[{"data":1,"prerenderedAt":3391},["ShallowReactive",2],{"nav-products":3,"product-doc-gate-1.0.x":10,"product-docs-all-gate":1201},[4],{"name":5,"tagline":6,"to":7,"isInternal":8,"icon":9},"Valdras Gate","no VPN licenses to manage","\u002Fproducts\u002Fgate\u002F",true,"\u002Fpublic\u002Fimg\u002Fproducts\u002Fgate\u002Fgate_logo.png",{"id":11,"title":12,"body":13,"description":81,"extension":1194,"meta":1195,"navigation":8,"path":1196,"seo":1197,"stem":1198,"summary":1199,"__hash__":1200},"productDocs\u002Fproducts\u002Fgate\u002Fdocumentation\u002F1.0.x.md","Valdras Gate Server",{"type":14,"value":15,"toc":1164},"minimark",[16,21,25,29,34,37,53,57,64,68,72,75,160,163,224,229,293,305,309,312,335,338,342,345,357,360,364,367,379,391,395,406,410,417,458,469,473,476,488,491,524,530,534,541,585,594,614,617,627,631,644,647,692,695,699,730,733,748,807,810,847,851,898,902,908,968,975,979,982,989,993,999,1014,1017,1029,1032,1035,1074,1078,1081,1094,1098,1124,1128,1133,1136,1141,1144,1149,1152,1157,1160],[17,18,20],"h2",{"id":19},"initial-startup","Initial Startup",[22,23,24],"p",{},"The first boot takes a few minutes longer than a stock AMI because the gateway provisions itself on first launch: the easy-rsa PKI is generated, a server certificate is issued, the OpenVPN service is configured against the VPC's network layout, and the runtime services are started. Subsequent reboots are fast — these one-time steps are skipped.",[17,26,28],{"id":27},"server-connection","Server Connection",[30,31,33],"h3",{"id":32},"using-ssm","Using SSM",[22,35,36],{},"All of our products are designed to support AWS Systems Manager (SSM) right out of the box. We strongly believe in security, and the fewer ports exposed to the public, the better. The SSM service provided by AWS perfectly aligns with this approach.",[22,38,39,40,47,48,52],{},"When you need to connect to an instance, opt for connecting through the ",[41,42,46],"a",{"href":43,"rel":44},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fsystems-manager\u002Flatest\u002Fuserguide\u002Fsession-manager.html",[45],"nofollow","Session Manager",". Once you've gained access, execute the command ",[49,50,51],"code",{},"sudo su ec2-user"," to switch to the user account where all of our tools are located. This ensures you have the appropriate permissions and access to the necessary resources.",[30,54,56],{"id":55},"using-ssh","Using SSH",[22,58,59,60,63],{},"SSH is also available, but is not the recommended path. The AMI ships without any pre-installed SSH keys: you must attach a key pair at instance launch and open port 22 on the security group yourself. The default user is ",[49,61,62],{},"ec2-user",". Prefer SSM Session Manager whenever possible — it requires no inbound ports and produces an audit trail.",[17,65,67],{"id":66},"user-management","User Management",[30,69,71],{"id":70},"creating-a-user","Creating a User",[22,73,74],{},"To create a new VPN user, all parameters are required:",[76,77,82],"pre",{"className":78,"code":79,"language":80,"meta":81,"style":81},"language-bash shiki shiki-themes github-light github-dark","sudo ov_user_add --first-name John \\\n                 --last-name Doe \\\n                 --email john.doe@example.com \\\n                 --traffic all \\\n                 --expiration-date 2026-12-31 \\\n                 --creation-reason \"Remote access for Q4 project\"\n","bash","",[49,83,84,107,118,129,140,151],{"__ignoreMap":81},[85,86,89,93,97,101,104],"span",{"class":87,"line":88},"line",1,[85,90,92],{"class":91},"sScJk","sudo",[85,94,96],{"class":95},"sZZnC"," ov_user_add",[85,98,100],{"class":99},"sj4cs"," --first-name",[85,102,103],{"class":95}," John",[85,105,106],{"class":99}," \\\n",[85,108,110,113,116],{"class":87,"line":109},2,[85,111,112],{"class":99},"                 --last-name",[85,114,115],{"class":95}," Doe",[85,117,106],{"class":99},[85,119,121,124,127],{"class":87,"line":120},3,[85,122,123],{"class":99},"                 --email",[85,125,126],{"class":95}," john.doe@example.com",[85,128,106],{"class":99},[85,130,132,135,138],{"class":87,"line":131},4,[85,133,134],{"class":99},"                 --traffic",[85,136,137],{"class":95}," all",[85,139,106],{"class":99},[85,141,143,146,149],{"class":87,"line":142},5,[85,144,145],{"class":99},"                 --expiration-date",[85,147,148],{"class":95}," 2026-12-31",[85,150,106],{"class":99},[85,152,154,157],{"class":87,"line":153},6,[85,155,156],{"class":99},"                 --creation-reason",[85,158,159],{"class":95}," \"Remote access for Q4 project\"\n",[22,161,162],{},"For routing only remote network traffic via the VPN:",[76,164,166],{"className":78,"code":165,"language":80,"meta":81,"style":81},"sudo ov_user_add --first-name Jane \\\n                 --last-name Smith \\\n                 --email jane.smith@example.com \\\n                 --traffic partial \\\n                 --expiration-date 2026-06-30 \\\n                 --creation-reason \"Access to private subnet\"\n",[49,167,168,181,190,199,208,217],{"__ignoreMap":81},[85,169,170,172,174,176,179],{"class":87,"line":88},[85,171,92],{"class":91},[85,173,96],{"class":95},[85,175,100],{"class":99},[85,177,178],{"class":95}," Jane",[85,180,106],{"class":99},[85,182,183,185,188],{"class":87,"line":109},[85,184,112],{"class":99},[85,186,187],{"class":95}," Smith",[85,189,106],{"class":99},[85,191,192,194,197],{"class":87,"line":120},[85,193,123],{"class":99},[85,195,196],{"class":95}," jane.smith@example.com",[85,198,106],{"class":99},[85,200,201,203,206],{"class":87,"line":131},[85,202,134],{"class":99},[85,204,205],{"class":95}," partial",[85,207,106],{"class":99},[85,209,210,212,215],{"class":87,"line":142},[85,211,145],{"class":99},[85,213,214],{"class":95}," 2026-06-30",[85,216,106],{"class":99},[85,218,219,221],{"class":87,"line":153},[85,220,156],{"class":99},[85,222,223],{"class":95}," \"Access to private subnet\"\n",[225,226,228],"h4",{"id":227},"required-parameters","Required Parameters",[230,231,232,239,245,251,277,287],"ul",{},[233,234,235,238],"li",{},[49,236,237],{},"--first-name",": User's first name",[233,240,241,244],{},[49,242,243],{},"--last-name",": User's last name",[233,246,247,250],{},[49,248,249],{},"--email",": User's email address",[233,252,253,256,257,260,261,264,265],{},[49,254,255],{},"--traffic",": Traffic routing mode (",[49,258,259],{},"all"," or ",[49,262,263],{},"partial",")\n",[230,266,267,272],{},[233,268,269,271],{},[49,270,259],{},": Routes all traffic through the VPN",[233,273,274,276],{},[49,275,263],{},": Routes only traffic to the remote network through the VPN",[233,278,279,282,283,286],{},[49,280,281],{},"--expiration-date",": Profile expiration date in ",[49,284,285],{},"YYYY-MM-DD"," format",[233,288,289,292],{},[49,290,291],{},"--creation-reason",": Justification for creating the profile (for audit purposes)",[22,294,295,296,299,300,304],{},"The ",[49,297,298],{},".ovpn"," profile is emailed to the address specified — see ",[301,302,303],"em",{},"Email Delivery"," below for the required SES setup.",[30,306,308],{"id":307},"deleting-a-user","Deleting a User",[22,310,311],{},"To delete a user, specify their email and traffic type:",[76,313,315],{"className":78,"code":314,"language":80,"meta":81,"style":81},"sudo ov_user_delete --email john.doe@example.com --traffic all\n",[49,316,317],{"__ignoreMap":81},[85,318,319,321,324,327,329,332],{"class":87,"line":88},[85,320,92],{"class":91},[85,322,323],{"class":95}," ov_user_delete",[85,325,326],{"class":99}," --email",[85,328,126],{"class":95},[85,330,331],{"class":99}," --traffic",[85,333,334],{"class":95}," all\n",[22,336,337],{},"This will revoke the user's certificate and update the Certificate Revocation List (CRL).",[30,339,341],{"id":340},"listing-all-users","Listing All Users",[22,343,344],{},"To view all VPN users:",[76,346,348],{"className":78,"code":347,"language":80,"meta":81,"style":81},"sudo ov_user_list\n",[49,349,350],{"__ignoreMap":81},[85,351,352,354],{"class":87,"line":88},[85,353,92],{"class":91},[85,355,356],{"class":95}," ov_user_list\n",[22,358,359],{},"Lists every user with their email, traffic mode, full name, expiration date, and creation timestamp.",[30,361,363],{"id":362},"listing-expired-users","Listing Expired Users",[22,365,366],{},"To view all users with expired profiles:",[76,368,370],{"className":78,"code":369,"language":80,"meta":81,"style":81},"sudo ov_user_list_expired\n",[49,371,372],{"__ignoreMap":81},[85,373,374,376],{"class":87,"line":88},[85,375,92],{"class":91},[85,377,378],{"class":95}," ov_user_list_expired\n",[22,380,381,382,386,387,390],{},"This command is ",[383,384,385],"strong",{},"report-only",": it identifies profiles whose expiration date has