'IPv4 Local Network', true, "ipv4")) {
            $input_errors[] = $result;
        }

        if ($result = openvpn_validate_cidr($pconfig['local_networkv6'], 'IPv6 Local Network', true, "ipv6")) {
            $input_errors[] = $result;
        }

        $portused = openvpn_port_used($pconfig['protocol'], $pconfig['interface'], $pconfig['local_port'], $vpnid);
        if (($portused != $vpnid) && ($portused != 0)) {
            $input_errors[] = gettext("The specified 'Local port' is in use. Please select another value");
        }

        if (!$tls_mode && empty($pconfig['autokey_enable'])) {
            if (!strstr($pconfig['shared_key'], "-----BEGIN OpenVPN Static key V1-----") ||
                !strstr($pconfig['shared_key'], "-----END OpenVPN Static key V1-----")) {
                $input_errors[] = gettext("The field 'Shared Key' does not appear to be valid");
            }
        }

        if ($tls_mode && !empty($pconfig['tlsauth_enable']) && empty($pconfig['autotls_enable'])) {
            if (!strstr($pconfig['tls'], "-----BEGIN OpenVPN Static key V1-----") ||
                !strstr($pconfig['tls'], "-----END OpenVPN Static key V1-----")) {
                $input_errors[] = gettext("The field 'TLS Authentication Key' does not appear to be valid");
            }
        }

        if (!empty($pconfig['dns_server1']) && !is_ipaddr(trim($pconfig['dns_server1']))) {
            $input_errors[] = gettext("The field 'DNS Server #1' must contain a valid IP address");
        }
        if (!empty($pconfig['dns_server2']) && !is_ipaddr(trim($pconfig['dns_server2']))) {
            $input_errors[] = gettext("The field 'DNS Server #2' must contain a valid IP address");
        }
        if (!empty($pconfig['dns_server3']) && !is_ipaddr(trim($pconfig['dns_server3']))) {
            $input_errors[] = gettext("The field 'DNS Server #3' must contain a valid IP address");
        }
        if (!empty($pconfig['dns_server4']) && !is_ipaddr(trim($pconfig['dns_server4']))) {
            $input_errors[] = gettext("The field 'DNS Server #4' must contain a valid IP address");
        }

        if (!empty($pconfig['ntp_server1']) && !is_ipaddr(trim($pconfig['ntp_server1']))) {
            $input_errors[] = gettext("The field 'NTP Server #1' must contain a valid IP address");
        }
        if (!empty($pconfig['ntp_server2']) && !is_ipaddr(trim($pconfig['ntp_server2']))) {
            $input_errors[] = gettext("The field 'NTP Server #2' must contain a valid IP address");
        }
        if (!empty($pconfig['ntp_server3']) && !is_ipaddr(trim($pconfig['ntp_server3']))) {
            $input_errors[] = gettext("The field 'NTP Server #3' must contain a valid IP address");
        }
        if (!empty($pconfig['ntp_server4']) && !is_ipaddr(trim($pconfig['ntp_server4']))) {
            $input_errors[] = gettext("The field 'NTP Server #4' must contain a valid IP address");
        }

        if (!empty($pconfig['wins_server_enable'])) {
            if (!empty($pconfig['wins_server1']) && !is_ipaddr(trim($pconfig['wins_server1']))) {
                $input_errors[] = gettext("The field 'WINS Server #1' must contain a valid IP address");
            }
            if (!empty($pconfig['wins_server2']) && !is_ipaddr(trim($pconfig['wins_server2']))) {
                $input_errors[] = gettext("The field 'WINS Server #2' must contain a valid IP address");
            }
        }

        if (!empty($pconfig['client_mgmt_port_enable'])) {
            if ($result = openvpn_validate_port($pconfig['client_mgmt_port'], 'Client management port')) {
                $input_errors[] = $result;
            }
        }

        if (!empty($pconfig['maxclients']) && !is_numeric($pconfig['maxclients'])) {
            $input_errors[] = gettext("The field 'Concurrent connections' must be numeric.");
        }

        /* If we are not in shared key mode, then we need the CA/Cert. */
        if (isset($pconfig['mode']) && $pconfig['mode'] != "p2p_shared_key") {
            $reqdfields = explode(" ", "caref certref");
            $reqdfieldsn = array(gettext("Certificate Authority"),gettext("Certificate"));
        } elseif (empty($pconfig['autokey_enable'])) {
            /* We only need the shared key filled in if we are in shared key mode and autokey is not selected. */
            $reqdfields = array('shared_key');
            $reqdfieldsn = array(gettext('Shared key'));
        }

        if ($pconfig['dev_mode'] != "tap") {
            $reqdfields[] = 'tunnel_network';
            $reqdfieldsn[] = gettext('Tunnel network');
        } else {
            if ($pconfig['serverbridge_dhcp'] && $pconfig['tunnel_network']) {
                $input_errors[] = gettext("Using a tunnel network and server bridge settings together is not allowed.");
            }
            if (($pconfig['serverbridge_dhcp_start'] && !$pconfig['serverbridge_dhcp_end'])
            || (!$pconfig['serverbridge_dhcp_start'] && $pconfig['serverbridge_dhcp_end'])) {
                $input_errors[] = gettext("Server Bridge DHCP Start and End must both be empty, or defined.");
            }
            if (($pconfig['serverbridge_dhcp_start'] && !is_ipaddrv4($pconfig['serverbridge_dhcp_start']))) {
                $input_errors[] = gettext("Server Bridge DHCP Start must be an IPv4 address.");
            }
            if (($pconfig['serverbridge_dhcp_end'] && !is_ipaddrv4($pconfig['serverbridge_dhcp_end']))) {
                $input_errors[] = gettext("Server Bridge DHCP End must be an IPv4 address.");
            }
            if (ip2ulong($pconfig['serverbridge_dhcp_start']) > ip2ulong($pconfig['serverbridge_dhcp_end'])) {
                $input_errors[] = gettext("The Server Bridge DHCP range is invalid (start higher than end).");
            }
        }
        do_input_validation($pconfig, $reqdfields, $reqdfieldsn, $input_errors);

        if (count($input_errors) == 0) {
            // validation correct, save data
            $server = array();

            // delete(rename) old interface so a new TUN or TAP interface can be created.
            if (isset($id) && $pconfig['dev_mode'] <> $a_server[$id]['dev_mode']) {
                openvpn_delete('server', $a_server[$id]);
            }
            // 1 on 1 copy of config attributes
            $copy_fields = "mode,protocol,dev_mode,local_port,description,crypto,digest,engine
333 334 335 336 337 338 339 340
                ,tunnel_network,tunnel_networkv6,remote_network,remote_networkv6
                ,gwredir,local_network,local_networkv6,maxclients,compression
                ,passtos,client2client,dynamic_ip,pool_enable,topology_subnet
                ,serverbridge_dhcp,serverbridge_interface,serverbridge_dhcp_start
                ,serverbridge_dhcp_end,dns_domain,dns_server1,dns_server2,dns_server3
                ,dns_server4,push_register_dns,ntp_server1,ntp_server2,netbios_enable
                ,netbios_ntype,netbios_scope,no_tun_ipv6,verbosity_level,wins_server1
                ,wins_server2,client_mgmt_port,strictusercn";
Ad Schellevis's avatar
Ad Schellevis committed
341

342 343 344 345 346
            foreach (explode(",", $copy_fields) as $fieldname) {
                $fieldname = trim($fieldname);
                if (!empty($pconfig[$fieldname])) {
                    $server[$fieldname] = $pconfig[$fieldname];
                }
Ad Schellevis's avatar
Ad Schellevis committed
347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362
            }

            // attributes containing some kind of logic
            if ($vpnid != 0) {
                $server['vpnid'] = $vpnid;
            } else {
                $server['vpnid'] = openvpn_vpnid_next();
            }

            if ($pconfig['disable'] == "yes") {
                $server['disable'] = true;
            }
            if (!empty($pconfig['authmode'])) {
                $server['authmode'] = implode(",", $pconfig['authmode']);
            }
            if (strpos($pconfig['interface'], "|") !== false) {
363
                list($server['interface'], $server['ipaddr']) = explode("|", $pconfig['interface']);
364 365
            } else {
                $server['interface'] = $pconfig['interface'];
Ad Schellevis's avatar
Ad Schellevis committed
366 367 368 369 370 371 372 373 374 375 376 377 378
            }

            $server['custom_options'] = str_replace("\r\n", "\n", $pconfig['custom_options']);

            if ($tls_mode) {
                if ($pconfig['tlsauth_enable']) {
                    if (!empty($pconfig['autotls_enable'])) {
                        $pconfig['tls'] = openvpn_create_key();
                    }
                    $server['tls'] = base64_encode($pconfig['tls']);
                }
                foreach (array("caref","crlref",
                      "certref","dh_length","cert_depth") as $cpKey) {
379 380 381
                    if (isset($pconfig[$cpKey])) {
                        $server[$cpKey] = $pconfig[$cpKey];
                    }
Ad Schellevis's avatar
Ad Schellevis committed
382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402
                }
                if (isset($pconfig['mode']) && $pconfig['mode'] == "server_tls_user" && isset($server['strictusercn'])) {
                    $server['strictusercn'] = $pconfig['strictusercn'];
                }
            } else {
                $server['shared_key'] = base64_encode($pconfig['shared_key']);
            }

            if (isset($_POST['duplicate_cn']) && $_POST['duplicate_cn'] == "yes") {
                $server['duplicate_cn'] = true;
            }

