Index: npl/internetserver/openvpn_conf/root/etc/cron.monthly/openvpn_regen_crl
===================================================================
--- npl/internetserver/openvpn_conf/root/etc/cron.monthly/openvpn_regen_crl	(revision 26ffad77000ead3839f0b4ca05a51545ff3ac867)
+++ 	(revision )
@@ -1,6 +1,0 @@
-#!/bin/bash
-
-
-cd /etc/openvpn
-./easyrsa gen-crl  &>/dev/null
-
Index: npl/internetserver/openvpn_conf/root/etc/openvpn/openvpn.conf
===================================================================
--- npl/internetserver/openvpn_conf/root/etc/openvpn/openvpn.conf	(revision 26ffad77000ead3839f0b4ca05a51545ff3ac867)
+++ npl/internetserver/openvpn_conf/root/etc/openvpn/openvpn.conf	(revision c5c522c7ca74a4c1725ca5e3fe0bdcadff80e49a)
@@ -1,8 +1,23 @@
-#########################################
-### SYN-3 openvpn configuration
-### This file will be overwritten by updates.
-### Please make changes in /etc/openvpn/openvpn_custom.conf
-##########################################
-
+#################################################
+# Sample OpenVPN 2.0 config file for            #
+# multi-client server.                          #
+#                                               #
+# This file is for the server side              #
+# of a many-clients  one-server                 #
+# OpenVPN configuration.                        #
+#                                               #
+# OpenVPN also supports                         #
+# single-machine  single-machine                #
+# configurations (See the Examples page         #
+# on the web site for more info).               #
+#                                               #
+# This config should work on Windows            #
+# or Linux/BSD systems.  Remember on            #
+# Windows to quote pathnames and use            #
+# double backslashes, e.g.:                     #
+# "C:\\Program Files\\OpenVPN\\config\\foo.key" #
+#                                               #
+# Comments are preceded with '#' or ';'         #
+#################################################
 
 # Which local IP address should OpenVPN
@@ -71,5 +86,5 @@
 #   openssl dhparam -out dh1024.pem 1024
 # Substitute 2048 for 1024 if you are using
-# 2048 bit keys.
+# 2048 bit keys. 
 dh /etc/openvpn/pki/dh.pem
 
@@ -168,5 +183,5 @@
 # a more specific route than the default route
 # of 0.0.0.0/0.0.0.0.
-;push "redirect-gateway"
+push "redirect-gateway"
 
 # Certain Windows-specific network settings
@@ -174,5 +189,5 @@
 # or WINS server addresses.  CAVEAT:
 # http://openvpn.net/faq.html#dhcpcaveats
-;push "dhcp-option DNS 10.8.0.1"
+push "dhcp-option DNS 10.8.0.1"
 ;push "dhcp-option WINS 10.8.0.1"
 
@@ -196,5 +211,5 @@
 # EACH HAVING ITS OWN UNIQUE "COMMON NAME",
 # UNCOMMENT THIS LINE OUT.
-duplicate-cn
+;duplicate-cn
 
 # The keepalive directive causes ping-like
@@ -231,7 +246,5 @@
 # If you enable it here, you must also
 # enable it in the client config file.
-#Disable from now on, see https://community.openvpn.net/openvpn/wiki/VORACLE
-comp-lzo no
-push "comp-lzo no"
+comp-lzo
 
 # The maximum number of concurrently connected
@@ -288,5 +301,2 @@
 plugin /usr/lib/openvpn/plugins/openvpn-plugin-auth-pam.so "openvpn login USERNAME password PASSWORD"
 
-#learn ipsets to allow firewalling on openvpn certificate name
-learn-address /etc/openvpn/update-ipset.sh
-script-security 3
Index: npl/internetserver/openvpn_conf/root/etc/openvpn/openvpn_custom.conf.new
===================================================================
--- npl/internetserver/openvpn_conf/root/etc/openvpn/openvpn_custom.conf.new	(revision 26ffad77000ead3839f0b4ca05a51545ff3ac867)
+++ 	(revision )
@@ -1,3 +1,0 @@
-# Put your custom openvpn setting here. This will not be overwritten by updates.
-
-
Index: npl/internetserver/openvpn_conf/root/etc/openvpn/rules/example_name
===================================================================
--- npl/internetserver/openvpn_conf/root/etc/openvpn/rules/example_name	(revision 26ffad77000ead3839f0b4ca05a51545ff3ac867)
+++ 	(revision )
@@ -1,7 +1,0 @@
-allow_tcp 192.168.70.222 3389
-
-allow_tcp 192.168.70.222 139
-allow_tcp 192.168.70.222 445
-allow_udp 192.168.70.222 445
-allow_udp 192.168.70.222 138
-allow_udp 192.168.70.222 137
Index: npl/internetserver/openvpn_conf/root/etc/openvpn/template.ovpn
===================================================================
--- npl/internetserver/openvpn_conf/root/etc/openvpn/template.ovpn	(revision 26ffad77000ead3839f0b4ca05a51545ff3ac867)
+++ npl/internetserver/openvpn_conf/root/etc/openvpn/template.ovpn	(revision c5c522c7ca74a4c1725ca5e3fe0bdcadff80e49a)
@@ -96,6 +96,5 @@
 # Don't enable this unless it is also
 # enabled in the server config file.
-#No, see https://community.openvpn.net/openvpn/wiki/VORACLE
-#comp-lzo
+comp-lzo
 