passed, but does not revoke or disable them. Expired profiles continue to work until you explicitly run ",[49,388,389],{},"ov_user_delete",". Use this command as part of a regular review cadence to renew or remove stale accounts.",[17,392,394],{"id":393},"backup-and-restore","Backup and Restore",[22,396,397,398,401,402,405],{},"From v1.0.3 the gateway ships two CLI tools — ",[49,399,400],{},"ov_backup"," and ",[49,403,404],{},"ov_restore"," — that capture and re-apply every operator-unique piece of state in a single command. Use them to migrate to a new instance, to roll forward onto a new AMI version, or to keep a disaster-recovery archive off the box.",[30,407,409],{"id":408},"what-is-in-the-archive","What is in the archive",[22,411,412,413,416],{},"A single ",[49,414,415],{},".tar.gz"," file containing:",[230,418,419,426,432,446,452],{},[233,420,421,422,425],{},"The user database (",[49,423,424],{},"\u002Fopt\u002F0x4447\u002Fdb\u002Fusers.db",").",[233,427,428,429,425],{},"The full easy-rsa PKI — CA certificate and private key, every client certificate and private key, the certificate database, and the revocation list (",[49,430,431],{},"\u002Fusr\u002Fshare\u002Feasy-rsa\u002Fpki\u002F",[233,433,434,435,438,439,442,443,425],{},"The operational OpenVPN state — ",[49,436,437],{},"ta.key",", the active ",[49,440,441],{},"crl.pem",", and the client-IP persistence file (",[49,444,445],{},"\u002Fetc\u002Fopenvpn\u002Fserver\u002F",[233,447,448,449,425],{},"DNS, email, and mutt configuration files (",[49,450,451],{},"\u002Fopt\u002F0x4447\u002Fconfigs\u002F",[233,453,454,455,425],{},"The VPN profile email template (",[49,456,457],{},"\u002Fopt\u002F0x4447\u002Ftemplates\u002Fvpn_profile_email.txt",[22,459,460,461,464,465,468],{},"Everything else — the generated OpenVPN server config, iptables state, the ",[49,462,463],{},".done"," first-boot sentinel — is ",[383,466,467],{},"deliberately excluded",", because those files are regenerated against the local VPC at first boot. Restoring them onto a different gateway would push the old gateway's DNS resolvers and routes to your clients.",[30,470,472],{"id":471},"creating-a-backup","Creating a backup",[22,474,475],{},"SSH into the gateway and run:",[76,477,479],{"className":78,"code":478,"language":80,"meta":81,"style":81},"sudo ov_backup\n",[49,480,481],{"__ignoreMap":81},[85,482,483,485],{"class":87,"line":88},[85,484,92],{"class":91},[85,486,487],{"class":95}," ov_backup\n",[22,489,490],{},"No flags, no arguments. The command:",[492,493,494,497,511,514,521],"ol",{},[233,495,496],{},"Runs an all-or-nothing pre-flight check. If any required file is missing, it lists every missing path and exits without writing anything.",[233,498,499,500,503,504,506,507,510],{},"Writes the archive to ",[49,501,502],{},"\u002Fhome\u002Fec2-user\u002Fbackup-\u003Chostname>-\u003CUTC-timestamp>.tar.gz",", owned by ",[49,505,62],{},", mode ",[49,508,509],{},"600",".",[233,512,513],{},"Prints a summary block (users in the database, issued certificates, revoked profiles) so you can sanity-check the contents before copying it off the box.",[233,515,516,517,520],{},"Prints ready-to-paste ",[49,518,519],{},"scp"," commands using both the public and private IPs of the gateway, discovered via IMDSv2.",[233,522,523],{},"Prints a security warning — the archive contains the CA private key, every client's private key, the TLS-auth PSK, and your SES SMTP credentials.",[22,525,526,527,529],{},"Copy the archive off the gateway with one of the printed ",[49,528,519],{}," commands. Encrypt it at rest. Never email it, never put it in chat, never commit it to git.",[30,531,533],{"id":532},"restoring-onto-a-new-gateway","Restoring onto a new gateway",[22,535,536,537,540],{},"Launch a fresh v1.0.3+ instance from the AMI and wait for first boot to complete (",[49,538,539],{},"\u002Fopt\u002F0x4447\u002F.done"," exists). Then copy the archive up and run:",[76,542,544],{"className":78,"code":543,"language":80,"meta":81,"style":81},"sudo ov_restore backup-\u003Chostname>-\u003Ctimestamp>.tar.gz\n",[49,545,546],{"__ignoreMap":81},[85,547,548,550,553,556,560,563,567,570,573,575,578,580,582],{"class":87,"line":88},[85,549,92],{"class":91},[85,551,552],{"class":95}," ov_restore",[85,554,555],{"class":95}," backup-",[85,557,559],{"class":558},"szBVR","\u003C",[85,561,562],{"class":95},"hostnam",[85,564,566],{"class":565},"sVt8B","e",[85,568,569],{"class":558},">",[85,571,572],{"class":95},"-",[85,574,559],{"class":558},[85,576,577],{"class":95},"timestam",[85,579,22],{"class":565},[85,581,569],{"class":558},[85,583,584],{"class":95},".tar.gz\n",[22,586,587,589,590,593],{},[49,588,404],{}," is also all-or-nothing. Three pre-flight checks run against the archive itself ",[383,591,592],{},"before any file is touched on disk",":",[230,595,596,602,608],{},[233,597,598,601],{},[383,599,600],{},"Whitelist"," — every entry inside the archive must be in the known set of paths. Tampered or hand-rolled archives are rejected.",[233,603,604,607],{},[383,605,606],{},"Presence"," — every required file must be there. Partial archives are rejected.",[233,609,610,613],{},[383,611,612],{},"CA certificate sanity"," — the bundled CA certificate must be a parseable X.509 certificate.",[22,615,616],{},"If any check fails, the gateway disk and the OpenVPN service are left untouched.",[22,618,619,620,622,623,626],{},"On success the tool stops the OpenVPN service, extracts the archive, re-asserts owner and mode ",[49,621,509],{}," on every secret file, re-applies the split-DNS rules from the restored ",[49,624,625],{},"dns.conf",", restarts the service, waits for it to settle, and prints a restore summary in the same shape as the backup summary — so you can visually diff the two and confirm nothing was lost.",[30,628,630],{"id":629},"after-a-restore","After a restore",[22,632,633,634,637,638,640,641,510],{},"Move the Elastic IP from the old gateway to the new one ",[383,635,636],{},"before users reconnect",". Existing ",[49,639,298],{}," profiles bake in the public IP at issue time: same IP and every existing profile keeps working with no client-side change; different IP and every profile must be reissued with ",[49,642,643],{},"ov_user_add",[22,645,646],{},"Verify:",[76,648,650],{"className":78,"code":649,"language":80,"meta":81,"style":81},"sudo ov_user_list\nsudo openssl crl -in \u002Fetc\u002Fopenvpn\u002Fserver\u002Fcrl.pem -text -noout | grep -c 'Serial Number'\n",[49,651,652,658],{"__ignoreMap":81},[85,653,654,656],{"class":87,"line":88},[85,655,92],{"class":91},[85,657,356],{"class":95},[85,659,660,662,665,668,671,674,677,680,683,686,689],{"class":87,"line":109},[85,661,92],{"class":91},[85,663,664],{"class":95}," openssl",[85,666,667],{"class":95}," crl",[85,669,670],{"class":99}," -in",[85,672,673],{"class":95}," \u002Fetc\u002Fopenvpn\u002Fserver\u002Fcrl.pem",[85,675,676],{"class":99}," -text",[85,678,679],{"class":99}," -noout",[85,681,682],{"class":558}," |",[85,684,685],{"class":91}," grep",[85,687,688],{"class":99}," -c",[85,690,691],{"class":95}," 'Serial Number'\n",[22,693,694],{},"The user list and revoked-profile count must match the old gateway. Then connect a test client to confirm the new gateway is serving the restored PKI. Once verified, stop and terminate the old instance.",[30,696,698],{"id":697},"caveats","Caveats",[230,700,701,709,715,721],{},[233,702,703,706,707,510],{},[383,704,705],{},"Run as root."," Both commands refuse to run without ",[49,708,92],{},[233,710,711,714],{},[383,712,713],{},"Same major version only."," Archives produced on v1.0.3 are restorable on any v1.0.3+ gateway. Restoring onto v1.0.2 or older is not supported.",[233,716,717,720],{},[383,718,719],{},"The archive is a master secret."," Treat it like a root password — if it ever leaks, rotate the CA and reissue every user.",[233,722,723,726,727,729],{},[383,724,725],{},"No automatic schedule."," ",[49,728,400],{}," runs on demand only. If you want periodic snapshots, schedule it via cron or Systems Manager and copy the resulting file to S3 (with KMS encryption).",[17,731,303],{"id":732},"email-delivery",[22,734,735,736,738,739,744,745,593],{},"When you create a user, their ",[49,737,298],{}," profile is emailed automatically via ",[41,740,743],{"href":741,"rel":742},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fses\u002Flatest\u002Fdg\u002FWelcome.html",[45],"Amazon SES",". Configure SES credentials in ",[49,746,747],{},"\u002Fopt\u002F0x4447\u002Fconfigs\u002Femail.conf",[76,749,751],{"className":78,"code":750,"language":80,"meta":81,"style":81},"AWS_REGION=us-east-1\nSMTP_USERNAME=REPLACE_WITH_YOUR_SES_SMTP_USERNAME\nSMTP_PASSWORD=REPLACE_WITH_YOUR_SES_SMTP_PASSWORD\nFROM_EMAIL=no_reply@example.com\nENVIRONMENT_NAME=VPN