            // update or add to config
            if (isset($id) && $a_server[$id]) {
                $a_server[$id] = $server;
            } else {
                $a_server[] = $server;
            }

            openvpn_resync('server', $server);
            write_config();
403
            openvpn_resync_csc(); // dump client specific overrides, the required set may have changed
Ad Schellevis's avatar
Ad Schellevis committed
404 405 406 407 408 409 410

            header("Location: vpn_openvpn_server.php");
            exit;
        } elseif (!empty($pconfig['authmode'])) {
            $pconfig['authmode'] = implode(",", $pconfig['authmode']);
        }
    }
Ad Schellevis's avatar
Ad Schellevis committed
411
}
412

Ad Schellevis's avatar
Ad Schellevis committed
413 414
include("head.inc");

Ad Schellevis's avatar
Ad Schellevis committed
415
$main_buttons = array(
416
    array('href'=>'vpn_openvpn_server.php?act=new', 'label'=>gettext("add server")),
Ad Schellevis's avatar
Ad Schellevis committed
417 418
);

419
legacy_html_escape_form_data($pconfig);
420

Ad Schellevis's avatar
Ad Schellevis committed
421 422
?>

423
<body>
Ad Schellevis's avatar
Ad Schellevis committed
424 425
<?php include("fbegin.inc"); ?>
<script type="text/javascript">
426
$( document ).ready(function() {
427 428
  // watch scroll position and set to last known on page load
  watchScrollPosition();
Ad Schellevis's avatar
Ad Schellevis committed
429 430 431 432
  // link delete buttons
  $(".act_delete").click(function(){
    var id = $(this).attr("id").split('_').pop(-1);
    BootstrapDialog.show({
Fabian Franz's avatar
Fabian Franz committed
433
        type:BootstrapDialog.TYPE_DANGER,
Ad Schellevis's avatar
Ad Schellevis committed
434 435 436
        title: "<?= gettext("OpenVPN");?>",
        message: "<?= gettext("Do you really want to delete this server?"); ?>",
        buttons: [{
437 438 439 440
                label: "<?= gettext("No");?>",
                action: function(dialogRef) {
                    dialogRef.close();
                }}, {
Ad Schellevis's avatar
Ad Schellevis committed
441 442 443 444 445 446 447
                  label: "<?= gettext("Yes");?>",
                  action: function(dialogRef) {
                    $.post(window.location, {act: 'del', id:id}, function(data) {
                          location.reload();
                    });
                    dialogRef.close();
                }
448
            }]
Ad Schellevis's avatar
Ad Schellevis committed
449 450
    });
  });
451 452

  // link toggle buttons
453 454
  $(".act_toggle").click(function(event){
      event.preventDefault();
455 456 457 458 459
      $.post(window.location, {act: 'toggle', id:$(this).data("id")}, function(data) {
          location.reload();
      });
  });

460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570
  // input form events
  if ($("#iform").length) {
      $("#mode,#gwredir").change(function(){
          $(".opt_mode").hide();
          $(".opt_mode_"+$("#mode").val()).show();
          if ($("#gwredir").is(":checked")) {
              $(".opt_gwredir").hide();
          }
          $("#dev_mode").change();
      });
      $("#mode").change();

      $("#dev_mode,#serverbridge_dhcp").change(function(){
          $(".dev_mode").hide();
          $(".dev_mode_"+$("#dev_mode").val()).show();
          if ($("#mode").val().indexOf('p2p_tls') == 0) {
              $("#serverbridge_dhcp").prop('disabled', true);
          } else {
              $("#serverbridge_dhcp").prop('disabled', false);
          }

          if ($("#mode").val().indexOf('p2p_tls') == 0 || $("#serverbridge_dhcp").is(':checked') == false) {
              $("#serverbridge_interface").prop('disabled', true);
              $("#serverbridge_dhcp_start").prop('disabled', true);
              $("#serverbridge_dhcp_end").prop('disabled', true);
          } else {
              $("#serverbridge_interface").prop('disabled', false);
              $("#serverbridge_dhcp_start").prop('disabled', false);
              $("#serverbridge_dhcp_end").prop('disabled', false);
          }
      });
      $("#dev_mode").change();

      $("#autokey_enable").change(function(){
          if ($("#autokey_enable").is(':checked')) {
              $("#autokey_opts").hide();
          } else {
              $("#autokey_opts").show();
          }
      });
      $("#autokey_enable").change();

      $("#tlsauth_enable,#autotls_enable").change(function(){
          if ($("#autotls_enable").is(':checked') || !$("#tlsauth_enable").is(':checked')) {
              $("#tls").parent().hide();
          } else {
              $("#tls").parent().show();
          }
          if ($("#tlsauth_enable").is(':checked')) {
              $("#autotls_enable").parent().show();
          } else {
              $("#autotls_enable").parent().hide();
          }
      });
      $("#tlsauth_enable").change();

      $("#dns_domain_enable").change(function(){
          if ($("#dns_domain_enable").is(':checked')) {
              $("#dns_domain_data").show();
          } else {
              $("#dns_domain_data").hide();
          }
      });
      $("#dns_domain_enable").change();

      $("#dns_server_enable").change(function(){
          if ($("#dns_server_enable").is(':checked')) {
              $("#dns_server_data").show();
          } else {
              $("#dns_server_data").hide();
          }
      });
      $("#dns_server_enable").change();

      $("#wins_server_enable").change(function(){
          if ($("#wins_server_enable").is(':checked')) {
              $("#wins_server_data").show();
          } else {
              $("#wins_server_data").hide();
          }
      });
      $("#wins_server_enable").change();

      $("#netbios_enable").change(function(){
          if ($("#netbios_enable").is(':checked')) {
              $("#wins_opts").show();
              $("#netbios_data").show();
          } else {
              $("#wins_opts").hide();
              $("#netbios_data").hide();
          }
      });
      $("#netbios_enable").change();

      $("#ntp_server_enable").change(function(){
          if ($("#ntp_server_enable").is(':checked')) {
              $("#ntp_server_data").show();
          } else {
              $("#ntp_server_data").hide();
          }
      });
      $("#ntp_server_enable").change();

      $("#client_mgmt_port_enable").change(function(){
          if ($("#client_mgmt_port_enable").is(':checked')) {
              $("#client_mgmt_port_data").show();
          } else {
              $("#client_mgmt_port_data").hide();
          }
      });
      $("#client_mgmt_port_enable").change();
Ad Schellevis's avatar
Ad Schellevis committed
571 572 573

