[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EFQRAV3FZDWG46MB0RPVJ3":3,"skill-same:01M6EFQRAV3FZDWG46MB0RPVJ3":45},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":18,"linkOnly":19,"markdownContent":20,"markdownBody":20,"frontMatter":21,"refName":22,"commitSha":23,"skillDirectory":24,"forksCount":25,"repositoryHtmlUrl":26,"repositoryHomepageUrl":27,"ownerHtmlUrl":28,"ownerBlogUrl":6,"ownerDescription":29,"updatedAt":30,"install":31,"resources":44},"01M6EFQRAV3FZDWG46MB0RPVJ3","openvpn",null,"ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002FTerminalSkills\u002Fskills\u002Fopenvpn\u002FSKILL.md",[],[5],"2026-11-10 10:12:30",false,"# OpenVPN\n\n## Overview\n\nDeploy and manage OpenVPN — the industry-standard open-source VPN. This skill covers full server setup with PKI (EasyRSA), client certificate management, routing modes (TUN\u002FTAP), split tunneling, site-to-site links, MFA integration, performance tuning, and monitoring. Suitable for remote access VPN, connecting offices, and securing traffic on untrusted networks.\n\n## Instructions\n\n### Step 1: Server Installation & PKI Setup\n\n```bash\n# Ubuntu\u002FDebian\napt update && apt install -y openvpn easy-rsa\n\n# Initialize PKI\nmake-cadir ~\u002Fopenvpn-ca && cd ~\u002Fopenvpn-ca\ncat > vars \u003C\u003C'EOF'\nset_var EASYRSA_REQ_COUNTRY    \"US\"\nset_var EASYRSA_REQ_PROVINCE   \"California\"\nset_var EASYRSA_REQ_CITY       \"San Francisco\"\nset_var EASYRSA_REQ_ORG        \"MyCompany\"\nset_var EASYRSA_REQ_EMAIL      \"admin@company.com\"\nset_var EASYRSA_ALGO           ec\nset_var EASYRSA_CURVE          secp384r1\nset_var EASYRSA_CA_EXPIRE      3650\nset_var EASYRSA_CERT_EXPIRE    825\nEOF\n\n.\u002Feasyrsa init-pki\n.\u002Feasyrsa build-ca nopass\n\n# Server certificate + DH + TLS auth\n.\u002Feasyrsa gen-req server nopass\n.\u002Feasyrsa sign-req server server\n.\u002Feasyrsa gen-dh\nopenvpn --genkey secret ta.key\n\n# Copy to OpenVPN\ncp pki\u002Fca.crt pki\u002Fissued\u002Fserver.crt pki\u002Fprivate\u002Fserver.key pki\u002Fdh.pem ta.key \u002Fetc\u002Fopenvpn\u002Fserver\u002F\n```\n\n### Step 2: Server Configuration\n\n**`\u002Fetc\u002Fopenvpn\u002Fserver\u002Fserver.conf`:**\n```ini\nport 1194\nproto udp\ndev tun\nca ca.crt\ncert server.crt\nkey server.key\ndh dh.pem\ntls-auth ta.key 0\n\nserver 10.8.0.0 255.255.255.0\ntopology subnet\npush \"redirect-gateway def1 bypass-dhcp\"\npush \"dhcp-option DNS 1.1.1.1\"\npush \"dhcp-option DNS 1.0.0.1\"\nkeepalive 10 120\n\ncipher AES-256-GCM\nauth SHA384\ntls-version-min 1.2\nuser nobody\ngroup nogroup\npersist-key\npersist-tun\n\nstatus \u002Fvar\u002Flog\u002Fopenvpn\u002Fstatus.log\nlog-append \u002Fvar\u002Flog\u002Fopenvpn\u002Fopenvpn.log\nverb 3\nmax-clients 100\ncrl-verify \u002Fetc\u002Fopenvpn\u002Fserver\u002Fcrl.pem\n```\n\n**Enable forwarding and NAT:**\n```bash\necho \"net.ipv4.ip_forward = 1\" >> \u002Fetc\u002Fsysctl.conf && sysctl -p\nIFACE=$(ip route get 1.1.1.1 | awk '{print $5; exit}')\niptables -t nat -A POSTROUTING -s 10.8.0.0\u002F24 -o \"$IFACE\" -j MASQUERADE\napt install -y iptables-persistent && netfilter-persistent save\nsystemctl enable --now openvpn-server@server\n```\n\n### Step 3: Client Certificate & Profile Generation\n\n```bash\ncd ~\u002Fopenvpn-ca\n.\u002Feasyrsa gen-req alice nopass\n.\u002Feasyrsa sign-req client alice\n```\n\n**Generate a self-contained .ovpn file:**\n```bash\n#!