# Push routes to the client to allow it
# to reach other private subnets behind
# the server. Remember that these
# private subnets will also need
# to know to route the OpenVPN client
# address pool (10.8.0.0/255.255.255.0)
# back to the OpenVPN server.
push "route 192.168.0.0 255.255.255.0"
push "route 10.8.0.0 255.255.255.0"
# "dev tun" will create a routed IP tunnel,
# "dev tap" will create an ethernet tunnel.
# Use "dev tap0" if you are ethernet bridging
# and have precreated a tap0 virtual interface
# and bridged it with your ethernet interface.
# If you want to control access policies
# over the VPN, you must create firewall
# rules for the the TUN/TAP interface.
# On non-Windows systems, you can give
# an explicit unit number, such as tun0.
# On Windows, use "dev-node" for this.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
dev tun
# Network topology
# Should be subnet (addressing via IP)
# unless Windows clients v2.0.9 and lower have to
# be supported (then net30, i.e. a /30 per client)
# Defaults to net30 (not recommended)
topology subnet
# This will prevent OpenVPN from tweaking the buffer
# size between the server and the client. It will be
# determined by the OS. Windows users who connect to
# a Linux server will experience faster speeds.
push "sndbuf 0"
push "rcvbuf 0"
sndbuf 0
rcvbuf 0
management 127.0.0.1 1195
# Configure server mode and supply a VPN subnet
# for OpenVPN to draw client addresses from.
# The server will take 10.8.0.1 for itself,
# the rest will be made available to clients.
# Each client will be able to reach the server
# on 10.8.0.1. Comment this line out if you are
# ethernet bridging. See the man page for more info
server 10.8.0.0 255.255.255.0
# SSL/TLS root certificate (ca), certificate
# (cert), and private key (key). Each client
# and the server must have their own cert and
# key file. The server and all clients will
# use the same ca file.
# Diffie hellman parameters.
dh /usr/syno/etc/packages/VPNCenter/VPNcerts/dh2048.pem
ca /usr/syno/etc/packages/VPNCenter/VPNcerts/CA.crt
cert /usr/syno/etc/packages/VPNCenter/VPNcerts/Server.crt
key /usr/syno/etc/packages/VPNCenter/VPNcerts/Server.key # This file should be kept secret
# The maximum number of concurrently connected
# clients we want to allow.
max-clients 5
# The persist options will try to avoid
# accessing certain resources on restart
# that may no longer be accessible because
# of the privilege downgrade.
persist-tun
persist-key
# Set the appropriate level of log
# file verbosity.
#
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 4
# By default, log messages will go to the syslog (or
# on Windows, if running as a service, they will go to
# the "\Program Files\OpenVPN\log" directory).
# Use log or log-append to override this default.
# "log" will truncate the log file on OpenVPN startup,
# while "log-append" will append to it. Use one
# or the other (but not both).
log /var/log/openvpn.log
# The keepalive directive causes ping-like
# messages to be sent back and forth over
# the link so that each side knows when
# the other side has gone down.
# Ping every 10 seconds, assume that remote
# peer is down if no ping received during
# a 60 second time period.
keepalive 10 60
plugin /var/packages/VPNCenter/target/lib/radiusplugin.so /var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf
# Output a short status file showing
# current connections, truncated
# and rewritten every 30 seconds.
status /tmp/ovpn_status_2_result 30
status-version 2
# TCP or UDP server?
proto tcp6-server
# Which TCP/UDP port should OpenVPN listen on?
# If you want to run multiple OpenVPN instances
# on the same machine, use a different port
# number for each one. You will need to
# open up this port on your firewall.
port 1194
# Select a cryptographic cipher.
# This config item must be copied to
# the client config file as well.
cipher AES-256-CBC # AES
auth SHA256
# For extra security beyond that provided
# by SSL/TLS, create an "HMAC firewall"
# to help block DoS attacks and UDP port flooding.
#
# The server and each client must have
# a copy of this key.
# The second parameter should be '0'
# on the server and '1' on the clients.
tls-auth /usr/syno/etc/packages/VPNCenter/VPNcerts/ta.key 0 # This file is secret
# Sets the minimum TLS version we will accept from the peer.
# If 'or-highest' is specified and version is not recognized,
# we will only accept the highest TLS version supported by
# the local SSL implementation.
tls-version-min 1.2 or-highest
remote-cert-tls client
Einen anderen Fehler hatte ich auch noch gemacht, aber ich konnte nicht mehr nachvollziehen, welcher Schritt ihn behoben hat. Ich hatte ursprünglich dieses Tutorial benutzt: 