  }

574
});
Ad Schellevis's avatar
Ad Schellevis committed
575 576
</script>

Ad Schellevis's avatar
Ad Schellevis committed
577 578 579
  <section class="page-content-main">
    <div class="container-fluid">
      <div class="row">
580
<?php
581 582 583 584
        if (isset($input_errors) && count($input_errors) > 0) {
            print_input_errors($input_errors);
        }
        if (isset($savemsg)) {
585
            print_info_box($savemsg);
586 587 588
        }?>
<?php
          if ($act=="new" || $act=="edit") :?>
589 590 591
          <form method="post" name="iform" id="iform">
            <section class="col-xs-12">
              <div class="tab-content content-box col-xs-12">
Ad Schellevis's avatar
Ad Schellevis committed
592
                <div class="table-responsive">
593
                  <table class="table table-striped opnsense_standard_table_form">
Ad Schellevis's avatar
Ad Schellevis committed
594
                    <tr>
595
                      <td width="22%"><strong><?=gettext("General information"); ?></strong></td>
Ad Schellevis's avatar
Ad Schellevis committed
596 597
                      <td width="78%" align="right">
                        <small><?=gettext("full help"); ?> </small>
Ad Schellevis's avatar
Ad Schellevis committed
598
                        <i class="fa fa-toggle-off text-danger"  style="cursor: pointer;" id="show_all_help_page" type="button"></i>
Ad Schellevis's avatar
Ad Schellevis committed
599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617
                      </td>
                    </tr>
                    <tr>
                      <td class="vncellreq">
                        <a id="help_for_disable" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a>
                        <b><?=gettext("Disabled"); ?></b>
                      </td>
                      <td>
                        <div>
                          <input name="disable" type="checkbox" value="yes" <?= !empty($pconfig['disable']) ? "checked=\"checked\"" : "";?> />
                        </div>
                        <div class="hidden" for="help_for_disable">
                        <?=gettext("Set this option to disable this server without removing it from the list"); ?>.
                        </div >
                      </td>
                    </tr>
                    <tr>
                      <td><i class="fa fa-info-circle text-muted"></i> <?=gettext("Server Mode");?></td>
                        <td>
618
                        <select name='mode' id="mode" class="form-control">
619 620 621 622 623 624 625
<?php
                      $openvpn_server_modes = array(
                        'p2p_tls' => gettext("Peer to Peer ( SSL/TLS )"),
                        'p2p_shared_key' => gettext("Peer to Peer ( Shared Key )"),
                        'server_tls' => gettext("Remote Access ( SSL/TLS )"),
                        'server_user' => gettext("Remote Access ( User Auth )"),
                        'server_tls_user' => gettext("Remote Access ( SSL/TLS + User Auth )"));
626 627 628 629
                        foreach ($openvpn_server_modes as $name => $desc) :
                            $selected = "";
                            if ($pconfig['mode'] == $name) {
                                $selected = "selected=\"selected\"";
630 631 632
                            }?>
                        <option value="<?=$name;?>" <?=$selected;?>><?=$desc;?></option>
<?php
633
                        endforeach; ?>
Ad Schellevis's avatar
Ad Schellevis committed
634 635 636
                        </select>
                      </td>
                    </tr>
637
                    <tr class="opt_mode opt_mode_server_user opt_mode_server_tls_user" style="display:none">
638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657
                      <td><i class="fa fa-info-circle text-muted"></i> <?=gettext("Backend for authentication");?></td>
                      <td>
                        <select name='authmode[]' id='authmode' class="form-control" multiple="multiple" size="5">
<?php
                        if (isset($pconfig['authmode'])) {
                            $authmodes = explode(",", $pconfig['authmode']);
                        } else {
                            $authmodes = array();
                        }
                        $auth_servers = auth_get_authserver_list();
                        foreach ($auth_servers as $auth_key => $auth_server) :
                                $selected = "";
                            if (in_array($auth_key, $authmodes)) {
                                    $selected = "selected=\"selected\"";
                            }?>
                            <option value="<?=htmlspecialchars($auth_key); ?>" <?=$selected; ?>><?=htmlspecialchars($auth_server['name']);?></option>
<?php
                        endforeach; ?>
                        </select>
                      </td>
658
                    </tr>
Ad Schellevis's avatar
Ad Schellevis committed
659 660 661
                    <tr>
                      <td><i class="fa fa-info-circle text-muted"></i> <?=gettext("Protocol");?></td>
                        <td>
662 663 664 665 666 667 668 669 670 671
                          <select name='protocol' class="form-control">
<?php
                          foreach (array("UDP", "UDP6", "TCP", "TCP6") as $prot) :
                              $selected = "";
                              if ($pconfig['protocol'] == $prot) {
                                  $selected = "selected=\"selected\"";
                              }?>
                            <option value="<?=$prot;?>" <?=$selected;?>><?=$prot;?></option>
<?php
                          endforeach; ?>
Ad Schellevis's avatar
Ad Schellevis committed
672
                        </select>
673
                      </td>
Ad Schellevis's avatar
Ad Schellevis committed
674 675 676 677
                    </tr>
                    <tr>
                      <td><i class="fa fa-info-circle text-muted"></i> <?=gettext("Device Mode"); ?></td>
                      <td>
678
                        <select name="dev_mode" id="dev_mode" class="form-control">
679 680 681 682 683 684 685 686 687 688 689 690 691 692 693
<?php
                        foreach (array("tun", "tap") as $device) :
                               $selected = "";
                            if (! empty($pconfig['dev_mode'])) {
                                if ($pconfig['dev_mode'] == $device) {
                                        $selected = "selected=\"selected\"";
                                }
                            } else {
                                if ($device == "tun") {
                                        $selected = "selected=\"selected\"";
                                }
                            }?>
                        <option value="<?=$device;?>" <?=$selected;?>><?=$device;?></option>
<?php
                        endforeach; ?>
694
                        </select>
Ad Schellevis's avatar
Ad Schellevis committed
695
                      </td>
696
                    </tr>
Ad Schellevis's avatar
Ad Schellevis committed
697 698 699 700
                    <tr>
                      <td><i class="fa fa-info-circle text-muted"></i> <?=gettext("Interface"); ?></td>
                      <td>
                        <select name="interface" class="form-control">
701 702 703 704 705 706 707 708 709 710 711 712 713 714
<?php
                        $interfaces = get_configured_interface_with_descr();
                        $carplist = get_configured_carp_interface_list();
                        foreach ($carplist as $cif => $carpip) {
                            $interfaces[$cif.'|'.$carpip] = $carpip." (".get_vip_descr($carpip).")";
                        }
                                                    $aliaslist = get_configured_ip_aliases_list();
                        foreach ($aliaslist as $aliasip => $aliasif) {
                            $interfaces[$aliasif.'|'.$aliasip] = $aliasip." (".get_vip_descr($aliasip).")";
                        }
                                                    $grouplist = return_gateway_groups_array();
                        foreach ($grouplist as $name => $group) {
                            if ($group['ipprotocol'] != inet) {
                                continue;
715
                            }
716 717 718 719
                            if ($group[0]['vip'] <> "") {
                                $vipif = $group[0]['vip'];
                            } else {
                                $vipif = $group[0]['int'];
720
                            }
721 722 723 724 725 726 727 728
                            $interfaces[$name] = "GW Group {$name}";
                        }
                        $interfaces['lo0'] = "Localhost";
                        $interfaces['any'] = "any";
                        foreach ($interfaces as $iface => $ifacename) :
                            $selected = '';
                            if ($iface == $pconfig['interface']) {
                                $selected = ' selected="selected"';
729
                            }
730 731 732 733
                        ?>
                          <option value="<?=$iface; ?>"<?=$selected;?>><?=htmlspecialchars($ifacename);?></option>
<?php
                        endforeach; ?>
Ad Schellevis's avatar
Ad Schellevis committed
734 735 736 737 738 739 740 741 742 743 744 745 746 747
                        </select> <br />
                      </td>
                    </tr>
                    <tr>
                      <td><i class="fa fa-info-circle text-muted"></i> <?=gettext("Local port");?></td>
                      <td>
                        <input name="local_port" type="text" class="form-control unknown" size="5" value="<?=$pconfig['local_port'];?>" />
                      </td>
                    </tr>
                    <tr>
                      <td width="22%" ><a id="help_for_description" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Description"); ?></td>
                      <td>
                        <input name="description" type="text" class="form-control unknown" size="30" value="<?=htmlspecialchars($pconfig['description']);?>" />
                        <div class="hidden" for="help_for_description">
748
                            <?=gettext("You may enter a description here for your reference (not parsed)"); ?>.
Ad Schellevis's avatar
Ad Schellevis committed
749 750 751
                        </div>
                      </td>
                    </tr>
752 753 754 755 756 757 758 759
                  </table>
                </div>
              </div>
            </section>
            <section class="col-xs-12">
              <div class="tab-content content-box col-xs-12">
                <div class="table-responsive">
                  <table class="table table-striped opnsense_standard_table_form">
Ad Schellevis's avatar
Ad Schellevis committed
760
                    <tr>
761
                      <td colspan="2"><strong><?=gettext("Cryptographic Settings"); ?></strong></td>
Ad Schellevis's avatar
Ad Schellevis committed
762
                    </tr>
763 764 765 766 767 768 769
                    <tr class="opt_mode opt_mode_p2p_tls opt_mode_server_tls opt_mode_server_user opt_mode_server_tls_user">
                      <td width="22%"><i class="fa fa-info-circle text-muted"></i> <?=gettext("TLS Authentication"); ?></td>
                      <td width="78%">
                        <div>
                          <input name="tlsauth_enable" id="tlsauth_enable" type="checkbox" value="yes" <?=!empty($pconfig['tlsauth_enable']) ? "checked=\"checked\"" : "" ;?>/>
                          <?=gettext("Enable authentication of TLS packets"); ?>.
                        </div>
Ad Schellevis's avatar
Ad Schellevis committed
770
                        <?php if (!$pconfig['tls']) :
771
?>
772 773 774 775
                        <div>
                          <input name="autotls_enable" id="autotls_enable" type="checkbox" value="yes" <?=!empty($pconfig['autotls_enable']) ? "checked=\"checked\"" : "" ;?>  />
                          <?=gettext("Automatically generate a shared TLS authentication key"); ?>.
                         </div>
Ad Schellevis's avatar
Ad Schellevis committed
776
                        <?php
777
endif; ?>
778 779 780 781
                        <div>
                          <textarea id="tls" name="tls" cols="65" rows="7" class="formpre"><?=$pconfig['tls'];?></textarea>
                          <?=gettext("Paste your shared key here"); ?>.
                        </div>
Ad Schellevis's avatar
Ad Schellevis committed
782 783
                      </td>
                    </tr>
784
                    <tr class="opt_mode opt_mode_p2p_tls opt_mode_server_tls opt_mode_server_user opt_mode_server_tls_user">
Ad Schellevis's avatar
Ad Schellevis committed
785 786
                      <td><i class="fa fa-info-circle text-muted"></i> <?=gettext("Peer Certificate Authority"); ?></td>
                        <td>
787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809
<?php
                        if (isset($config['ca'])) :?>
                          <select name='caref' class="form-control">
<?php
                          foreach ($config['ca'] as $ca) :
                              $selected = "";
                              if ($pconfig['caref'] == $ca['refid']) {
                                  $selected = "selected=\"selected\"";
                              }
                          ?>
                            <option value="<?=htmlspecialchars($ca['refid']);?>" <?=$selected;?>>
                              <?=htmlspecialchars($ca['descr']);?>
                            </option>
<?php
                          endforeach; ?>
                          </select>
<?php
                        else :?>