Server\n",[49,752,753,764,774,784,794],{"__ignoreMap":81},[85,754,755,758,761],{"class":87,"line":88},[85,756,757],{"class":565},"AWS_REGION",[85,759,760],{"class":558},"=",[85,762,763],{"class":95},"us-east-1\n",[85,765,766,769,771],{"class":87,"line":109},[85,767,768],{"class":565},"SMTP_USERNAME",[85,770,760],{"class":558},[85,772,773],{"class":95},"REPLACE_WITH_YOUR_SES_SMTP_USERNAME\n",[85,775,776,779,781],{"class":87,"line":120},[85,777,778],{"class":565},"SMTP_PASSWORD",[85,780,760],{"class":558},[85,782,783],{"class":95},"REPLACE_WITH_YOUR_SES_SMTP_PASSWORD\n",[85,785,786,789,791],{"class":87,"line":131},[85,787,788],{"class":565},"FROM_EMAIL",[85,790,760],{"class":558},[85,792,793],{"class":95},"no_reply@example.com\n",[85,795,796,799,801,804],{"class":87,"line":142},[85,797,798],{"class":565},"ENVIRONMENT_NAME",[85,800,760],{"class":558},[85,802,803],{"class":95},"VPN",[85,805,806],{"class":91}," Server\n",[22,808,809],{},"Notes:",[230,811,812,826,835,842],{},[233,813,814,401,816,818,819,822,823,510],{},[49,815,768],{},[49,817,778],{}," are SES ",[383,820,821],{},"SMTP credentials",", not your AWS access key\u002Fsecret. Generate them in the SES console: ",[301,824,825],{},"Account dashboard → SMTP settings → Create SMTP credentials",[233,827,828,830,831,834],{},[49,829,788],{}," must be a ",[383,832,833],{},"verified identity"," in the SES region you configured (a verified address or a verified domain).",[233,836,837,838,841],{},"While your SES account is in ",[383,839,840],{},"sandbox mode",", recipient addresses must also be verified. Request production access in the SES console to send to arbitrary recipients.",[233,843,844,846],{},[49,845,798],{}," appears in the email body to help recipients identify which gateway issued the profile.",[17,848,850],{"id":849},"vpn-clients","VPN Clients",[230,852,853,879],{},[233,854,855,856],{},"Desktop\n",[230,857,858,865,872],{},[233,859,860],{},[41,861,864],{"href":862,"rel":863},"https:\u002F\u002Fopenvpn.net\u002Fclient-connect-vpn-for-windows\u002F",[45],"Windows",[233,866,867],{},[41,868,871],{"href":869,"rel":870},"https:\u002F\u002Fopenvpn.net\u002Fclient-connect-vpn-for-mac-os\u002F",[45],"MacOS",[233,873,874],{},[41,875,878],{"href":876,"rel":877},"https:\u002F\u002Fopenvpn.net\u002Fvpn-server-resources\u002Fhow-to-connect-to-access-server-from-a-linux-computer\u002F",[45],"Linux",[233,880,881,882],{},"Mobile\n",[230,883,884,891],{},[233,885,886],{},[41,887,890],{"href":888,"rel":889},"https:\u002F\u002Fapps.apple.com\u002Fus\u002Fapp\u002Fopenvpn-connect\u002Fid590379981",[45],"iOS",[233,892,893],{},[41,894,897],{"href":895,"rel":896},"https:\u002F\u002Fplay.google.com\u002Fstore\u002Fapps\u002Fdetails?id=net.openvpn.openvpn&hl=en",[45],"Android",[17,899,901],{"id":900},"troubleshooting","Troubleshooting",[22,903,904,905,510],{},"The OpenVPN service runs as ",[49,906,907],{},"openvpn@0x4447-udp.service",[909,910,911,924],"table",{},[912,913,914],"thead",{},[915,916,917,921],"tr",{},[918,919,920],"th",{},"Goal",[918,922,923],{},"Command",[925,926,927,938,948,958],"tbody",{},[915,928,929,933],{},[930,931,932],"td",{},"Check service status",[930,934,935],{},[49,936,937],{},"sudo systemctl status openvpn@0x4447-udp",[915,939,940,943],{},[930,941,942],{},"Tail live logs",[930,944,945],{},[49,946,947],{},"sudo journalctl -u openvpn@0x4447-udp -f",[915,949,950,953],{},[930,951,952],{},"Restart the service",[930,954,955],{},[49,956,957],{},"sudo systemctl restart openvpn@0x4447-udp",[915,959,960,963],{},[930,961,962],{},"Inspect generated server config",[930,964,965],{},[49,966,967],{},"sudo cat \u002Fetc\u002Fopenvpn\u002Fudp-server.conf",[22,969,970,971,974],{},"The server config (",[49,972,973],{},"\u002Fetc\u002Fopenvpn\u002Fudp-server.conf",") is regenerated on every boot. Do not edit it directly.",[17,976,978],{"id":977},"dns-routing-advanced","DNS Routing (advanced)",[22,980,981],{},"By default the gateway pushes its own resolver (the VPC DNS) to every connected client, so all DNS queries flow through the VPN. Most customers do not need to change this.",[22,983,984,985,988],{},"For hybrid networks — where some domains live in AWS Route 53 Private Hosted Zones, and others must resolve against on-prem DNS — you can configure ",[383,986,987],{},"per-domain DNS routing"," (split-DNS). Clients send queries for the listed suffixes through the VPN's DNS, and use their own local resolver for everything else.",[30,990,992],{"id":991},"configuring-domain-routes","Configuring Domain Routes",[22,994,995,996,593],{},"Edit ",[49,997,998],{},"\u002Fopt\u002F0x4447\u002Fconfigs\u002Fdns.conf",[76,1000,1002],{"className":78,"code":1001,"language":80,"meta":81,"style":81},"VPN_DNS_DOMAIN_ROUTES=\"internal.acme.com corp.acme.local\"\n",[49,1003,1004],{"__ignoreMap":81},[85,1005,1006,1009,1011],{"class":87,"line":88},[85,1007,1008],{"class":565},"VPN_DNS_DOMAIN_ROUTES",[85,1010,760],{"class":558},[85,1012,1013],{"class":95},"\"internal.acme.com corp.acme.local\"\n",[22,1015,1016],{},"Apply the change without rebooting:",[76,1018,1020],{"className":78,"code":1019,"language":80,"meta":81,"style":81},"sudo \u002Fopt\u002F0x4447\u002Flib\u002Fdns_routes_apply.sh\n",[49,1021,1022],{"__ignoreMap":81},[85,1023,1024,1026],{"class":87,"line":88},[85,1025,92],{"class":91},[85,1027,1028],{"class":95}," \u002Fopt\u002F0x4447\u002Flib\u002Fdns_routes_apply.sh\n",[22,1030,1031],{},"The helper rewrites the DNS push directives in the OpenVPN server config and reloads the service. Already-connected clients pick up the new routes on their next reconnect.",[30,1033,698],{"id":1034},"caveats-1",[230,1036,1037,1050,1064],{},[233,1038,1039,1046,1047,1049],{},[383,1040,1041,1042,1045],{},"Only meaningful for ",[49,1043,1044],{},"--traffic partial"," profiles."," Full-tunnel (",[49,1048,259],{},") profiles route every packet through the VPN, including DNS, so per-domain routing has no effect there.",[233,1051,1052,1055,1056,1059,1060,1063],{},[383,1053,1054],{},"Client compatibility:"," OpenVPN Connect 3.x (Windows, macOS, iOS, Android) and Tunnelblick honour ",[49,1057,1058],{},"DOMAIN-ROUTE",". NetworkManager-openvpn honours it when paired with ",[49,1061,1062],{},"systemd-resolved",". Older clients silently fall back to using the pushed DNS for every query.",[233,1065,1066,1069,1070,1073],{},[383,1067,1068],{},"Empty value = default behaviour."," If ",[49,1071,1072],{},"VPN_DNS_DOMAIN_ROUTES=\"\"",", no per-domain routes are pushed.",[17,1075,1077],{"id":1076},"iam-requirements","IAM Requirements",[22,1079,1080],{},"The instance profile attached to the gateway must allow:",[230,1082,1083,1088],{},[233,1084,1085],{},[49,1086,1087],{},"ec2:DescribeRouteTables",[233,1089,1090,1093],{},[49,1091,1092],{},"AmazonSSMManagedInstanceCore"," (AWS-managed policy) — required if you want to connect via SSM Session Manager.",[17,1095,1097],{"id":1096},"features","Features",[230,1099,1100,1106,1112,1118],{},[233,1101,1102,1105],{},[383,1103,1104],{},"Unlimited Users",": Supports an unlimited number of users, ensuring scalability for your growing needs.",[233,1107,1108,1111],{},[383,1109,1110],{},"Flexible Traffic Routing",": Route all or specific parts of your traffic through the VPN, giving you complete control over your data flow.",[233,1113,1114,1117],{},[383,1115,1116],{},"Multi-CIDR VPC Support",": Secondary VPC CIDR blocks are auto-detected and pushed to clients — no manual configuration needed.",[233,1119,1120,1123],{},[383,1121,1122],{},"VPC Peering Support",": CIDRs of peer VPCs reachable via active peering connections are auto-discovered and pushed to clients, so users transparently reach resources across peered VPCs.",[17,1125,1127],{"id":1126},"use-cases","Use Cases",[22,1129,1130,593],{},[383,1131,1132],{},"Access to Private AWS Subnets",[22,1134,1135],{},"AWS networks contain subnets, which can be public or private. Private subnets are secure areas not directly accessible from the public internet, housing critical servers and data. The most secure method to access these private subnets is through a VPN deployed in a public subnet. This setup encrypts your connection, allowing safe access to the private subnet and its servers as if they were local to your network, ensuring data security and integrity within AWS environments.",[22,1137,1138,593],{},[383,1139,1140],{},"Secured Internet Connection for Remote Employees",[22,1142,1143],{},"Beyond accessing private resources, this VPN also safeguards the internet connections of remote employees. By routing their traffic through the VPN, all online activities are encrypted, protecting company-sensitive data from potential interception by third parties. This ensures that