\u002Fbin\u002Fbash\n# generate-client.sh\nCLIENT=$1; CA_DIR=~\u002Fopenvpn-ca; SERVER_IP=\"your.server.ip\"\ncat > ~\u002Fclient-configs\u002F$CLIENT.ovpn \u003C\u003CEOF\nclient\ndev tun\nproto udp\nremote $SERVER_IP 1194\nresolv-retry infinite\nnobind\npersist-key\npersist-tun\nremote-cert-tls server\ncipher AES-256-GCM\nauth SHA384\nkey-direction 1\nverb 3\n\u003Cca>\n$(cat \"$CA_DIR\u002Fpki\u002Fca.crt\")\n\u003C\u002Fca>\n\u003Ccert>\n$(sed -n '\u002FBEGIN CERTIFICATE\u002F,\u002FEND CERTIFICATE\u002Fp' \"$CA_DIR\u002Fpki\u002Fissued\u002F$CLIENT.crt\")\n\u003C\u002Fcert>\n\u003Ckey>\n$(cat \"$CA_DIR\u002Fpki\u002Fprivate\u002F$CLIENT.key\")\n\u003C\u002Fkey>\n\u003Ctls-auth>\n$(cat \"$CA_DIR\u002Fta.key\")\n\u003C\u002Ftls-auth>\nEOF\necho \"Created: ~\u002Fclient-configs\u002F$CLIENT.ovpn\"\n```\n\n### Step 4: Split Tunneling & Site-to-Site\n\n**Split tunnel** — only route specific networks through VPN:\n```ini\n# Server: replace redirect-gateway with specific routes\npush \"route 10.0.0.0 255.0.0.0\"\npush \"route 192.168.0.0 255.255.0.0\"\n```\n\n**Client-side override:**\n```ini\nroute-nopull\nroute 10.0.0.0 255.0.0.0\nroute 192.168.1.0 255.255.255.0\n```\n\n**Site-to-site** — connect two offices:\n```ini\n# Office A (server): route to Office B LAN\nifconfig 10.9.0.1 10.9.0.2\nroute 192.168.2.0 255.255.255.0\n\n# Office B (client): route to Office A LAN\nremote office-a.example.com 1195\nifconfig 10.9.0.2 10.9.0.1\nroute 192.168.1.0 255.255.255.0\n```\n\n### Step 5: MFA & Client Revocation\n\n**Add TOTP (Google Authenticator):**\n```bash\napt install -y libpam-google-authenticator\nsu - vpnuser -c \"google-authenticator -t -d -f -r 3 -R 30 -w 3\"\n```\n\nAdd to server.conf: `plugin \u002Fusr\u002Flib\u002Fopenvpn\u002Fopenvpn-plugin-auth-pam.so openvpn`\nClient adds: `auth-user-pass`\n\n**Revoke a client:**\n```bash\ncd ~\u002Fopenvpn-ca\n.\u002Feasyrsa revoke alice\n.\u002Feasyrsa gen-crl\ncp pki\u002Fcrl.pem \u002Fetc\u002Fopenvpn\u002Fserver\u002Fcrl.pem\nsystemctl restart openvpn-server@server\n```\n\n### Step 6: Monitoring & Performance\n\n```bash\n# Connected clients\ncat \u002Fvar\u002Flog\u002Fopenvpn\u002Fstatus.log\n\n# Management interface (add to server.conf: management 127.0.0.1 7505)\necho \"status\" | nc 127.0.0.1 7505\necho \"kill alice\" | nc 127.0.0.1 7505\n```\n\n**Performance tuning** (add to server.conf):\n```ini\nsndbuf 0\nrcvbuf 0\npush \"sndbuf 393216\"\npush \"rcvbuf 393216\"\nfragment 1400\nmssfix 1400\n```\n\n## Examples\n\n### Example 1: Deploy a full OpenVPN server with client provisioning\n**User prompt:** \"Set up an OpenVPN server on our Ubuntu 22.04 VPS at 198.51.100.25. Create a full PKI with EasyRSA, configure UDP on port 1194 with AES-256-GCM, push DNS 1.1.1.1 to clients, and generate .ovpn profiles for alice, bob, and carol.\"\n\nThe agent will install openvpn and easy-rsa, initialize a PKI with EC keys (secp384r1), build a CA, generate server and three client certificates, create a server.conf with UDP\u002FTUN\u002FAES-256-GCM and NAT masquerading, write a `generate-client.sh` script, produce self-contained `.ovpn` files for alice, bob, and carol with embedded certificates, enable IP forwarding, persist iptables rules, and start the service.\n\n### Example 2: Add TOTP two-factor authentication to an existing OpenVPN server\n**User prompt:** \"Our OpenVPN server is running but we need to add Google Authenticator MFA. Set it up so each user needs their certificate plus a TOTP code to connect.