                          <b><?=gettext("No Certificate Authorities defined.");?></b>
                          <br /><?=gettext("Create one under")?> <a href="system_camanager.php"> <?=gettext("System: Certificates");?></a>.
<?php
                        endif; ?>
                      </td>
Ad Schellevis's avatar
Ad Schellevis committed
810
                    </tr>
811
                    <tr class="opt_mode opt_mode_p2p_tls opt_mode_server_tls opt_mode_server_user opt_mode_server_tls_user">
Ad Schellevis's avatar
Ad Schellevis committed
812
                      <td><i class="fa fa-info-circle text-muted"></i> <?=gettext("Peer Certificate Revocation List"); ?></td>
813 814 815
                      <td>
<?php
                        if (isset($config['crl'])) :?>
Ad Schellevis's avatar
Ad Schellevis committed
816 817
                        <select name='crlref' class="form-control">
                          <option value="">None</option>
818 819
<?php
                          foreach ($config['crl'] as $crl) :
820 821 822 823 824
                              if (!isset($crl['refid'])) {
                                  continue;
                              }
                              $ca = lookup_ca($crl['caref']);
                              if ($ca) {
825 826
                                  $selected = $pconfig['crlref'] == $crl['refid'] ? 'selected="selected"' : ''; ?>
                            <option value="<?=htmlspecialchars($crl['refid']);?>" <?=$selected;?>><?=htmlspecialchars("{$crl['descr']} ({$ca['descr']})");?></option>
827
<?php
828
                              }
829
                          endforeach; ?>
Ad Schellevis's avatar
Ad Schellevis committed
830
                        </select>
831 832 833 834 835 836 837
<?php
                        else :?>
                        <b><?=gettext("No Certificate Revocation Lists (CRLs) defined.");?></b>
                        <br /><?=gettext("Create one under");?> <a href="system_crlmanager.php"><?=gettext("System: Certificates");?></a>.
<?php
                        endif; ?>
                      </td>
Ad Schellevis's avatar
Ad Schellevis committed
838
                    </tr>
839
                    <tr class="opt_mode opt_mode_p2p_tls opt_mode_server_tls opt_mode_server_user opt_mode_server_tls_user">
Ad Schellevis's avatar
Ad Schellevis committed
840
                      <td><i class="fa fa-info-circle text-muted"></i> <?=gettext("Server Certificate"); ?></td>
841 842 843
                      <td>
<?php
                      if (isset($config['cert'])) :?>
Ad Schellevis's avatar
Ad Schellevis committed
844
                        <select name='certref' class="form-control">
845
<?php
846 847 848 849 850 851 852 853
                        foreach ($config['cert'] as $cert) :
                            $selected = "";
                            $caname = "";
                            $inuse = "";
                            $revoked = "";
                            if (isset($cert['caref'])) {
                                $ca = lookup_ca($cert['caref']);
                                if (!empty($ca)) {
854
                                    $caname = " ({$ca['descr']})";
855 856 857 858 859 860 861 862 863 864 865 866
                                }
                            }
                            if ($pconfig['certref'] == $cert['refid']) {
                                $selected = "selected=\"selected\"";
                            }
                            if (cert_in_use($cert['refid'])) {
                                $inuse = " *In Use";
                            }
                            if (is_cert_revoked($cert)) {
                                $revoked = " *Revoked";
                            }
                        ?>
867 868 869 870
                          <option value="<?=htmlspecialchars($cert['refid']);?>" <?=$selected;?>>
                            <?=htmlspecialchars($cert['descr'] . $caname . $inuse . $revoked);?>
                          </option>
<?php
871
                        endforeach; ?>
Ad Schellevis's avatar
Ad Schellevis committed
872
                        </select>
873 874 875 876 877 878
<?php
                      else :?>
                          <b><?=gettext("No Certificates defined.");?></b>
                          <br /><?=gettext("Create one under");?> <a href="system_certmanager.php"><?=gettext("System: Certificates");?></a>.
<?php
                      endif; ?>
Ad Schellevis's avatar
Ad Schellevis committed
879 880
                      </td>
                    </tr>
881
                    <tr class="opt_mode opt_mode_p2p_tls opt_mode_server_tls opt_mode_server_user opt_mode_server_tls_user">
Ad Schellevis's avatar
Ad Schellevis committed
882 883 884
                      <td><i class="fa fa-info-circle text-muted"></i> <?=gettext("DH Parameters Length"); ?></td>
                      <td>
                        <select name="dh_length" class="form-control">
885 886 887 888 889 890 891
<?php
                        foreach (array(1024, 2048, 4096) as $length) :
                            $selected = "";
                            if ($length == $pconfig['dh_length']) {
                                $selected = " selected=\"selected\"";
                            }
                        ?>
Ad Schellevis's avatar
Ad Schellevis committed
892
                          <option<?=$selected?>><?=$length;?></option>
893 894
<?php
                        endforeach; ?>
Ad Schellevis's avatar
Ad Schellevis committed
895 896
                        </select>
                        <span>
897
                          <?=gettext("bits"); ?>
Ad Schellevis's avatar
Ad Schellevis committed
898 899 900
                        </span>
                      </td>
                    </tr>
901
                    <tr class="opt_mode opt_mode_p2p_shared_key">
902
                      <td width="22%"><i class="fa fa-info-circle text-muted"></i> <?=gettext("Shared Key"); ?></td>
Ad Schellevis's avatar
Ad Schellevis committed
903
                      <td>
904 905
<?php
                        if (empty($pconfig['shared_key'])) :?>
906 907 908 909
                        <div>
                          <input name="autokey_enable" id="autokey_enable" type="checkbox" value="yes"  <?=!empty($pconfig['autokey_enable']) ? "checked=\"checked\"" : "" ;?>  />
                          <?=gettext("Automatically generate a shared key"); ?>.
                        </div>
910 911
<?php
                        endif; ?>
912 913 914 915
                        <div id="autokey_opts">
                          <textarea name="shared_key" cols="65" rows="7"><?=$pconfig['shared_key'];?></textarea>
                          <?=gettext("Paste your shared key here"); ?>.
                        </div>
Ad Schellevis's avatar
Ad Schellevis committed
916 917 918 919 920 921
                      </td>
                    </tr>
                    <tr>
                      <td><i class="fa fa-info-circle text-muted"></i> <?=gettext("Encryption algorithm"); ?></td>
                      <td>
                        <select name="crypto" class="form-control">
922 923 924 925 926 927 928 929
<?php
                        $cipherlist = openvpn_get_cipherlist();
                        foreach ($cipherlist as $name => $desc) :
                            $selected = "";
                            if ($name == $pconfig['crypto']) {
                                $selected = " selected=\"selected\"";
                            }
                        ?>
Ad Schellevis's avatar
Ad Schellevis committed
930
                          <option value="<?=$name;?>"<?=$selected?>>
931
                            <?=htmlspecialchars($desc);?>
Ad Schellevis's avatar
Ad Schellevis committed
932
                          </option>
933 934
<?php
                        endforeach; ?>
Ad Schellevis's avatar
Ad Schellevis committed
935 936 937 938 939 940 941
                        </select>
                      </td>
                    </tr>
                    <tr>
                      <td><a id="help_for_digest" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Auth Digest Algorithm"); ?></td>
                      <td>
                        <select name="digest" class="form-control">
942 943 944 945 946 947 948 949
<?php
                        $digestlist = openvpn_get_digestlist();
                        foreach ($digestlist as $name => $desc) :
                            $selected = "";
                            if ($name == $pconfig['digest']) {
                                $selected = " selected=\"selected\"";
                            }
                        ?>
Ad Schellevis's avatar
Ad Schellevis committed
950
                          <option value="<?=$name;?>"<?=$selected?>>
951
                            <?=htmlspecialchars($desc);?>
Ad Schellevis's avatar
Ad Schellevis committed
952
                          </option>
953 954
<?php
                        endforeach; ?>
Ad Schellevis's avatar
Ad Schellevis committed
955 956
                        </select>
                        <div class="hidden" for="help_for_digest">
957
                            <?= gettext('Leave this set to SHA1 unless all clients are set to match. SHA1 is the default for OpenVPN.') ?>
Ad Schellevis's avatar
Ad Schellevis committed
958 959 960 961 962 963 964
                        </div>
                      </td>
                    </tr>
                    <tr id="engine">
                      <td><i class="fa fa-info-circle text-muted"></i> <?=gettext("Hardware Crypto"); ?></td>
                      <td>
                        <select name="engine" class="form-control">
965 966 967 968 969 970 971 972
<?php
                        $engines = openvpn_get_engines();
                        foreach ($engines as $name => $desc) :
                            $selected = "";
                            if ($name == $pconfig['engine']) {
                                $selected = " selected=\"selected\"";
                            }
                        ?>
Ad Schellevis's avatar
Ad Schellevis committed
973
                          <option value="<?=$name;?>"<?=$selected?>>
974
                            <?=htmlspecialchars($desc);?>
Ad Schellevis's avatar
Ad Schellevis committed
975
                          </option>
976 977
<?php
                        endforeach; ?>
Ad Schellevis's avatar
Ad Schellevis committed
978 979 980
                        </select>
                      </td>
                    </tr>
981
                    <tr class="opt_mode opt_mode_p2p_tls opt_mode_server_tls opt_mode_server_user opt_mode_server_tls_user">
Ad Schellevis's avatar
Ad Schellevis committed
982 983
                      <td width="22%" ><a id="help_for_cert_depth" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Certificate Depth"); ?></td>
                      <td>
984
                        <table>
Ad Schellevis's avatar
Ad Schellevis committed
985 986
                        <tr><td>
                        <select name="cert_depth" class="form-control">
987
                          <option value=""><?=gettext('Do Not Check') ?></option>
988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004
<?php
                          $openvpn_cert_depths = array(
                            1 => gettext('One (Client+Server)'),
                            2 => gettext('Two (Client+Intermediate+Server)'),
                            3 => gettext('Three (Client+2xIntermediate+Server)'),
                            4 => gettext('Four (Client+3xIntermediate+Server)'),
                            5 => gettext('Five (Client+4xIntermediate+Server)')
                          );
                          foreach ($openvpn_cert_depths as $depth => $depthdesc) :
                              $selected = "";
                              if ($depth == $pconfig['cert_depth']) {
                                  $selected = " selected=\"selected\"";
                              }
                          ?>
                            <option value="<?= $depth ?>" <?= $selected ?>><?= $depthdesc ?></option>
<?php
                        endforeach; ?>
Ad Schellevis's avatar
Ad Schellevis committed
1005
                        </select>
1006 1007 1008 1009
                      </td>
                    </tr>
                    <tr>
                      <td>
Ad Schellevis's avatar
Ad Schellevis committed
1010 1011 1012 1013 1014 1015 1016 1017 1018
                        <div class="hidden" for="help_for_cert_depth">
                          <span>
                            <?=gettext("When a certificate-based client logs in, do not accept certificates below this depth. Useful for denying certificates made with intermediate CAs generated from the same CA as the server."); ?>
                          </span>
                        </div>
                        </td></tr>
                        </table>
                      </td>
                    </tr>
1019
                    <tr class="opt_mode opt_mode_server_tls_user">
Ad Schellevis's avatar
Ad Schellevis committed
1020 1021
                      <td width="22%" ><a id="help_for_strictusercn" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Strict User/CN Matching"); ?></td>
                      <td>
1022 1023 1024 1025 1026 1027
                        <input name="strictusercn" type="checkbox" value="yes" <?=!empty($pconfig['strictusercn']) ? "checked=\"checked\"" : "" ;?> />
                        <div class="hidden" for="help_for_strictusercn">
                          <span>
                              <?=gettext("When authenticating users, enforce a match between the common name of the client certificate and the username given at login."); ?>
                          </span>
                        </div>
Ad Schellevis's avatar
Ad Schellevis committed
1028 1029
                      </td>
                    </tr>
1030 1031 1032 1033 1034 1035 1036 1037