employees can work securely from any location, preserving confidentiality and data integrity.",[22,1145,1146,593],{},[383,1147,1148],{},"Inter-Office Connectivity",[22,1150,1151],{},"For organizations with multiple office locations, maintaining a secure and reliable inter-office network is crucial. Our VPN solution facilitates the creation of a secure virtual network overlaying the public internet, linking different office locations. This secure network tunnel ensures that data exchanged between offices is encrypted and protected from external threats, enabling seamless collaboration and resource sharing across geographical locations.",[22,1153,1154,593],{},[383,1155,1156],{},"Compliance and Data Protection",[22,1158,1159],{},"Businesses subject to stringent regulatory requirements can benefit significantly from our VPN solution. By encrypting data in transit and providing secure access controls, the VPN helps organizations comply with data protection laws and industry standards. This is particularly important for sectors like healthcare, finance, and legal, where data privacy is paramount.",[1161,1162,1163],"style",{},"html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}",{"title":81,"searchDepth":109,"depth":109,"links":1165},[1166,1167,1171,1177,1184,1185,1186,1187,1191,1192,1193],{"id":19,"depth":109,"text":20},{"id":27,"depth":109,"text":28,"children":1168},[1169,1170],{"id":32,"depth":120,"text":33},{"id":55,"depth":120,"text":56},{"id":66,"depth":109,"text":67,"children":1172},[1173,1174,1175,1176],{"id":70,"depth":120,"text":71},{"id":307,"depth":120,"text":308},{"id":340,"depth":120,"text":341},{"id":362,"depth":120,"text":363},{"id":393,"depth":109,"text":394,"children":1178},[1179,1180,1181,1182,1183],{"id":408,"depth":120,"text":409},{"id":471,"depth":120,"text":472},{"id":532,"depth":120,"text":533},{"id":629,"depth":120,"text":630},{"id":697,"depth":120,"text":698},{"id":732,"depth":109,"text":303},{"id":849,"depth":109,"text":850},{"id":900,"depth":109,"text":901},{"id":977,"depth":109,"text":978,"children":1188},[1189,1190],{"id":991,"depth":120,"text":992},{"id":1034,"depth":120,"text":698},{"id":1076,"depth":109,"text":1077},{"id":1096,"depth":109,"text":1097},{"id":1126,"depth":109,"text":1127},"md",{},"\u002Fproducts\u002Fgate\u002Fdocumentation\u002F1.0.x",{"title":12,"description":81},"products\u002Fgate\u002Fdocumentation\u002F1.0.x","Ready to go VPN server using OpenVPN with no profile limits.","lIQkBKfJ5gO-bV-kApSMys9qhF1Or1ohya1F4iF-8fY",[1202,2014],{"id":11,"title":12,"body":1203,"description":81,"extension":1194,"meta":2012,"navigation":8,"path":1196,"seo":2013,"stem":1198,"summary":1199,"__hash__":1200},{"type":14,"value":1204,"toc":1982},[1205,1207,1209,1211,1213,1215,1222,1224,1228,1230,1232,1234,1288,1290,1344,1346,1388,1394,1396,1398,1416,1418,1420,1422,1432,1434,1436,1438,1448,1454,1456,1462,1464,1468,1494,1500,1502,1504,1514,1516,1536,1540,1542,1546,1578,1584,1598,1600,1606,1608,1616,1618,1652,1654,1656,1678,1680,1689,1735,1737,1763,1765,1800,1802,1806,1850,1854,1856,1858,1862,1864,1868,1880,1882,1892,1894,1896,1920,1922,1924,1934,1936,1954,1956,1960,1962,1966,1968,1972,1974,1978,1980],[17,1206,20],{"id":19},[22,1208,24],{},[17,1210,28],{"id":27},[30,1212,33],{"id":32},[22,1214,36],{},[22,1216,39,1217,47,1220,52],{},[41,1218,46],{"href":43,"rel":1219},[45],[49,1221,51],{},[30,1223,56],{"id":55},[22,1225,59,1226,63],{},[49,1227,62],{},[17,1229,67],{"id":66},[30,1231,71],{"id":70},[22,1233,74],{},[76,1235,1236],{"className":78,"code":79,"language":80,"meta":81,"style":81},[49,1237,1238,1250,1258,1266,1274,1282],{"__ignoreMap":81},[85,1239,1240,1242,1244,1246,1248],{"class":87,"line":88},[85,1241,92],{"class":91},[85,1243,96],{"class":95},[85,1245,100],{"class":99},[85,1247,103],{"class":95},[85,1249,106],{"class":99},[85,1251,1252,1254,1256],{"class":87,"line":109},[85,1253,112],{"class":99},[85,1255,115],{"class":95},[85,1257,106],{"class":99},[85,1259,1260,1262,1264],{"class":87,"line":120},[85,1261,123],{"class":99},[85,1263,126],{"class":95},[85,1265,106],{"class":99},[85,1267,1268,1270,1272],{"class":87,"line":131},[85,1269,134],{"class":99},[85,1271,137],{"class":95},[85,1273,106],{"class":99},[85,1275,1276,1278,1280],{"class":87,"line":142},[85,1277,145],{"class":99},[85,1279,148],{"class":95},[85,1281,106],{"class":99},[85,1283,1284,1286],{"class":87,"line":153},[85,1285,156],{"class":99},[85,1287,159],{"class":95},[22,1289,162],{},[76,1291,1292],{"className":78,"code":165,"language":80,"meta":81,"style":81},[49,1293,1294,1306,1314,1322,1330,1338],{"__ignoreMap":81},[85,1295,1296,1298,1300,1302,1304],{"class":87,"line":88},[85,1297,92],{"class":91},[85,1299,96],{"class":95},[85,1301,100],{"class":99},[85,1303,178],{"class":95},[85,1305,106],{"class":99},[85,1307,1308,1310,1312],{"class":87,"line":109},[85,1309,112],{"class":99},[85,1311,187],{"class":95},[85,1313,106],{"class":99},[85,1315,1316,1318,1320],{"class":87,"line":120},[85,1317,123],{"class":99},[85,1319,196],{"class":95},[85,1321,106],{"class":99},[85,1323,1324,1326,1328],{"class":87,"line":131},[85,1325,134],{"class":99},[85,1327,205],{"class":95},[85,1329,106],{"class":99},[85,1331,1332,1334,1336],{"class":87,"line":142},[85,1333,145],{"class":99},[85,1335,214],{"class":95},[85,1337,106],{"class":99},[85,1339,1340,1342],{"class":87,"line":153},[85,1341,156],{"class":99},[85,1343,223],{"class":95},[225,1345,228],{"id":227},[230,1347,1348,1352,1356,1360,1378,1384],{},[233,1349,1350,238],{},[49,1351,237],{},[233,1353,1354,244],{},[49,1355,243],{},[233,1357,1358,250],{},[49,1359,249],{},[233,1361,1362,256,1364,260,1366,264,1368],{},[49,1363,255],{},[49,1365,259],{},[49,1367,263],{},[230,1369,1370,1374],{},[233,1371,1372,271],{},[49,1373,259],{},[233,1375,1376,276],{},[49,1377,263],{},[233,1379,1380,282,1382,286],{},[49,1381,281],{},[49,1383,285],{},[233,1385,1386,292],{},[49,1387,291],{},[22,1389,295,1390,299,1392,304],{},[49,1391,298],{},[301,1393,303],{},[30,1395,308],{"id":307},[22,1397,311],{},[76,1399,1400],{"className":78,"code":314,"language":80,"meta":81,"style":81},[49,1401,1402],{"__ignoreMap":81},[85,1403,1404,1406,1408,1410,1412,1414],{"class":87,"line":88},[85,1405,92],{"class":91},[85,1407,323],{"class":95},[85,1409,326],{"class":99},[85,1411,126],{"class":95},[85,1413,331],{"class":99},[85,1415,334],{"class":95},[22,1417,337],{},[30,1419,341],{"id":340},[22,1421,344],{},[76,1423,1424],{"className":78,"code":347,"language":80,"meta":81,"style":81},[49,1425,1426],{"__ignoreMap":81},[85,1427,1428,1430],{"class":87,"line":88},[85,1429,92],{"class":91},[85,1431,356],{"class":95},[22,1433,359],{},[30,1435,363],{"id":362},[22,1437,366],{},[76,1439,1440],{"className":78,"code":369,"language":80,"meta":81,"style":81},[49,1441,1442],{"__ignoreMap":81},[85,1443,1444,1446],{"class":87,"line":88},[85,1445,92],{"class":91},[85,1447,378],{"class":95},[22,1449,381,1450,386,1452,390],{},[383,1451,385],{},[49,1453,389],{},[17,1455,394],{"id":393},[22,1457,397,1458,401,1460,405],{},[49,1459,400],{},[49,1461,404],{},[30,1463,409],{"id":408},[22,1465,412,1466,416],{},[49,1467,415],{},[230,1469,1470,1474,1478,1486,1490],{},[233,1471,421,1472,425],{},[49,1473,424],{},[233,1475,428,1476,425],{},[49,1477,431],{},[233,1479,434,1480,438,1482,442,1484,425],{},[49,1481,437],{},[49,1483,441],{},[49,1485,445],{},[233,1487,448,1488,425],{},[49,1489,451],{},[233,1491,454,1492,425],{},[49,1493,457],{},[22,1495,460,1496,464,1498,468],{},[49,1497,463],{},[383,1499,467],{},[30,1501,472],{"id":471},[22,1503,475],{},[76,1505,1506],{"className":78,"code":478,"language":80,"meta":81,"style":81},[49,1507,1508],{"__ignoreMap":81},[85,1509,1510,1512],{"class":87,"line":88},[85,1511,92],{"class":91},[85,1513,487],{"class":95},[22,1515,490],{},[492,1517,1518,1520,1528,1530,1534],{},[233,1519,496],{},[233,1521,499,1522,503,1524,506,1526,510],{},[49,1523,502],{},[49,1525,62],{},[49,1527,509],{},[233,1529,513],{},[233,1531,516,1532,520],{},[49,1533,519],{},[233,1535,523],{},[22,1537,526,1538,529],{},[49,1539,519],{},[30,1541,533],{"id":532},[22,1543,536,1544,540],{},[49,1545,539],{},[76,1547,1548],{"className":78,"code":543,"language":80,"meta":81,"style":81},[49,1549,1550],{"__ignoreMap":81},[85,1551,1552,1554,1556,1558,1560,1562,1564,1566,1568,1570,1572,1574,1576],{"class":87,"line":88},[85,1553,92],{"class":91},[85,1555,552],{"class":95},[85,1557,555],{"class":95},[85,1559,559],{"class":558},[85,1561,562],{"class":95},[85,1563,566],{"class":565},[85,1565,569],{"class":558},[85,1567,572],{"class":95},[85,1569,559],{"class":558},[85,1571,577],{"class":95},[85,1573,22],{"class":565},[85,1575,569],{"class":558},[85,1577,584],{"class":95},[22,1579,1580,589,1582,593],{},[49,1581,404],{},[383,1583