\"\n\nThe agent will install `libpam-google-authenticator`, create a PAM config at `\u002Fetc\u002Fpam.d\u002Fopenvpn` requiring the Google Authenticator module, add the PAM plugin directive to server.conf, run `google-authenticator` setup for each VPN system user, add `auth-user-pass` to the client `.ovpn` templates, and restart the OpenVPN service. It will explain that users enter their username and TOTP code when prompted.\n\n## Guidelines\n\n- Always use `tls-auth` or `tls-crypt` to add an HMAC firewall that drops unauthenticated packets before they reach the TLS stack\n- Use elliptic curve keys (`EASYRSA_ALGO ec`, `EASYRSA_CURVE secp384r1`) for faster handshakes and stronger security than RSA-2048\n- Keep the CA private key offline or on a separate machine; if compromised, an attacker can issue valid client certificates\n- Set `crl-verify` in server.conf and regenerate the CRL after every revocation, or revoked clients will still be able to connect\n- Prefer UDP over TCP for the VPN tunnel to avoid TCP-over-TCP performance degradation; use TCP 443 only as a fallback for restrictive networks\n- Test split tunnel configurations by checking client routing tables (`ip route`) after connecting to verify only intended traffic routes through the VPN\n",{},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002FTerminalSkills\u002Fskills\u002Fopenvpn",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":7,"skillName":5,"commands":32,"prompt":42,"zipAvailable":43},[33,36,39],{"tool":34,"command":35},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill openvpn",{"tool":37,"command":38},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill openvpn",{"tool":40,"command":41},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill openvpn","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002FTerminalSkills\u002Fskills\u002Fopenvpn\u002FSKILL.md",true,[],[46,60,70,79,85,92],{"skillNo":47,"name":48,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":49,"categories":50,"keywords":56,"publishedAt":18},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[51],{"categoryNo":52,"categoryName":53,"taxonomyType":54,"taxonomyTypeDesc":55},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[57,58,59],"model","model hierarchy","model hierarchy skill",{"skillNo":61,"name":62,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":63,"categories":64,"keywords":66,"publishedAt":18},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[65],{"categoryNo":52,"categoryName":53,"taxonomyType":54,"taxonomyTypeDesc":55},[67,68,69],"MCP","zoom","zoom mcp",{"skillNo":71,"name":72,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":73,"categories":74,"keywords":75,"publishedAt":18},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[76,77,78,68],"sdk","zoom apps sdk","apps",{"skillNo":80,"name":81,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":18},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[81],{"skillNo":86,"name":87,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":91,"publishedAt":18},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[90],{"categoryNo":52,"categoryName":53,"taxonomyType":54,"taxonomyTypeDesc":55},[87],{"skillNo":93,"name":94,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":18},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[94]]