                </table>
              </div>
            </div>
          </section>
          <section class="col-xs-12">
            <div class="tab-content content-box col-xs-12">
              <div class="table-responsive">
                <table class="table table-striped opnsense_standard_table_form">
Ad Schellevis's avatar
Ad Schellevis committed
1038
                    <tr>
1039
                      <td colspan="2"><strong><?=gettext("Tunnel Settings"); ?></strong></td>
Ad Schellevis's avatar
Ad Schellevis committed
1040 1041
                    </tr>
                    <tr>
1042 1043
                      <td width="22%" id="ipv4_tunnel_network"><a id="help_for_tunnel_network" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("IPv4 Tunnel Network"); ?></td>
                      <td witdh="78%">
Ad Schellevis's avatar
Ad Schellevis committed
1044 1045
                        <input name="tunnel_network" type="text" class="form-control unknown" size="20" value="<?=$pconfig['tunnel_network'];?>" />
                        <div class="hidden" for="help_for_tunnel_network">
1046
                            <?=gettext("This is the IPv4 virtual network used for private " .
Ad Schellevis's avatar
Ad Schellevis committed
1047 1048 1049
                                                  "communications between this server and client " .
                                                  "hosts expressed using CIDR (eg. 10.0.8.0/24). " .
                                                  "The first network address will be assigned to " .
Fabian Franz's avatar
Fabian Franz committed
1050
                                                  "the server virtual interface. The remaining " .
Ad Schellevis's avatar
Ad Schellevis committed
1051 1052 1053 1054 1055 1056 1057 1058 1059 1060
                                                  "network addresses can optionally be assigned " .
                                                  "to connecting clients. (see Address Pool)"); ?>
                        </div>
                      </td>
                    </tr>
                    <tr>
                      <td width="22%" ><a id="help_for_tunnel_networkv6" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("IPv6 Tunnel Network"); ?></td>
                      <td>
                        <input name="tunnel_networkv6" type="text" class="form-control unknown" size="20" value="<?=$pconfig['tunnel_networkv6'];?>" />
                        <div class="hidden" for="help_for_tunnel_networkv6">
1061
                            <?=gettext("This is the IPv6 virtual network used for private " .
Ad Schellevis's avatar
Ad Schellevis committed
1062 1063 1064 1065 1066 1067 1068 1069 1070
                                                  "communications between this server and client " .
                                                  "hosts expressed using CIDR (eg. fe80::/64). " .
                                                  "The first network address will be assigned to " .
                                                  "the server virtual interface. The remaining " .
                                                  "network addresses can optionally be assigned " .
                                                  "to connecting clients. (see Address Pool)"); ?>
                        </div>
                      </td>
                    </tr>
1071
                    <tr class="dev_mode dev_mode_tap">
Ad Schellevis's avatar
Ad Schellevis committed
1072 1073
                      <td width="22%" ><a id="help_for_serverbridge_dhcp" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Bridge DHCP"); ?></td>
                      <td>
1074
                              <input id="serverbridge_dhcp" name="serverbridge_dhcp" type="checkbox" value="yes" <?=!empty($pconfig['serverbridge_dhcp']) ? "checked=\"checked\"" : "" ;?>/>
Ad Schellevis's avatar
Ad Schellevis committed
1075 1076
                              <div class="hidden" for="help_for_serverbridge_dhcp">
                                <span>
1077
                                    <?=gettext("Allow clients on the bridge to obtain DHCP."); ?><br />
Ad Schellevis's avatar
Ad Schellevis committed
1078 1079 1080 1081
                                </span>
                              </div>
                      </td>
                    </tr>
1082
                    <tr class="dev_mode dev_mode_tap">
Ad Schellevis's avatar
Ad Schellevis committed
1083 1084
                      <td width="22%" ><a id="help_for_serverbridge_interface" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Bridge Interface"); ?></td>
                      <td>
1085
                        <select id="serverbridge_interface" name="serverbridge_interface" class="form-control">
1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103
<?php
                        $serverbridge_interface['none'] = "none";
                        $serverbridge_interface = array_merge($serverbridge_interface, get_configured_interface_with_descr());
                        $carplist = get_configured_carp_interface_list();
                        foreach ($carplist as $cif => $carpip) {
                            $serverbridge_interface[$cif.'|'.$carpip] = $carpip." (".get_vip_descr($carpip).")";
                        }
                                                    $aliaslist = get_configured_ip_aliases_list();
                        foreach ($aliaslist as $aliasip => $aliasif) {
                            $serverbridge_interface[$aliasif.'|'.$aliasip] = $aliasip." (".get_vip_descr($aliasip).")";
                        }
                        foreach ($serverbridge_interface as $iface => $ifacename) :
                          $selected = "";
                          if ($iface == $pconfig['serverbridge_interface']) {
                              $selected = "selected=\"selected\"";
                          }
                        ?>
                            <option value="<?=$iface;?>" <?=$selected;?>>
1104 1105
                                <?=htmlspecialchars($ifacename);?>
                            </option>
1106 1107
<?php
                        endforeach; ?>
Ad Schellevis's avatar
Ad Schellevis committed
1108 1109
                        </select>
                        <div class="hidden" for="help_for_serverbridge_interface">
1110
                            <?=gettext("The interface to which this tap instance will be " .
Ad Schellevis's avatar
Ad Schellevis committed
1111 1112 1113 1114 1115 1116 1117 1118
                                                  "bridged. This is not done automatically. You must assign this " .
                                                  "interface and create the bridge separately. " .
                                                  "This setting controls which existing IP address and subnet " .
                                                  "mask are used by OpenVPN for the bridge. Setting this to " .
                                                  "'none' will cause the Server Bridge DHCP settings below to be ignored."); ?>
                        </div>
                      </td>
                    </tr>
1119
                    <tr class="dev_mode dev_mode_tap">
Ad Schellevis's avatar
Ad Schellevis committed
1120 1121
                      <td width="22%" ><a id="help_for_serverbridge_dhcp_start" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Server Bridge DHCP Start"); ?></td>
                      <td>
1122
                        <input  id="serverbridge_dhcp_start" name="serverbridge_dhcp_start" type="text" class="form-control unknown" size="20" value="<?=$pconfig['serverbridge_dhcp_start'];?>" />
Ad Schellevis's avatar
Ad Schellevis committed
1123
                        <div class="hidden" for="help_for_serverbridge_dhcp_start">
1124
                            <?=gettext("When using tap mode as a multi-point server, " .
Ad Schellevis's avatar
Ad Schellevis committed
1125 1126 1127 1128 1129 1130 1131 1132
                                                  "you may optionally supply a DHCP range to use on the " .
                                                  "interface to which this tap instance is bridged. " .
                                                  "If these settings are left blank, DHCP will be passed " .
                                                  "through to the LAN, and the interface setting above " .
                                                  "will be ignored."); ?>
                        </div>
                      </td>
                    </tr>
1133
                    <tr class="dev_mode dev_mode_tap">
Ad Schellevis's avatar
Ad Schellevis committed
1134 1135
                      <td width="22%" ><i class="fa fa-info-circle text-muted"></i> <?=gettext("Server Bridge DHCP End"); ?></td>
                      <td>
1136
                        <input id="serverbridge_dhcp_end" name="serverbridge_dhcp_end" type="text" class="form-control unknown" size="20" value="<?=$pconfig['serverbridge_dhcp_end'];?>" />
Ad Schellevis's avatar
Ad Schellevis committed
1137 1138
                      </td>
                    </tr>
1139
                    <tr class="opt_mode opt_mode_p2p_tls opt_mode_server_tls opt_mode_server_user opt_mode_server_tls_user">
Ad Schellevis's avatar
Ad Schellevis committed
1140 1141
                      <td width="22%" ><a id="help_for_gwredir" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Redirect Gateway"); ?></td>
                      <td>
1142
                        <input name="gwredir" id="gwredir" type="checkbox" value="yes" <?=!empty($pconfig['gwredir']) ? "checked=\"checked\"" : "" ;?> />
Ad Schellevis's avatar
Ad Schellevis committed
1143 1144
                        <div class="hidden" for="help_for_gwredir">
                            <span>
1145
                                <?=gettext("Force all client generated traffic through the tunnel"); ?>.
Ad Schellevis's avatar
Ad Schellevis committed
1146 1147 1148 1149
                            </span>
                        </div>
                      </td>
                    </tr>
1150
                    <tr class="opt_mode opt_mode_p2p_tls opt_mode_server_tls opt_mode_server_user opt_mode_server_tls_user opt_gwredir">
Ad Schellevis's avatar
Ad Schellevis committed
1151 1152 1153 1154
                      <td width="22%" ><a id="help_local_network" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("IPv4 Local Network/s"); ?></td>
                      <td>
                        <input name="local_network" type="text" class="form-control unknown" size="40" value="<?=$pconfig['local_network'];?>" />
                        <div class="hidden" for="help_local_network">
1155
                            <?=gettext("These are the IPv4 networks that will be accessible " .
Ad Schellevis's avatar
Ad Schellevis committed
1156 1157 1158 1159 1160 1161 1162 1163
                                                  "from the remote endpoint. Expressed as a comma-separated list of one or more CIDR ranges. " .
                                                  "You may leave this blank if you don't " .
                                                  "want to add a route to the local network " .
                                                  "through this tunnel on the remote machine. " .
                                                  "This is generally set to your LAN network"); ?>.
                        </div>
                      </td>
                    </tr>
1164
                    <tr class="opt_mode opt_mode_p2p_tls opt_mode_server_tls opt_mode_server_user opt_mode_server_tls_user opt_gwredir">
Ad Schellevis's avatar
Ad Schellevis committed
1165 1166 1167 1168
                      <td width="22%" ><a id="help_for_local_networkv6" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a><?=gettext("IPv6 Local Network/s"); ?></td>
                      <td>
                        <input name="local_networkv6" type="text" class="form-control unknown" size="40" value="<?=$pconfig['local_networkv6'];?>" />
                        <div class="hidden" for="help_for_local_networkv6">
1169
                            <?=gettext("These are the IPv6 networks that will be accessible " .
Ad Schellevis's avatar
Ad Schellevis committed
1170 1171 1172 1173 1174 1175 1176 1177
                                                  "from the remote endpoint. Expressed as a comma-separated list of one or more IP/PREFIX. " .
                                                  "You may leave this blank if you don't " .
                                                  "want to add a route to the local network " .
                                                  "through this tunnel on the remote machine. " .
                                                  "This is generally set to your LAN network"); ?>.
                        </div>
                      </td>
                    </tr>
1178
                    <tr class="opt_mode opt_mode_p2p_tls opt_mode_p2p_shared_key">
Ad Schellevis's avatar
Ad Schellevis committed
1179 1180 1181 1182
                      <td width="22%" ><a id="help_for_remote_network" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("IPv4 Remote Network/s"); ?></td>
                      <td>
                        <input name="remote_network" type="text" class="form-control unknown" size="40" value="<?=$pconfig['remote_network'];?>" />
                        <div class="hidden" for="help_for_remote_network">
1183
                            <?=gettext("These are the IPv4 networks that will be routed through " .
Ad Schellevis's avatar
Ad Schellevis committed
1184 1185 1186 1187 1188 1189 1190 1191 1192
                                                  "the tunnel, so that a site-to-site VPN can be " .
                                                  "established without manually changing the routing tables. " .
                                                  "Expressed as a comma-separated list of one or more CIDR ranges. " .