,592],{},[230,1585,1586,1590,1594],{},[233,1587,1588,601],{},[383,1589,600],{},[233,1591,1592,607],{},[383,1593,606],{},[233,1595,1596,613],{},[383,1597,612],{},[22,1599,616],{},[22,1601,619,1602,622,1604,626],{},[49,1603,509],{},[49,1605,625],{},[30,1607,630],{"id":629},[22,1609,633,1610,637,1612,640,1614,510],{},[383,1611,636],{},[49,1613,298],{},[49,1615,643],{},[22,1617,646],{},[76,1619,1620],{"className":78,"code":649,"language":80,"meta":81,"style":81},[49,1621,1622,1628],{"__ignoreMap":81},[85,1623,1624,1626],{"class":87,"line":88},[85,1625,92],{"class":91},[85,1627,356],{"class":95},[85,1629,1630,1632,1634,1636,1638,1640,1642,1644,1646,1648,1650],{"class":87,"line":109},[85,1631,92],{"class":91},[85,1633,664],{"class":95},[85,1635,667],{"class":95},[85,1637,670],{"class":99},[85,1639,673],{"class":95},[85,1641,676],{"class":99},[85,1643,679],{"class":99},[85,1645,682],{"class":558},[85,1647,685],{"class":91},[85,1649,688],{"class":99},[85,1651,691],{"class":95},[22,1653,694],{},[30,1655,698],{"id":697},[230,1657,1658,1664,1668,1672],{},[233,1659,1660,706,1662,510],{},[383,1661,705],{},[49,1663,92],{},[233,1665,1666,714],{},[383,1667,713],{},[233,1669,1670,720],{},[383,1671,719],{},[233,1673,1674,726,1676,729],{},[383,1675,725],{},[49,1677,400],{},[17,1679,303],{"id":732},[22,1681,735,1682,738,1684,744,1687,593],{},[49,1683,298],{},[41,1685,743],{"href":741,"rel":1686},[45],[49,1688,747],{},[76,1690,1691],{"className":78,"code":750,"language":80,"meta":81,"style":81},[49,1692,1693,1701,1709,1717,1725],{"__ignoreMap":81},[85,1694,1695,1697,1699],{"class":87,"line":88},[85,1696,757],{"class":565},[85,1698,760],{"class":558},[85,1700,763],{"class":95},[85,1702,1703,1705,1707],{"class":87,"line":109},[85,1704,768],{"class":565},[85,1706,760],{"class":558},[85,1708,773],{"class":95},[85,1710,1711,1713,1715],{"class":87,"line":120},[85,1712,778],{"class":565},[85,1714,760],{"class":558},[85,1716,783],{"class":95},[85,1718,1719,1721,1723],{"class":87,"line":131},[85,1720,788],{"class":565},[85,1722,760],{"class":558},[85,1724,793],{"class":95},[85,1726,1727,1729,1731,1733],{"class":87,"line":142},[85,1728,798],{"class":565},[85,1730,760],{"class":558},[85,1732,803],{"class":95},[85,1734,806],{"class":91},[22,1736,809],{},[230,1738,1739,1749,1755,1759],{},[233,1740,1741,401,1743,818,1745,822,1747,510],{},[49,1742,768],{},[49,1744,778],{},[383,1746,821],{},[301,1748,825],{},[233,1750,1751,830,1753,834],{},[49,1752,788],{},[383,1754,833],{},[233,1756,837,1757,841],{},[383,1758,840],{},[233,1760,1761,846],{},[49,1762,798],{},[17,1764,850],{"id":849},[230,1766,1767,1786],{},[233,1768,855,1769],{},[230,1770,1771,1776,1781],{},[233,1772,1773],{},[41,1774,864],{"href":862,"rel":1775},[45],[233,1777,1778],{},[41,1779,871],{"href":869,"rel":1780},[45],[233,1782,1783],{},[41,1784,878],{"href":876,"rel":1785},[45],[233,1787,881,1788],{},[230,1789,1790,1795],{},[233,1791,1792],{},[41,1793,890],{"href":888,"rel":1794},[45],[233,1796,1797],{},[41,1798,897],{"href":895,"rel":1799},[45],[17,1801,901],{"id":900},[22,1803,904,1804,510],{},[49,1805,907],{},[909,1807,1808,1816],{},[912,1809,1810],{},[915,1811,1812,1814],{},[918,1813,920],{},[918,1815,923],{},[925,1817,1818,1826,1834,1842],{},[915,1819,1820,1822],{},[930,1821,932],{},[930,1823,1824],{},[49,1825,937],{},[915,1827,1828,1830],{},[930,1829,942],{},[930,1831,1832],{},[49,1833,947],{},[915,1835,1836,1838],{},[930,1837,952],{},[930,1839,1840],{},[49,1841,957],{},[915,1843,1844,1846],{},[930,1845,962],{},[930,1847,1848],{},[49,1849,967],{},[22,1851,970,1852,974],{},[49,1853,973],{},[17,1855,978],{"id":977},[22,1857,981],{},[22,1859,984,1860,988],{},[383,1861,987],{},[30,1863,992],{"id":991},[22,1865,995,1866,593],{},[49,1867,998],{},[76,1869,1870],{"className":78,"code":1001,"language":80,"meta":81,"style":81},[49,1871,1872],{"__ignoreMap":81},[85,1873,1874,1876,1878],{"class":87,"line":88},[85,1875,1008],{"class":565},[85,1877,760],{"class":558},[85,1879,1013],{"class":95},[22,1881,1016],{},[76,1883,1884],{"className":78,"code":1019,"language":80,"meta":81,"style":81},[49,1885,1886],{"__ignoreMap":81},[85,1887,1888,1890],{"class":87,"line":88},[85,1889,92],{"class":91},[85,1891,1028],{"class":95},[22,1893,1031],{},[30,1895,698],{"id":1034},[230,1897,1898,1906,1914],{},[233,1899,1900,1046,1904,1049],{},[383,1901,1041,1902,1045],{},[49,1903,1044],{},[49,1905,259],{},[233,1907,1908,1055,1910,1059,1912,1063],{},[383,1909,1054],{},[49,1911,1058],{},[49,1913,1062],{},[233,1915,1916,1069,1918,1073],{},[383,1917,1068],{},[49,1919,1072],{},[17,1921,1077],{"id":1076},[22,1923,1080],{},[230,1925,1926,1930],{},[233,1927,1928],{},[49,1929,1087],{},[233,1931,1932,1093],{},[49,1933,1092],{},[17,1935,1097],{"id":1096},[230,1937,1938,1942,1946,1950],{},[233,1939,1940,1105],{},[383,1941,1104],{},[233,1943,1944,1111],{},[383,1945,1110],{},[233,1947,1948,1117],{},[383,1949,1116],{},[233,1951,1952,1123],{},[383,1953,1122],{},[17,1955,1127],{"id":1126},[22,1957,1958,593],{},[383,1959,1132],{},[22,1961,1135],{},[22,1963,1964,593],{},[383,1965,1140],{},[22,1967,1143],{},[22,1969,1970,593],{},[383,1971,1148],{},[22,1973,1151],{},[22,1975,1976,593],{},[383,1977,1156],{},[22,1979,1159],{},[1161,1981,1163],{},{"title":81,"searchDepth":109,"depth":109,"links":1983},[1984,1985,1989,1995,2002,2003,2004,2005,2009,2010,2011],{"id":19,"depth":109,"text":20},{"id":27,"depth":109,"text":28,"children":1986},[1987,1988],{"id":32,"depth":120,"text":33},{"id":55,"depth":120,"text":56},{"id":66,"depth":109,"text":67,"children":1990},[1991,1992,1993,1994],{"id":70,"depth":120,"text":71},{"id":307,"depth":120,"text":308},{"id":340,"depth":120,"text":341},{"id":362,"depth":120,"text":363},{"id":393,"depth":109,"text":394,"children":1996},[1997,1998,1999,2000,2001],{"id":408,"depth":120,"text":409},{"id":471,"depth":120,"text":472},{"id":532,"depth":120,"text":533},{"id":629,"depth":120,"text":630},{"id":697,"depth":120,"text":698},{"id":732,"depth":109,"text":303},{"id":849,"depth":109,"text":850},{"id":900,"depth":109,"text":901},{"id":977,"depth":109,"text":978,"children":2006},[2007,2008],{"id":991,"depth":120,"text":992},{"id":1034,"depth":120,"text":698},{"id":1076,"depth":109,"text":1077},{"id":1096,"depth":109,"text":1097},{"id":1126,"depth":109,"text":1127},{},{"title":12,"description":81},{"id":2015,"title":12,"body":2016,"description":81,"extension":1194,"meta":3386,"navigation":8,"path":3387,"seo":3388,"stem":3389,"summary":1199,"__hash__":3390},"productDocs\u002Fproducts\u002Fgate\u002Fdocumentation\u002F1.1.x.md",{"type":14,"value":2017,"toc":3348},[2018,2020,2022,2024,2026,2028,2035,2037,2041,2043,2045,2052,2106,2108,2175,2177,2219,2223,2247,2253,2255,2257,2275,2278,2291,2293,2295,2305,2308,2310,2312,2322,2328,2332,2335,2355,2360,2363,2373,2380,2386,2390,2399,2402,2425,2428,2450,2454,2460,2534,2537,2558,2560,2566,2568,2570,2580,2589,2595,2597,2600,2632,2639,2644,2646,2654,2656,2666,2669,2671,2695,2697,2706,2752,2754,2780,2782,2817,2824,2837,2857,2866,2871,2920,2931,2936,2963,2972,2974,2978,3022,3026,3028,3030,3034,3036,3040,3052,3054,3064,3067,3069,3093,3095,3097,3107,3109,3127,3129,3133,3135,3139,3141,3145,3147,3151,3153,3157,3162,3171,3179,3193,3203,3211,3216,3230,3254,3259,3271,3276,3283,3288,3302,3307,3310,3315,3327,3332,3346],[17,2019,20],{"id":19},[22,2021,24],{},[17,2023,28],{"id":27},[30,2025,33],{"id":32},[22,2027,36],{},[22,2029,39,2030,47,2033,52],{},[41,2031,46],{"href":43,"rel":2032},[45],[49,2034,51],{},[30,2036,56],{"id":55},[22,2038,59,2039,63],{},[49,2040,62],{},[17,2042,67],{"id":66},[30,2044,71],{"id":70},[22,2046,2047,2048,2051],{},"To create a new VPN user, all parameters except ",[49,2049,2050],{},"--auto-renew"," are required:",[76,2053,2054],{"className":78,"code":79,"language":80,"meta":81,"style":81},[49,2055,2056,2068,2076,2084,2092,2100],{"__ignoreMap":81},[85,2057,2058,2060,2062,2064,2066],{"class":87,"line":88},[85,2059,92],{"class":91},[85,2061,96],{"class":95},[85,2063,100],{"class":99},[85,2065,103],{"class":95},[85,2067,106],{"class":99},[85,2069,2070,2072,2074],{"class":87,"line":109},[85,2071,112],{"class":99},[85,2073,115],{"class":95},[85,2075,106],{"class":99},[85,2077,2078,2080,2082],{"class":87,"line":120},[85,2079,123],{"class":99},[85,2081,126],{"class":95},[85,2083,106],{"class":99},[85,2085,2086,2088,2090],{"class":87,"line":131},[85,2087,134],{"class":99},[85,2089,137],{"class":95},[85,2091,106],{"class":99},[85,2093,2094,2096,2098],{"class":87,"line":142},[85,2095,145],{"class":99},[85,2097,148],{"class":95},[85,2099,106],{"class":99},[85,2101,2102,2104],{"class":87,"line":153},[85,2103,156],{"class":99},[85,2105,159],{"class":95},[22,2107,162],{},[76,2109,2111],{"className":78,"code":2110,"language":80,"meta":81,"style":81},"sudo