From 1a0fa9c9b0b2f818de4c143eb350274971afe3c8 Mon Sep 17 00:00:00 2001 From: Stanislas Lange Date: Sun, 2 Aug 2026 14:03:38 +0200 Subject: [PATCH] Update VPN access policy diagram --- README.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 4a9885d..346c42e 100644 --- a/README.md +++ b/README.md @@ -12,19 +12,23 @@ This script is meant to be run on your own server, whether it's a VPS or a dedic Once set up, you will be able to generate client configuration files for every device you want to connect. -By default, each client routes its internet traffic through the server, fully encrypted. You can instead keep internet traffic outside the VPN and allow only selected server-side networks. +Internet routing, access between VPN clients, and access to selected server-side networks can be configured independently. By default, internet routing is enabled and the other paths are disabled. ```mermaid -graph LR +flowchart LR A[Phone] -->|Encrypted| VPN B[Laptop] -->|Encrypted| VPN C[Computer] -->|Encrypted| VPN VPN[OpenVPN Server] - VPN --> I[Internet] + VPN -->|Internet routing
Default: enabled| I[Internet] + VPN -.->|Explicit CIDRs only
Default: disabled| LAN[Home LAN or cloud VPC] + VPN -.->|Client-to-client access
Default: disabled| PEERS[Other VPN clients] ``` +The solid destination path is enabled by default. Dashed destination paths are opt-in. + ## Why OpenVPN? OpenVPN was the de facto standard for open-source VPNs when this script was created. WireGuard came later and is simpler and faster for most use cases. Check out [wireguard-install](https://github.com/angristan/wireguard-install).