                                                  "If this is a site-to-site VPN, enter the " .
                                                  "remote LAN/s here. You may leave this blank if " .
                                                  "you don't want a site-to-site VPN"); ?>.
                        </div>
                      </td>
                    </tr>
1193
                    <tr class="opt_mode opt_mode_p2p_tls opt_mode_p2p_shared_key">
Ad Schellevis's avatar
Ad Schellevis committed
1194 1195 1196 1197
                      <td width="22%" ><a id="help_for_remote_networkv6" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("IPv6 Remote Network/s"); ?></td>
                      <td>
                        <input name="remote_networkv6" type="text" class="form-control unknown" size="40" value="<?=$pconfig['remote_networkv6'];?>" />
                        <div class="hidden" for="help_for_remote_networkv6">
1198
                            <?=gettext("These are the IPv6 networks that will be routed through " .
Ad Schellevis's avatar
Ad Schellevis committed
1199 1200 1201 1202 1203 1204 1205 1206 1207 1208
                                                  "the tunnel, so that a site-to-site VPN can be " .
                                                  "established without manually changing the routing tables. " .
                                                  "Expressed as a comma-separated list of one or more IP/PREFIX. " .
                                                  "If this is a site-to-site VPN, enter the " .
                                                  "remote LAN/s here. You may leave this blank if " .
                                                  "you don't want a site-to-site VPN"); ?>.
                        </div>
                      </td>
                    </tr>
                    <tr>
1209
                      <td width="22%" ><a id="help_for_maxclients" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Concurrent connections");?></td>
Ad Schellevis's avatar
Ad Schellevis committed
1210 1211 1212
                      <td>
                        <input name="maxclients" type="text" class="form-control unknown" size="5" value="<?=$pconfig['maxclients'];?>" />
                        <div class="hidden" for="help_for_maxclients">
1213
                            <?=gettext("Specify the maximum number of clients allowed to concurrently connect to this server"); ?>.
Ad Schellevis's avatar
Ad Schellevis committed
1214 1215 1216 1217 1218 1219 1220
                        </div>
                      </td>
                    </tr>
                    <tr>
                      <td width="22%" ><a id="help_for_compression" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Compression"); ?></td>
                      <td>
                        <select name="compression" class="form-control">
1221 1222 1223 1224 1225 1226 1227 1228 1229 1230
<?php
                        foreach ($openvpn_compression_modes as $cmode => $cmodedesc) :
                            $selected = "";
                            if ($cmode == $pconfig['compression']) {
                                $selected = " selected=\"selected\"";
                            }
                          ?>
                            <option value="<?= $cmode ?>" <?= $selected ?>><?= $cmodedesc ?></option>
<?php
                        endforeach; ?>
Ad Schellevis's avatar
Ad Schellevis committed
1231 1232
                        </select>
                        <div class="hidden" for="help_for_compression">
1233
                            <?=gettext("Compress tunnel packets using the LZO algorithm. Adaptive compression will dynamically disable compression for a period of time if OpenVPN detects that the data in the packets is not being compressed efficiently"); ?>.
Ad Schellevis's avatar
Ad Schellevis committed
1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247
                        </div>
                      </td>
                    </tr>
                    <tr>
                      <td width="22%" ><a id="help_for_passtos" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Type-of-Service"); ?></td>
                      <td>
                        <input name="passtos" type="checkbox" value="yes" <?=!empty($pconfig['passtos']) ? "checked=\"checked\"" : "" ;?> />
                        <div class="hidden" for="help_for_passtos">
                          <span>
                            <?=gettext("Set the TOS IP header value of tunnel packets to match the encapsulated packet value"); ?>.
                          </span>
                        </div>
                      </td>
                    </tr>
1248
                    <tr class="opt_mode opt_mode_server_tls opt_mode_server_user opt_mode_server_tls_user">
Ad Schellevis's avatar
Ad Schellevis committed
1249 1250 1251 1252 1253
                      <td width="22%" ><a id="help_for_client2client" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Inter-client communication"); ?></td>
                      <td>
                          <input name="client2client" type="checkbox" value="yes"  <?=!empty($pconfig['client2client']) ? "checked=\"checked\"" : "" ;?> />
                          <div class="hidden" for="help_for_client2client">
                            <span>
1254
                                <?=gettext("Allow communication between clients connected to this server"); ?>
Ad Schellevis's avatar
Ad Schellevis committed
1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269
                            </span>
                          </div>
                      </td>
                    </tr>
                    <tr id="duplicate_cn">
                      <td width="22%" ><a id="help_for_duplicate_cn" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Duplicate Connections"); ?></td>
                      <td>
                            <input name="duplicate_cn" type="checkbox" value="yes" <?=!empty($pconfig['duplicate_cn']) ? "checked=\"checked\"" : "" ;?> />
                            <div class="hidden" for="help_for_duplicate_cn">
                              <span>
                                <?=gettext("Allow multiple concurrent connections from clients using the same Common Name.<br />NOTE: This is not generally recommended, but may be needed for some scenarios."); ?>
                              </span>
                            </div>
                      </td>
                    </tr>
1270
                    <tr class="dev_mode dev_mode_tun">
Ad Schellevis's avatar
Ad Schellevis committed
1271 1272 1273 1274 1275 1276 1277 1278 1279 1280
                      <td width="22%" ><a id="help_for_no_tun_ipv6" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Disable IPv6"); ?></td>
                      <td>
                        <input name="no_tun_ipv6" type="checkbox" value="yes" <?=!empty($pconfig['no_tun_ipv6']) ? "checked=\"checked\"" : "" ;?> />
                        <div class="hidden" for="help_for_no_tun_ipv6">
                          <span>
                            <?=gettext("Don't forward IPv6 traffic"); ?>.
                          </span>
                        </div>
                      </td>
                    </tr>
1281 1282 1283 1284 1285 1286 1287 1288
                  </table>
                </div>
              </div>
            </section>
            <section class="col-xs-12">
              <div class="tab-content content-box col-xs-12">
                <div class="table-responsive">
                  <table class="table table-striped opnsense_standard_table_form">
Ad Schellevis's avatar
Ad Schellevis committed
1289
                    <tr>
1290
                      <td colspan="2"><strong><?=gettext("Client Settings"); ?></strong></td>
Ad Schellevis's avatar
Ad Schellevis committed
1291 1292 1293
                    </tr>
                    <tr>
                      <td width="22%" ><a id="help_for_dynamic_ip" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Dynamic IP"); ?></td>
1294
                      <td width="78%">
Ad Schellevis's avatar
Ad Schellevis committed
1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313
                        <input name="dynamic_ip" type="checkbox" id="dynamic_ip" value="yes" <?=!empty($pconfig['dynamic_ip']) ? "checked=\"checked\"" : "" ;?> />
                        <div class="hidden" for="help_for_dynamic_ip">
                          <span>
                            <?=gettext("Allow connected clients to retain their connections if their IP address changes"); ?>.<br />
                          </span>
                        </div>
                      </td>
                    </tr>
                    <tr>
                      <td width="22%" ><a id="help_for_pool_enable" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Address Pool"); ?></td>
                      <td>
                        <input name="pool_enable" type="checkbox" id="pool_enable" value="yes" <?=!empty($pconfig['pool_enable']) ? "checked=\"checked\"" : "" ;?> />
                        <div class="hidden" for="help_for_pool_enable">
                          <span>
                            <?=gettext("Provide a virtual adapter IP address to clients (see Tunnel Network)"); ?><br />
                          </span>
                        </div>
                      </td>
                    </tr>
1314
                    <tr class="dev_mode dev_mode_tun" id="topology_subnet_opt">
Ad Schellevis's avatar
Ad Schellevis committed
1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329
                      <td width="22%" ><a id="help_for_topology_subnet" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Topology"); ?></td>
                      <td>
                        <input name="topology_subnet" type="checkbox" id="topology_subnet" value="yes"  <?=!empty($pconfig['topology_subnet']) ? "checked=\"checked\"" : "" ;?> />
                        <div class="hidden" for="help_for_topology_subnet">
                          <span>
                            <?=gettext("Allocate only one IP per client (topology subnet), rather than an isolated subnet per client (topology net30)."); ?><br />
                            <?=gettext("Relevant when supplying a virtual adapter IP address to clients when using tun mode on IPv4."); ?><br />
                            <?=gettext("Some clients may require this even for IPv6, such as OpenVPN Connect (iOS/Android). Others may break if it is present, such as older versions of OpenVPN or clients such as Yealink phones."); ?><br />
                          </span>
                        </div>
                      </td>
                    </tr>
                    <tr>
                      <td width="22%" ><a id="help_for_dns_domain" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("DNS Default Domain"); ?></td>
                      <td>
1330 1331
                        <input name="dns_domain_enable" type="checkbox" id="dns_domain_enable" value="yes" <?=!empty($pconfig['dns_domain']) ? "checked=\"checked\"" : "" ;?> />
                        <div id="dns_domain_data">
Ad Schellevis's avatar
Ad Schellevis committed
1332 1333 1334 1335
                              <input name="dns_domain" type="text" class="form-control unknown" id="dns_domain" size="30" value="<?=htmlspecialchars($pconfig['dns_domain']);?>" />
                        </div>
                        <div class="hidden" for="help_for_dns_domain">
                          <span>
1336
                              <?=gettext("Provide a default domain name to clients"); ?><br />
Ad Schellevis's avatar
Ad Schellevis committed
1337 1338 1339 1340 1341 1342 1343
                          </span>
                        </div>
                      </td>
                    </tr>
                    <tr>
                      <td width="22%" ><a id="help_for_dns_server" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("DNS Servers"); ?></td>
                      <td>
1344 1345
                        <input name="dns_server_enable" type="checkbox" id="dns_server_enable" value="yes" <?=!empty($pconfig['dns_server1']) || !empty($pconfig['dns_server2']) || !empty($pconfig['dns_server3']) || !empty($pconfig['dns_server4']) ? "checked=\"checked\"" : "" ;?> />
                        <div id="dns_server_data">
Ad Schellevis's avatar
Ad Schellevis committed
1346
                              <span>
1347
                                <?=gettext("Server #1:"); ?>&nbsp;
Ad Schellevis's avatar
Ad Schellevis committed
1348 1349 1350
                              </span>
                              <input name="dns_server1" type="text" class="form-control unknown" id="dns_server1" size="20" value="<?=$pconfig['dns_server1'];?>" />
                              <span>
1351
                                <?=gettext("Server #2:"); ?>&nbsp;
Ad Schellevis's avatar
Ad Schellevis committed
1352 1353 1354
                              </span>
                              <input name="dns_server2" type="text" class="form-control unknown" id="dns_server2" size="20" value="<?=$pconfig['dns_server2'];?>" />
                              <span>
1355
                                <?=gettext("Server #3:"); ?>&nbsp;
Ad Schellevis's avatar
Ad Schellevis committed
1356 1357 1358
                              </span>
                              <input name="dns_server3" type="text" class="form-control unknown" id="dns_server3" size="20" value="<?=$pconfig['dns_server3'];?>" />
                              <span>
1359
                                <?=gettext("Server #4:"); ?>&nbsp;
Ad Schellevis's avatar
Ad Schellevis committed
1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383
                              </span>
                              <input name="dns_server4" type="text" class="form-control unknown" id="dns_server4" size="20" value="<?=$pconfig['dns_server4'];?>" />
                        </div>