ov_user_add --first-name Jane \\\n                 --last-name Smith \\\n                 --email jane.smith@example.com \\\n                 --traffic partial \\\n                 --expiration-date 2026-06-30 \\\n                 --creation-reason \"Access to private subnet\" \\\n                 --auto-renew yes\n",[49,2112,2113,2125,2133,2141,2149,2157,2166],{"__ignoreMap":81},[85,2114,2115,2117,2119,2121,2123],{"class":87,"line":88},[85,2116,92],{"class":91},[85,2118,96],{"class":95},[85,2120,100],{"class":99},[85,2122,178],{"class":95},[85,2124,106],{"class":99},[85,2126,2127,2129,2131],{"class":87,"line":109},[85,2128,112],{"class":99},[85,2130,187],{"class":95},[85,2132,106],{"class":99},[85,2134,2135,2137,2139],{"class":87,"line":120},[85,2136,123],{"class":99},[85,2138,196],{"class":95},[85,2140,106],{"class":99},[85,2142,2143,2145,2147],{"class":87,"line":131},[85,2144,134],{"class":99},[85,2146,205],{"class":95},[85,2148,106],{"class":99},[85,2150,2151,2153,2155],{"class":87,"line":142},[85,2152,145],{"class":99},[85,2154,214],{"class":95},[85,2156,106],{"class":99},[85,2158,2159,2161,2164],{"class":87,"line":153},[85,2160,156],{"class":99},[85,2162,2163],{"class":95}," \"Access to private subnet\"",[85,2165,106],{"class":99},[85,2167,2169,2172],{"class":87,"line":2168},7,[85,2170,2171],{"class":99},"                 --auto-renew",[85,2173,2174],{"class":95}," yes\n",[225,2176,228],{"id":227},[230,2178,2179,2183,2187,2191,2209,2215],{},[233,2180,2181,238],{},[49,2182,237],{},[233,2184,2185,244],{},[49,2186,243],{},[233,2188,2189,250],{},[49,2190,249],{},[233,2192,2193,256,2195,260,2197,264,2199],{},[49,2194,255],{},[49,2196,259],{},[49,2198,263],{},[230,2200,2201,2205],{},[233,2202,2203,271],{},[49,2204,259],{},[233,2206,2207,276],{},[49,2208,263],{},[233,2210,2211,282,2213,286],{},[49,2212,281],{},[49,2214,285],{},[233,2216,2217,292],{},[49,2218,291],{},[225,2220,2222],{"id":2221},"optional-parameters","Optional Parameters",[230,2224,2225],{},[233,2226,2227,2229,2230,260,2233,2236,2237,2239,2240,2242,2243,2246],{},[49,2228,2050],{},": ",[49,2231,2232],{},"yes",[49,2234,2235],{},"no"," (default ",[49,2238,2235],{},"). When ",[49,2241,2232],{},", the gateway automatically issues and emails a fresh profile before this one expires. See ",[301,2244,2245],{},"Automatic Renewal"," below.",[22,2248,295,2249,299,2251,304],{},[49,2250,298],{},[301,2252,303],{},[30,2254,308],{"id":307},[22,2256,311],{},[76,2258,2259],{"className":78,"code":314,"language":80,"meta":81,"style":81},[49,2260,2261],{"__ignoreMap":81},[85,2262,2263,2265,2267,2269,2271,2273],{"class":87,"line":88},[85,2264,92],{"class":91},[85,2266,323],{"class":95},[85,2268,326],{"class":99},[85,2270,126],{"class":95},[85,2272,331],{"class":99},[85,2274,334],{"class":95},[22,2276,2277],{},"This revokes the user's certificate and updates the Certificate Revocation List (CRL).",[22,2279,2280,2282,2283,2286,2287,2290],{},[49,2281,389],{}," identifies the user by their ",[383,2284,2285],{},"(email, traffic)"," pair, not by a single certificate. It revokes ",[383,2288,2289],{},"every"," certificate that pair can still connect with, adds them to the CRL, and restarts OpenVPN so the revocation takes effect immediately. There is no way to target one individual certificate — the command removes the whole user. Once it completes, that user can no longer connect with any profile they were ever issued.",[30,2292,341],{"id":340},[22,2294,344],{},[76,2296,2297],{"className":78,"code":347,"language":80,"meta":81,"style":81},[49,2298,2299],{"__ignoreMap":81},[85,2300,2301,2303],{"class":87,"line":88},[85,2302,92],{"class":91},[85,2304,356],{"class":95},[22,2306,2307],{},"Each row shows the user's email, traffic mode, full name, expiration date, and creation timestamp.",[30,2309,363],{"id":362},[22,2311,366],{},[76,2313,2314],{"className":78,"code":369,"language":80,"meta":81,"style":81},[49,2315,2316],{"__ignoreMap":81},[85,2317,2318,2320],{"class":87,"line":88},[85,2319,92],{"class":91},[85,2321,378],{"class":95},[22,2323,381,2324,386,2326,390],{},[383,2325,385],{},[49,2327,389],{},[30,2329,2331],{"id":2330},"resending-a-profile","Resending a Profile",[22,2333,2334],{},"If a user loses the email or never received it, re-deliver the existing profile to its registered address — no reissue, no new certificate:",[76,2336,2338],{"className":78,"code":2337,"language":80,"meta":81,"style":81},"sudo ov_user_resend --email john.doe@example.com --traffic all\n",[49,2339,2340],{"__ignoreMap":81},[85,2341,2342,2344,2347,2349,2351,2353],{"class":87,"line":88},[85,2343,92],{"class":91},[85,2345,2346],{"class":95}," ov_user_resend",[85,2348,326],{"class":99},[85,2350,126],{"class":95},[85,2352,331],{"class":99},[85,2354,334],{"class":95},[22,2356,295,2357,2359],{},[49,2358,298],{}," on disk is sent as-is; the user database is not modified.",[17,2361,2245],{"id":2362},"automatic-renewal",[22,2364,2365,2366,2368,2369,2372],{},"New in v1.1.0. Certificates are issued with a hard expiration date (",[49,2367,281],{},"). Auto-renewal lets the gateway issue and email a fresh profile ",[383,2370,2371],{},"before"," the current one expires, so users never experience a gap — and the operator does not have to track expiry dates by hand.",[22,2374,2375,2376,2379],{},"Renewal is ",[383,2377,2378],{},"opt-in per profile",". A daily background check looks for profiles that have auto-renew enabled and that fall inside the renewal window (10 days by default). For each one, the gateway issues a fresh profile and emails it to the registered address before the current one lapses. The recipient simply imports the new profile they receive.",[22,2381,2382,2383,510],{},"If a profile cannot be renewed, the existing one is left untouched and the profile is flagged so you can investigate it with ",[49,2384,2385],{},"ov_user_audit --stuck",[30,2387,2389],{"id":2388},"enabling-auto-renew","Enabling Auto-Renew",[22,2391,2392,2393,2396,2397,510],{},"At creation time, pass ",[49,2394,2395],{},"--auto-renew yes"," to ",[49,2398,643],{},[22,2400,2401],{},"For an existing profile, toggle it without reissuing the certificate:",[76,2403,2405],{"className":78,"code":2404,"language":80,"meta":81,"style":81},"sudo ov_user_auto_renew --email john.doe@example.com --traffic all --enable\n",[49,2406,2407],{"__ignoreMap":81},[85,2408,2409,2411,2414,2416,2418,2420,2422],{"class":87,"line":88},[85,2410,92],{"class":91},[85,2412,2413],{"class":95}," ov_user_auto_renew",[85,2415,326],{"class":99},[85,2417,126],{"class":95},[85,2419,331],{"class":99},[85,2421,137],{"class":95},[85,2423,2424],{"class":99}," --enable\n",[22,2426,2427],{},"Disable it the same way:",[76,2429,2431],{"className":78,"code":2430,"language":80,"meta":81,"style":81},"sudo ov_user_auto_renew --email john.doe@example.com --traffic all --disable\n",[49,2432,2433],{"__ignoreMap":81},[85,2434,2435,2437,2439,2441,2443,2445,2447],{"class":87,"line":88},[85,2436,92],{"class":91},[85,2438,2413],{"class":95},[85,2440,326],{"class":99},[85,2442,126],{"class":95},[85,2444,331],{"class":99},[85,2446,137],{"class":95},[85,2448,2449],{"class":99}," --disable\n",[30,2451,2453],{"id":2452},"auditing-renewals","Auditing Renewals",[22,2455,2456,2459],{},[49,2457,2458],{},"ov_user_audit"," provides read-only lenses over the user database (it never writes):",[909,2461,2462,2472],{},[912,2463,2464],{},[915,2465,2466,2469],{},[918,2467,2468],{},"Lens",[918,2470,2471],{},"Shows",[925,2473,2474,2484,2494,2504,2514,2524],{},[915,2475,2476,2481],{},[930,2477,2478],{},[49,2479,2480],{},"--summary",[930,2482,2483],{},"One-line counts (active, expiring, revoked, renewed).",[915,2485,2486,2491],{},[930,2487,2488],{},[49,2489,2490],{},"--expiring [--days N]",[930,2492,2493],{},"Active profiles expiring within N days (default 10).",[915,2495,2496,2501],{},[930,2497,2498],{},[49,2499,2500],{},"--renewed [--since \u003Cdate>] [--until \u003Cdate>]",[930,2502,2503],{},"Profiles renewed in the given window.",[915,2505,2506,2511],{},[930,2507,2508],{},[49,2509,2510],{},"--revoked [--since \u003Cdate>]",[930,2512,2513],{},"Revoked profiles.",[915,2515,2516,2521],{},[930,2517,2518],{},[49,2519,2520],{},"--history --email \u003Caddr> [--traffic \u003Call|partial>]",[930,2522,2523],{},"Full lifecycle of one profile.",[915,2525,2526,2531],{},[930,2527,2528],{},[49,2529,2530],{},"--stuck",[930,2532,2533],{},"Profiles whose auto-renewal failed, with the last log line for each.",[22,2535,2536],{},"Example:",[76,2538,2540],{"className":78,"code":2539,"language":80,"meta":81,"style":81},"sudo ov_user_audit --expiring --days 