 # Set log file verbosity.
Index: npl/internetserver/openvpn_conf/root/etc/openvpn/update-ipset.sh
===================================================================
--- npl/internetserver/openvpn_conf/root/etc/openvpn/update-ipset.sh	(revision 26ffad77000ead3839f0b4ca05a51545ff3ac867)
+++ 	(revision )
@@ -1,29 +1,0 @@
-#!/bin/bash
-
-# Openvpn iptables rules based on certificate name.
-# (C)2018 SYN-3 edwin@datux.nl
-
-OPERATION=$1
-IP=$2
-CN=$3
-
-
-log()
-{
- logger -t openvpn-update-ipset "$1"
-}
-
-# always make sure the ip doesnt exist in other sets (in case of bugs/openvpn restarts)
-log "Deleting $IP from all ipsets"
-for SET in `ipset list -n|grep ^openvpn_cert_`; do ipset del $SET $IP; done    
-
-
-if [ "$OPERATION" == "add" ] || [ "$OPERATION" == "update" ]; then
-    # add chain
-    log "Adding $IP to ipset openvpn_cert_$CN"
-    ipset create openvpn_cert_$CN hash:ip
-    ipset add openvpn_cert_$CN $IP
-fi
-
-
-exit 0
Index: npl/internetserver/openvpn_conf/root/etc/postinst.d/post.openvpn
===================================================================
--- npl/internetserver/openvpn_conf/root/etc/postinst.d/post.openvpn	(revision c5c522c7ca74a4c1725ca5e3fe0bdcadff80e49a)
+++ npl/internetserver/openvpn_conf/root/etc/postinst.d/post.openvpn	(revision c5c522c7ca74a4c1725ca5e3fe0bdcadff80e49a)
@@ -0,0 +1,56 @@
+#!/bin/bash
+
+set -e
+
+cd /etc/openvpn
+
+
+#basic setup
+if ! [ -e pki ]; then
+	./easyrsa init-pki
+fi
+
+#create ca cert
+if ! [ -e pki/ca.crt ]; then
+	echo syn3 | ./easyrsa build-ca nopass
+fi
+
+#create server cert
+if ! [ -e pki/issued/server.crt ]; then
+	./easyrsa build-server-full server nopass
+fi
+
+#create dh parameters
+if ! [ -e pki/dh.pem ]; then
+	./easyrsa gen-dh
+fi
+
+#create CRL list
+if ! [ -e pki/crl.pem ]; then
+	./easyrsa gen-crl
+fi
+
+#openvpn group
+if ! ( getent group | grep "OpenVPN access" &> /dev/null ) ; then
+ smbldap-groupadd -g 521 "OpenVPN access" || exit 1;
+fi
+
+#openvpn ipblock
+NAME="OpenVPN clients"
+if ! grep "$NAME" /etc/firewall/ipblocks; then
+	echo "$NAME='10.8.0.0/24'" >> /etc/firewall/ipblocks
+fi
+
+
+
+
+#create tlsauth key
+if ! [ -e pki/ta.key ]; then
+        openvpn --genkey --secret pki/ta.key
+fi
+
+
+
+#example
+#./syn3-client bla.linuxsysteem.nl gerard
+
Index: npl/internetserver/openvpn_conf/root/service/openvpn/run
===================================================================
--- npl/internetserver/openvpn_conf/root/service/openvpn/run	(revision 26ffad77000ead3839f0b4ca05a51545ff3ac867)
+++ npl/internetserver/openvpn_conf/root/service/openvpn/run	(revision c5c522c7ca74a4c1725ca5e3fe0bdcadff80e49a)
@@ -1,57 +1,6 @@
 #!/bin/bash
-
-set -e
-
-cd /etc/openvpn
-
-# key generation moved here, otherwise it takes too long (now the system is generating more entrophy because it continues to start)
-
-
-#basic setup
-if ! [ -e pki ]; then
-	./easyrsa init-pki
-fi
-
-#create ca cert
-if ! [ -e pki/ca.crt ]; then
-	echo syn3 | ./easyrsa build-ca nopass
-fi
-
-#create server cert
-if ! [ -e pki/issued/server.crt ]; then
-	./easyrsa build-server-full server nopass
-fi
-
-#create dh parameters
-if ! [ -e pki/dh.pem ]; then
-	./easyrsa gen-dh
-fi
-
-#create CRL list
-if ! [ -e pki/crl.pem ]; then
-	./easyrsa gen-crl
-fi
-
-#openvpn group
-if ! ( getent group | grep "OpenVPN access" &> /dev/null ) ; then
- smbldap-groupadd -g 521 "OpenVPN access" || exit 1;
-fi
-
-#openvpn ipblock
-NAME="OpenVPN clients"
-if ! grep "$NAME" /etc/firewall/ipblocks; then
-	echo "$NAME='10.8.0.0/24'" >> /etc/firewall/ipblocks
-fi
-
-#create tlsauth key
-if ! [ -e pki/ta.key ]; then
-        openvpn --genkey --secret pki/ta.key
-fi
-
-#make sure this is done (otherwise crl expire error after updating to this openvpn version)
-/etc/cron.monthly/openvpn_regen_crl
-
 
 modprobe tun
 
-exec openvpn --config openvpn.conf --config openvpn_syn3.conf  --config openvpn_custom.conf
+cd /etc/openvpn
+exec openvpn --config openvpn.conf