                        <div class="hidden" for="help_for_dns_server">
                          <span>
                            <?=gettext("Provide a DNS server list to clients"); ?><br />
                          </span>
                        </div>
                      </td>
                    </tr>
                    <tr id="chkboxPushRegisterDNS">
                      <td width="22%" ><a id="help_for_push_register_dns" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Force DNS cache update"); ?></td>
                      <td>
                        <input name="push_register_dns" type="checkbox" value="yes" <?=!empty($pconfig['push_register_dns']) ? "checked=\"checked\"" : "" ;?> />
                        <div class="hidden" for="help_for_push_register_dns">
                          <span>
                            <?=gettext("Run ''net stop dnscache'', ''net start dnscache'', ''ipconfig /flushdns'' and ''ipconfig /registerdns'' on connection initiation. This is known to kick Windows into recognizing pushed DNS servers."); ?><br />
                          </span>
                        </div>
                      </td>
                    </tr>
                    <tr>
                      <td width="22%" ><a id="help_for_ntp_server_enable" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("NTP Servers"); ?></td>
                      <td>
1384 1385
                        <input name="ntp_server_enable" type="checkbox" id="ntp_server_enable" value="yes" <?=!empty($pconfig['ntp_server1']) || !empty($pconfig['ntp_server2']) ? "checked=\"checked\"" : "" ;?>  />
                        <div id="ntp_server_data">
Ad Schellevis's avatar
Ad Schellevis committed
1386
                          <span>
1387
                            <?=gettext("Server #1:"); ?>&nbsp;
Ad Schellevis's avatar
Ad Schellevis committed
1388 1389 1390
                          </span>
                          <input name="ntp_server1" type="text" class="form-control unknown" id="ntp_server1" size="20" value="<?=$pconfig['ntp_server1'];?>" />
                          <span>
1391
                            <?=gettext("Server #2:"); ?>&nbsp;
Ad Schellevis's avatar
Ad Schellevis committed
1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404
                          </span>
                          <input name="ntp_server2" type="text" class="form-control unknown" id="ntp_server2" size="20" value="<?=$pconfig['ntp_server2'];?>" />
                        </div>
                        <div class="hidden" for="help_for_ntp_server_enable">
                          <span>
                            <?=gettext("Provide a NTP server list to clients"); ?><br />
                          </span>
                        </div>
                      </td>
                    </tr>
                    <tr>
                      <td width="22%" ><a id="help_for_netbios_enable" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("NetBIOS Options"); ?></td>
                      <td>
1405
                        <input name="netbios_enable" type="checkbox" id="netbios_enable" value="yes" <?=!empty($pconfig['netbios_enable']) ? "checked=\"checked\"" : "" ;?>  />
Ad Schellevis's avatar
Ad Schellevis committed
1406 1407
                        <div class="hidden" for="help_for_netbios_enable">
                          <span>
1408 1409
                            <?=gettext("Enable NetBIOS over TCP/IP"); ?><br />
                            <?=gettext("If this option is not set, all NetBIOS-over-TCP/IP options (including WINS) will be disabled"); ?>.
Ad Schellevis's avatar
Ad Schellevis committed
1410 1411
                          </span>
                        </div>
1412
                        <div id="netbios_data">
Ad Schellevis's avatar
Ad Schellevis committed
1413 1414 1415 1416
                          <span>
                            <?=gettext("Node Type"); ?>:&nbsp;
                          </span>
                          <select name='netbios_ntype' class="form-control">
1417
<?php
1418 1419 1420 1421 1422 1423 1424 1425 1426
                          foreach ($netbios_nodetypes as $type => $name) :
                              $selected = "";
                              if ($pconfig['netbios_ntype'] == $type) {
                                  $selected = "selected=\"selected\"";
                              }
                          ?>
                            <option value="<?=$type;?>" <?=$selected;?>><?=$name;?></option>
<?php
                          endforeach; ?>
Ad Schellevis's avatar
Ad Schellevis committed
1427 1428
                          </select>
                          <div class="hidden" for="help_for_netbios_enable">
1429
                            <?=gettext("Possible options: b-node (broadcasts), p-node " .
1430 1431
                                                        "(point-to-point name queries to a WINS server), " .
                                                        "m-node (broadcast then query name server), and " .
1432
                                                        "h-node (query name server, then broadcast)."); ?>
Ad Schellevis's avatar
Ad Schellevis committed
1433 1434 1435 1436 1437 1438
                          </div>
                          <span>
                            <?=gettext("Scope ID"); ?>:&nbsp;
                          </span>
                          <input name="netbios_scope" type="text" class="form-control unknown" id="netbios_scope" size="30" value="<?=$pconfig['netbios_scope'];?>" />
                          <div class="hidden" for="help_for_netbios_enable">
Fabian Franz's avatar
Fabian Franz committed
1439 1440
                            <?=gettext("A NetBIOS Scope ID provides an extended naming " .
                                                        "service for NetBIOS over TCP/IP. The NetBIOS " .
1441 1442
                                                        "scope ID isolates NetBIOS traffic on a single " .
                                                        "network to only those nodes with the same " .
1443
                                                        "NetBIOS scope ID."); ?>
Ad Schellevis's avatar
Ad Schellevis committed
1444 1445 1446 1447 1448 1449 1450
                          </div>
                        </div>
                      </td>
                    </tr>
                    <tr id="wins_opts">
                      <td width="22%" ><a id="help_for_wins_server" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("WINS Servers"); ?></td>
                      <td>
1451
                        <input name="wins_server_enable" type="checkbox" id="wins_server_enable" value="yes" <?=!empty($pconfig['wins_server1']) || !empty($pconfig['wins_server2']) ? "checked=\"checked\"" : "" ;?> />
Ad Schellevis's avatar
Ad Schellevis committed
1452 1453 1454 1455 1456
                        <div class="hidden" for="help_for_wins_server">
                          <span>
                            <?=gettext("Provide a WINS server list to clients"); ?><br />
                          </span>
                        </div>
1457
                        <div id="wins_server_data">
Ad Schellevis's avatar
Ad Schellevis committed
1458
                          <span>
1459
                            <?=gettext("Server #1:"); ?>&nbsp;
Ad Schellevis's avatar
Ad Schellevis committed
1460 1461 1462
                          </span>
                          <input name="wins_server1" type="text" class="form-control unknown" id="wins_server1" size="20" value="<?=$pconfig['wins_server1'];?>" />
                          <span>
1463
                            <?=gettext("Server #2:"); ?>&nbsp;
Ad Schellevis's avatar
Ad Schellevis committed
1464 1465 1466 1467 1468 1469 1470 1471
                          </span>
                          <input name="wins_server2" type="text" class="form-control unknown" id="wins_server2" size="20" value="<?=$pconfig['wins_server2'];?>" />
                        </div>
                      </td>
                    </tr>
                    <tr>
                      <td width="22%" ><a id="help_for_client_mgmt_port" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Client Management Port"); ?></td>
                      <td>
1472 1473
                        <input name="client_mgmt_port_enable" type="checkbox" id="client_mgmt_port_enable" value="yes" <?=!empty($pconfig['client_mgmt_port']) ? "checked=\"checked\"" : "" ;?> />
                        <div id="client_mgmt_port_data">
Ad Schellevis's avatar
Ad Schellevis committed
1474 1475 1476 1477
                              <input name="client_mgmt_port" type="text" class="form-control unknown" id="client_mgmt_port" size="30" value="<?=htmlspecialchars($pconfig['client_mgmt_port']);?>" />
                        </div>
                        <div class="hidden" for="help_for_client_mgmt_port">
                          <span>
1478
                            <?=gettext("Use a different management port on clients. The default port is 166. Specify a different port if the client machines need to select from multiple OpenVPN links."); ?><br />
Ad Schellevis's avatar
Ad Schellevis committed
1479 1480 1481 1482
                          </span>
                        </div>
                      </td>
                    </tr>
1483 1484 1485 1486 1487 1488 1489 1490
                  </table>
                </div>
              </div>
            </section>
            <section class="col-xs-12">
              <div class="tab-content content-box col-xs-12">
                <div class="table-responsive">
                  <table class="table table-striped opnsense_standard_table_form">
Ad Schellevis's avatar
Ad Schellevis committed
1491
                    <tr>
1492
                      <td colspan="2"><strong><?=gettext("Advanced configuration"); ?></strong></td>
Ad Schellevis's avatar
Ad Schellevis committed
1493 1494 1495 1496 1497 1498
                    </tr>
                    <tr>
                      <td width="22%" ><a id="help_for_custom_options" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Advanced"); ?></td>
                      <td>
                        <textarea rows="6" cols="78" name="custom_options" id="custom_options"><?=$pconfig['custom_options'];?></textarea><br />
                        <div class="hidden" for="help_for_custom_options">
1499 1500
                            <?=gettext("Enter any additional options you would like to add to the OpenVPN server configuration here, separated by a semicolon"); ?><br />
                            <?=gettext("EXAMPLE: push \"route 10.0.0.0 255.255.255.0\""); ?>;
Ad Schellevis's avatar
Ad Schellevis committed
1501 1502 1503 1504 1505 1506 1507
                        </div>
                      </td>
                    </tr>
                    <tr id="comboboxVerbosityLevel">
                      <td width="22%" ><a id="help_for_verbosity_level" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Verbosity level");?></td>
                      <td>
                        <select name="verbosity_level" class="form-control">
1508
<?php
1509
                        foreach ($openvpn_verbosity_level as $verb_value => $verb_desc) :
1510
                            $selected = '';
1511
                            if ($pconfig['verbosity_level'] == $verb_value) {
1512
                                $selected = 'selected="selected"';
1513 1514
                            }
                        ?>
1515 1516 1517
                          <option value="<?=$verb_value; ?>" <?=$selected; ?>><?=$verb_desc;?></option>
<?php
                        endforeach; ?>
Ad Schellevis's avatar
Ad Schellevis committed
1518 1519
                        </select>
                        <div class="hidden" for="help_for_verbosity_level">
1520
                          <?=gettext("Each level shows all info from the previous levels. Level 3 is recommended if you want a good summary of what's happening without being swamped by output."); ?><br /> <br />
1521 1522 1523 1524
                          <?=sprintf(gettext("%s0%s -- No output except fatal errors."),'<strong>','</strong>') ?> <br />
                          <?=sprintf(gettext("%s1%s -- startup info + connection initiated messages + non-fatal encryption & net errors."),'<strong>','</strong>') ?> <br />
                          <?=sprintf(gettext("%s2,3%s -- show TLS negotiations & route info."),'<strong>','</strong>') ?> <br />
                          <?=sprintf(gettext("%s4%s -- Normal usage range."),'<strong>','</strong>') ?> <br />
1525 1526
                          <?=sprintf(gettext("%s5%s -- Output R and W characters to the console for each packet read and write, uppercase is used for TCP/UDP packets and lowercase is used for TUN/TAP packets."),'<strong>','</strong>') ?> <br />
                          <?=sprintf(gettext("%s6%s-%s11%s -- Debug info range."),'<strong>','</strong>','<strong>','</strong>') ?>
Ad Schellevis's avatar
Ad Schellevis committed
1527 1528 1529 1530 1531 1532 1533 1534
                        </div>
                      </td>
                    </tr>
                    <tr>
                      <td width="22%">&nbsp;</td>
                      <td width="78%">
                        <input name="save" type="submit" class="btn btn-primary" value="<?=gettext("Save"); ?>" />
                        <input name="act" type="hidden" value="<?=$act;?>" />
1535 1536
<?php
                        if (isset($id) && $a_server[$id]) :?>
Ad Schellevis's avatar
Ad Schellevis committed
1537
                        <input name="id" type="hidden" value="<?=htmlspecialchars($id);?>" />
1538 1539
<?php
                        endif; ?>
Ad Schellevis's avatar
Ad Schellevis committed
1540 1541 1542 1543
                      </td>
                    </tr>
                  </table>
                </div>
1544 1545 1546 1547
               </div>
             </section>
           </form>