14\n",[49,2541,2542],{"__ignoreMap":81},[85,2543,2544,2546,2549,2552,2555],{"class":87,"line":88},[85,2545,92],{"class":91},[85,2547,2548],{"class":95}," ov_user_audit",[85,2550,2551],{"class":99}," --expiring",[85,2553,2554],{"class":99}," --days",[85,2556,2557],{"class":99}," 14\n",[17,2559,394],{"id":393},[22,2561,397,2562,401,2564,405],{},[49,2563,400],{},[49,2565,404],{},[30,2567,472],{"id":471},[22,2569,475],{},[76,2571,2572],{"className":78,"code":478,"language":80,"meta":81,"style":81},[49,2573,2574],{"__ignoreMap":81},[85,2575,2576,2578],{"class":87,"line":88},[85,2577,92],{"class":91},[85,2579,487],{"class":95},[22,2581,2582,2583,2585,2586,2588],{},"No flags, no arguments. The command writes a single timestamped archive to the ",[49,2584,62],{}," home directory, prints a summary so you can sanity-check the contents, and prints ready-to-paste ",[49,2587,519],{}," commands for copying it off the box.",[22,2590,2591,2592,2594],{},"The archive holds every private key and credential on the gateway. Copy it off with one of the printed ",[49,2593,519],{}," commands, store it encrypted at rest, and never email it, put it in chat, or commit it to git.",[30,2596,533],{"id":532},[22,2598,2599],{},"Launch a fresh v1.1.0+ instance from the AMI and wait for first boot to complete (the OpenVPN service is up). Then copy the archive up and run:",[76,2601,2602],{"className":78,"code":543,"language":80,"meta":81,"style":81},[49,2603,2604],{"__ignoreMap":81},[85,2605,2606,2608,2610,2612,2614,2616,2618,2620,2622,2624,2626,2628,2630],{"class":87,"line":88},[85,2607,92],{"class":91},[85,2609,552],{"class":95},[85,2611,555],{"class":95},[85,2613,559],{"class":558},[85,2615,562],{"class":95},[85,2617,566],{"class":565},[85,2619,569],{"class":558},[85,2621,572],{"class":95},[85,2623,559],{"class":558},[85,2625,577],{"class":95},[85,2627,22],{"class":565},[85,2629,569],{"class":558},[85,2631,584],{"class":95},[22,2633,2634,2635,2638],{},"To validate an archive without touching disk first, run ",[49,2636,2637],{},"sudo ov_restore --dry-run \u003Cfile>"," — it checks the archive and exits.",[22,2640,2641,2643],{},[49,2642,404],{}," is all-or-nothing. It validates the archive before touching the disk and refuses to proceed on a tampered, incomplete, or invalid archive — if validation fails, the gateway is left untouched. On success it restores your state, restarts the VPN, and prints a restore summary in the same shape as the backup summary, so you can diff the two and confirm nothing was lost.",[30,2645,630],{"id":629},[22,2647,633,2648,637,2650,640,2652,510],{},[383,2649,636],{},[49,2651,298],{},[49,2653,643],{},[22,2655,646],{},[76,2657,2658],{"className":78,"code":347,"language":80,"meta":81,"style":81},[49,2659,2660],{"__ignoreMap":81},[85,2661,2662,2664],{"class":87,"line":88},[85,2663,92],{"class":91},[85,2665,356],{"class":95},[22,2667,2668],{},"The user list must match the old gateway. Then connect a test client to confirm the new gateway is serving the restored certificates. Once verified, stop and terminate the old instance.",[30,2670,698],{"id":697},[230,2672,2673,2679,2685,2689],{},[233,2674,2675,706,2677,510],{},[383,2676,705],{},[49,2678,92],{},[233,2680,2681,2684],{},[383,2682,2683],{},"Restore forward, not backward."," A v1.1.0 gateway can restore a backup taken on v1.1.0 or on any older v1.0.x gateway — older backups are upgraded automatically. You cannot restore a v1.1.0 backup onto an older gateway.",[233,2686,2687,720],{},[383,2688,719],{},[233,2690,2691,726,2693,729],{},[383,2692,725],{},[49,2694,400],{},[17,2696,303],{"id":732},[22,2698,735,2699,738,2701,744,2704,593],{},[49,2700,298],{},[41,2702,743],{"href":741,"rel":2703},[45],[49,2705,747],{},[76,2707,2708],{"className":78,"code":750,"language":80,"meta":81,"style":81},[49,2709,2710,2718,2726,2734,2742],{"__ignoreMap":81},[85,2711,2712,2714,2716],{"class":87,"line":88},[85,2713,757],{"class":565},[85,2715,760],{"class":558},[85,2717,763],{"class":95},[85,2719,2720,2722,2724],{"class":87,"line":109},[85,2721,768],{"class":565},[85,2723,760],{"class":558},[85,2725,773],{"class":95},[85,2727,2728,2730,2732],{"class":87,"line":120},[85,2729,778],{"class":565},[85,2731,760],{"class":558},[85,2733,783],{"class":95},[85,2735,2736,2738,2740],{"class":87,"line":131},[85,2737,788],{"class":565},[85,2739,760],{"class":558},[85,2741,793],{"class":95},[85,2743,2744,2746,2748,2750],{"class":87,"line":142},[85,2745,798],{"class":565},[85,2747,760],{"class":558},[85,2749,803],{"class":95},[85,2751,806],{"class":91},[22,2753,809],{},[230,2755,2756,2766,2772,2776],{},[233,2757,2758,401,2760,818,2762,822,2764,510],{},[49,2759,768],{},[49,2761,778],{},[383,2763,821],{},[301,2765,825],{},[233,2767,2768,830,2770,834],{},[49,2769,788],{},[383,2771,833],{},[233,2773,837,2774,841],{},[383,2775,840],{},[233,2777,2778,846],{},[49,2779,798],{},[17,2781,850],{"id":849},[230,2783,2784,2803],{},[233,2785,855,2786],{},[230,2787,2788,2793,2798],{},[233,2789,2790],{},[41,2791,864],{"href":862,"rel":2792},[45],[233,2794,2795],{},[41,2796,871],{"href":869,"rel":2797},[45],[233,2799,2800],{},[41,2801,878],{"href":876,"rel":2802},[45],[233,2804,881,2805],{},[230,2806,2807,2812],{},[233,2808,2809],{},[41,2810,890],{"href":888,"rel":2811},[45],[233,2813,2814],{},[41,2815,897],{"href":895,"rel":2816},[45],[30,2818,2820,2821,2823],{"id":2819},"linux-split-tunnel-partial-profiles","Linux split-tunnel (",[49,2822,263],{},") profiles",[22,2825,2826,2827,2829,2830,2833,2834,2836],{},"A ",[49,2828,263],{}," profile is designed to route ",[383,2831,2832],{},"only"," traffic destined for your AWS network through the VPN, leaving normal internet traffic on the user's local connection (split-tunnel). On Windows, macOS, iOS, Android, and the Linux OpenVPN command-line client, imported ",[49,2835,263],{}," profiles behave exactly that way.",[22,2838,2839,2840,2843,2844,2846,2847,2849,2850,2852,2853,2856],{},"Linux ",[383,2841,2842],{},"desktops that import the profile into NetworkManager"," (Ubuntu, Fedora, Debian, Mint, Pop!_OS, and most GNOME\u002FKDE distributions) have an important caveat. By default NetworkManager sends ",[383,2845,259],{}," traffic — including normal internet traffic — through the VPN, turning a ",[49,2848,263],{}," profile into a full tunnel. This is long-standing NetworkManager behaviour, not a fault in the profile: NetworkManager silently ignores the split-tunnel routing directives inside the ",[49,2851,298],{}," file. The identical profile run with the OpenVPN command-line client (",[49,2854,2855],{},"sudo openvpn --config profile.ovpn",") split-tunnels correctly.",[22,2858,2859,2860,2862,2863,2865],{},"For full-tunnel (",[49,2861,259],{},") profiles this makes no difference. For ",[49,2864,263],{}," profiles on NetworkManager, tell NetworkManager not to use the VPN as the default route:",[22,2867,2868],{},[383,2869,2870],{},"Command line:",[76,2872,2874],{"className":78,"code":2873,"language":80,"meta":81,"style":81},"nmcli connection modify \u003Cconnection-name> ipv4.never-default yes\nnmcli connection up \u003Cconnection-name>\n",[49,2875,2876,2902],{"__ignoreMap":81},[85,2877,2878,2881,2884,2887,2890,2893,2895,2897,2900],{"class":87,"line":88},[85,2879,2880],{"class":91},"nmcli",[85,2882,2883],{"class":95}," connection",[85,2885,2886],{"class":95}," modify",[85,2888,2889],{"class":558}," \u003C",[85,2891,2892],{"class":95},"connection-nam",[85,2894,566],{"class":565},[85,2896,569],{"class":558},[85,2898,2899],{"class":95}," ipv4.never-default",[85,2901,2174],{"class":95},[85,2903,2904,2906,2908,2911,2913,2915,2917],{"class":87,"line":109},[85,2905,2880],{"class":91},[85,2907,2883],{"class":95},[85,2909,2910],{"class":95}," up",[85,2912,2889],{"class":558},[85,2914,2892],{"class":95},[85,2916,566],{"class":565},[85,2918,2919],{"class":558},">\n",[22,2921,2922,2923,2926,2927,2930],{},"Replace ",[49,2924,2925],{},"\u003Cconnection-name>"," with the name shown by ",[49,2928,2929],{},"nmcli connection show"," (it matches the profile you imported).",[22,2932,2933],{},[383,2934,2935],{},"GUI (GNOME \u002F KDE network settings):",[492,2937,2938,2941,2948,2954,2960],{},[233,2939,2940],{},"Open the VPN connection's settings.",[233,2942,2943,2944,2947],{},"Go to the ",[383,2945,2946],{},"IPv4"," tab.",[233,2949,2950,2951,510],{},"Open ",[383,2952,2953],{},"Routes…",[233,2955,2956,2957,510],{},"Tick ",[383,2958,2959],{},"Use this connection only for resources on its network",[233,2961,2962],{},"Save, then reconnect the VPN.",[22,2964,2965,2966,2968,2969,2971],{},"This change affects only Linux NetworkManager clients using ",[49,2967,263],{}," profiles. Full-tunnel (",[49,2970,259],{},") profiles, and every other platform, need no