From d3b0ec10e756000e5326ec653347f9d2ed842866 Mon Sep 17 00:00:00 2001 From: Angristan Date: Fri, 25 Nov 2016 01:01:10 +0100 Subject: [PATCH] Remove UFW and MASQUERADE See https://github.com/Angristan/OpenVPN-install/commit/17a9d76ae9186975c3ce4edd320334b2b1ef4ba9 --- README.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 141f903..32dfe1c 100644 --- a/README.md +++ b/README.md @@ -22,19 +22,18 @@ On the client-side, it's less problematic, but if you want to use an OpenVPN ser This fork includes the following features : - Every feature of the [original script](https://github.com/Nyr/openvpn-install) - No comp-lzo [compression is a vector for oracle attacks, e.g. CRIME or BREACH](https://github.com/BetterCrypto/Applied-Crypto-Hardening/pull/91#issuecomment-75388575) -- Better encryption (see below) - [Avoid DNS leak on Windows 10](https://community.openvpn.net/openvpn/ticket/605) -- UFW support +- Better encryption (see below) - TLS 1.2 only - Strong ciphers, DH keys and certificates. (see variants) - AES-256-CBC and SHA-512 for HMAC (instead of BF-128-CBC and SHA1) -- Run server in unprivileged mode, reducing risks to the system - TLS-auth to help [thwart DoS attacks](https://openvpn.net/index.php/open-source/documentation/howto.html#security) and provide a 2nd line of defense to the TLS channel. +- Run server in unprivileged mode, reducing risks to the system - [FDN's DNS Servers](http://www.fdn.fr/actions/dns/) - [DNS.WATCH DNS Servers](https://dns.watch/index) - Up-to-date OpenVPN (2.3.11) thanks to [EPEL](http://fedoraproject.org/wiki/EPEL) and [swupdate.openvpn.net](https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos) -- Support for either SNAT or MASQUERADE for forwarding - Choice for UDP or TCP +- Other improvements ## Variants