1548 1549
<?php
              else :?>
1550 1551
          <section class="col-xs-12">
            <div class="tab-content content-box col-xs-12">
1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566
              <table class="table table-striped">
                <thead>
                <tr>
                  <td></td>
                  <td><?=gettext("Protocol / Port"); ?></td>
                  <td><?=gettext("Tunnel Network"); ?></td>
                  <td><?=gettext("Description"); ?></td>
                  <td></td>
                </tr>
                </thead>

                <tbody>
<?php
                  $i = 0;
                  foreach ($a_server as $server) :?>
Ad Schellevis's avatar
Ad Schellevis committed
1567
                  <tr>
1568 1569 1570 1571 1572 1573 1574 1575 1576
                    <td>
                      <a href="#" class="act_toggle" data-id="<?=$i;?>" data-toggle="tooltip" title="<?=(empty($server['disable'])) ? gettext("disable") : gettext("enable");?>">
                        <span class="glyphicon glyphicon-play <?=(empty($server['disable'])) ? "text-success" : "text-muted";?>"></span>
                      </a>
                    </td>
                    <td>
                        <?=htmlspecialchars($server['protocol']);?> / <?=htmlspecialchars($server['local_port']);?>
                    </td>
                    <td>
1577 1578
                        <?=htmlspecialchars($server['tunnel_network']);?> <?=!empty($server['tunnel_networkv6']) ? "," :""?>
                        <?=htmlspecialchars($server['tunnel_networkv6']);?>
1579 1580
                    </td>
                    <td>
1581
                        <?=htmlspecialchars($server['description']);?>
1582 1583 1584 1585 1586
                    </td>
                    <td>
                        <a href="vpn_openvpn_server.php?act=edit&amp;id=<?=$i;?>" title="<?=gettext("edit server"); ?>" class="btn btn-default btn-xs"><span class="glyphicon glyphicon-pencil"></span></a>
                        <a id="del_<?=$i;?>" title="<?=gettext("delete server"); ?>" class="act_delete btn btn-default btn-xs"><span class="fa fa-trash text-muted"></span></a>
                    </td>
Ad Schellevis's avatar
Ad Schellevis committed
1587
                  </tr>
1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599
<?php
                  $i++;
                  endforeach;?>
                  <tr><td colspan="5">&nbsp;</td></tr>
                </tbody>
                <tfoot>
                  <tr><td colspan="5">
                    <a href="wizard.php?xml=openvpn" class="btn btn-default btn-xs"><span class="fa fa-magic"></span></a>
                    &nbsp;<?=gettext("Use a wizard to setup a new server");?>
                  </td></tr>
                </tfoot>
              </table>
1600 1601
            </div>
          </section>
1602 1603
<?php
              endif; ?>
Ad Schellevis's avatar
Ad Schellevis committed
1604 1605 1606
      </div>
    </div>
  </section>
Ad Schellevis's avatar
Ad Schellevis committed
1607

Ad Schellevis's avatar
Ad Schellevis committed
1608
<?php include("foot.inc"); ?>