change.",[17,2973,901],{"id":900},[22,2975,904,2976,510],{},[49,2977,907],{},[909,2979,2980,2988],{},[912,2981,2982],{},[915,2983,2984,2986],{},[918,2985,920],{},[918,2987,923],{},[925,2989,2990,2998,3006,3014],{},[915,2991,2992,2994],{},[930,2993,932],{},[930,2995,2996],{},[49,2997,937],{},[915,2999,3000,3002],{},[930,3001,942],{},[930,3003,3004],{},[49,3005,947],{},[915,3007,3008,3010],{},[930,3009,952],{},[930,3011,3012],{},[49,3013,957],{},[915,3015,3016,3018],{},[930,3017,962],{},[930,3019,3020],{},[49,3021,967],{},[22,3023,970,3024,974],{},[49,3025,973],{},[17,3027,978],{"id":977},[22,3029,981],{},[22,3031,984,3032,988],{},[383,3033,987],{},[30,3035,992],{"id":991},[22,3037,995,3038,593],{},[49,3039,998],{},[76,3041,3042],{"className":78,"code":1001,"language":80,"meta":81,"style":81},[49,3043,3044],{"__ignoreMap":81},[85,3045,3046,3048,3050],{"class":87,"line":88},[85,3047,1008],{"class":565},[85,3049,760],{"class":558},[85,3051,1013],{"class":95},[22,3053,1016],{},[76,3055,3056],{"className":78,"code":1019,"language":80,"meta":81,"style":81},[49,3057,3058],{"__ignoreMap":81},[85,3059,3060,3062],{"class":87,"line":88},[85,3061,92],{"class":91},[85,3063,1028],{"class":95},[22,3065,3066],{},"This applies the new routes immediately. Already-connected clients pick them up on their next reconnect.",[30,3068,698],{"id":1034},[230,3070,3071,3079,3087],{},[233,3072,3073,1046,3077,1049],{},[383,3074,1041,3075,1045],{},[49,3076,1044],{},[49,3078,259],{},[233,3080,3081,1055,3083,1059,3085,1063],{},[383,3082,1054],{},[49,3084,1058],{},[49,3086,1062],{},[233,3088,3089,1069,3091,1073],{},[383,3090,1068],{},[49,3092,1072],{},[17,3094,1077],{"id":1076},[22,3096,1080],{},[230,3098,3099,3103],{},[233,3100,3101],{},[49,3102,1087],{},[233,3104,3105,1093],{},[49,3106,1092],{},[17,3108,1097],{"id":1096},[230,3110,3111,3115,3119,3123],{},[233,3112,3113,1105],{},[383,3114,1104],{},[233,3116,3117,1111],{},[383,3118,1110],{},[233,3120,3121,1117],{},[383,3122,1116],{},[233,3124,3125,1123],{},[383,3126,1122],{},[17,3128,1127],{"id":1126},[22,3130,3131,593],{},[383,3132,1132],{},[22,3134,1135],{},[22,3136,3137,593],{},[383,3138,1140],{},[22,3140,1143],{},[22,3142,3143,593],{},[383,3144,1148],{},[22,3146,1151],{},[22,3148,3149,593],{},[383,3150,1156],{},[22,3152,1159],{},[17,3154,3156],{"id":3155},"faq","FAQ",[22,3158,3159],{},[383,3160,3161],{},"Is there a limit on the number of users?",[22,3163,3164,3165,3167,3168,3170],{},"No. The gateway supports an unlimited number of VPN profiles. Each user you create with ",[49,3166,643],{}," gets their own certificate and ",[49,3169,298],{}," profile.",[22,3172,3173],{},[383,3174,3175,3176,3178],{},"Why does my ",[49,3177,263],{}," (split-tunnel) profile route everything through the VPN on Linux?",[22,3180,3181,3182,3185,3186,3188,3189,3192],{},"This happens only on Linux desktops that import the profile into NetworkManager, which claims the default route by default. Run ",[49,3183,3184],{},"nmcli connection modify \u003Cconnection-name> ipv4.never-default yes"," (or tick ",[383,3187,2959],{}," in the IPv4 settings) and reconnect. See ",[301,3190,3191],{},"VPN Clients → Linux split-tunnel profiles"," for full details. Windows, macOS, iOS, Android, and the OpenVPN command-line client are unaffected.",[22,3194,3195],{},[383,3196,3197,3198,401,3200,3202],{},"What is the difference between ",[49,3199,259],{},[49,3201,263],{}," traffic mode?",[22,3204,3205,3207,3208,3210],{},[49,3206,259],{}," routes every packet from the client through the VPN (full tunnel) — useful for securing all of a remote employee's internet traffic. ",[49,3209,263],{}," routes only traffic destined for your AWS network through the VPN (split tunnel), leaving normal internet traffic on the user's local connection.",[22,3212,3213],{},[383,3214,3215],{},"Does a profile stop working once its expiration date passes?",[22,3217,3218,3219,3221,3222,3225,3226,3229],{},"Yes. ",[49,3220,281],{}," is the certificate's ",[383,3223,3224],{},"hard cryptographic expiry"," — it is stamped into the certificate's ",[49,3227,3228],{},"notAfter"," field at issue time. Once that date passes, the OpenVPN server rejects the certificate during the TLS handshake and the profile can no longer connect. No operator action is required for the profile to stop working.",[22,3231,3232,3233,3236,3237,3240,3241,3244,3245,3248,3249,3251,3252,510],{},"What does ",[383,3234,3235],{},"not"," happen automatically is ",[301,3238,3239],{},"revocation",". The certificate is not added to the CRL and the database row still shows the profile as ",[49,3242,3243],{},"active"," — ",[49,3246,3247],{},"ov_user_list_expired"," is a report-only convenience to surface these. To revoke a still-valid profile before its expiry date (so it stops working immediately), run ",[49,3250,389],{},", which revokes the certificate and updates the CRL. To remove the stale database row after natural expiry, also use ",[49,3253,389],{},[22,3255,3256],{},[383,3257,3258],{},"How does auto-renewal work and is it on by default?",[22,3260,3261,3262,3264,3265,3268,3269,510],{},"Auto-renewal is opt-in per profile and off by default. Enable it with ",[49,3263,2395],{}," at creation, or ",[49,3266,3267],{},"ov_user_auto_renew --enable"," later. A daily job issues and emails a fresh profile before the current one expires (within a 10-day window). See ",[301,3270,2245],{},[22,3272,3273],{},[383,3274,3275],{},"A user lost their email — do I have to recreate the profile?",[22,3277,3278,3279,3282],{},"No. Run ",[49,3280,3281],{},"ov_user_resend --email \u003Caddr> --traffic \u003Call|partial>"," to re-deliver the existing profile. No new certificate is issued and the user database is not modified.",[22,3284,3285],{},[383,3286,3287],{},"How do I move the gateway to a new instance or AMI version without losing users?",[22,3289,3290,3291,3293,3294,3296,3297,3299,3300,510],{},"Run ",[49,3292,400],{}," on the old gateway, launch a fresh instance from the AMI, copy the archive up, and run ",[49,3295,404],{},". Then move the Elastic IP to the new instance ",[383,3298,2371],{}," users reconnect so existing profiles keep working. See ",[301,3301,394],{},[22,3303,3304],{},[383,3305,3306],{},"Why does the first boot take longer than a normal AMI?",[22,3308,3309],{},"On first launch the gateway generates its PKI, issues a server certificate, configures OpenVPN against your VPC layout, and starts the services. This is one-time work — subsequent reboots skip it and are fast.",[22,3311,3312],{},[383,3313,3314],{},"How do I connect without opening SSH?",[22,3316,3317,3318,3320,3321,3323,3324,510],{},"Use AWS Systems Manager Session Manager — no inbound ports required. Connect, then run ",[49,3319,51],{},". The instance profile needs the ",[49,3322,1092],{}," policy. See ",[301,3325,3326],{},"Server Connection → Using SSM",[22,3328,3329],{},[383,3330,3331],{},"Why are my profile emails not being delivered?",[22,3333,3334,3335,3337,3338,3340,3341,3343,3344,510],{},"Email is sent via Amazon SES. Confirm ",[49,3336,747],{}," holds valid SES ",[383,3339,821],{}," (not your AWS access key), that ",[49,3342,788],{}," is a verified SES identity, and — if your SES account is still in sandbox mode — that the recipient address is verified too. See ",[301,3345,303],{},[1161,3347,1163],{},{"title":81,"searchDepth":109,"depth":109,"links":3349},[3350,3351,3355,3362,3366,3372,3373,3377,3378,3382,3383,3384,3385],{"id":19,"depth":109,"text":20},{"id":27,"depth":109,"text":28,"children":3352},[3353,3354],{"id":32,"depth":120,"text":33},{"id":55,"depth":120,"text":56},{"id":66,"depth":109,"text":67,"children":3356},[3357,3358,3359,3360,3361],{"id":70,"depth":120,"text":71},{"id":307,"depth":120,"text":308},{"id":340,"depth":120,"text":341},{"id":362,"depth":120,"text":363},{"id":2330,"depth":120,"text":2331},{"id":2362,"depth":109,"text":2245,"children":3363},[3364,3365],{"id":2388,"depth":120,"text":2389},{"id":2452,"depth":120,"text":2453},{"id":393,"depth":109,"text":394,"children":3367},[3368,3369,3370,3371],{"id":471,"depth":120,"text":472},{"id":532,"depth":120,"text":533},{"id":629,"depth":120,"text":630},{"id":697,"depth":120,"text":698},{"id":732,"depth":109,"text":303},{"id":849,"depth":109,"text":850,"children":3374},[3375],{"id":2819,"depth":120,"text":3376},"Linux split-tunnel (partial) profiles",{"id":900,"depth":109,"text":901},{"id":977,"depth":109,"text":978,"children":3379},[3380,3381],{"id":991,"depth":120,"text":992},{"id":1034,"depth":120,"text":698},{"id":1076,"depth":109,"text":1077},{"id":1096,"depth":109,"text":1097},{"id":1126,"depth":109,"text":1127},{"id":3155,"depth":109,"text":3156},{},"\u002Fproducts\u002Fgate\u002Fdocumentation\u002F1.1.x",{"title":12,"description":81},"products\u002Fgate\u002Fdocumentation\u002F1.1.x","wHan7VQfqjpnxA_572YU8hO5pwq9u2MamOH-g6tHasI",1784130820728]