TLS keydir direction usage

[Air4141841 24]

Good Day,

with newer versions of pfsense the option is there to set the option to:
direction 1
direction 0
both
use default direction.

going forward what does Staff suggest we set this option too?


 

[Staff 9972]

@Air4141841

Hello!

key-direction 1 when you use TLS Auth key (i.e. you connect to entry-IP addresses 1 and 2).

Omit it when you use TLS Crypt (i.e. you connect to entry-IP addresses 3 and 4), because it's not pertaining to TLS Crypt.

For an explanation, look for secret file [direction]  and –key-direction in the manual https://openvpn.net/community-resources/reference-manual-for-openvpn-2-4/

If you run OpenVPN 2.4 or higher version, TLS Crypt is recommended because it encrypts the whole Control Channel, with the important side effect to make OpenVPN "fingerprint" not detectable by Deep Packet Inspection (some ISPs, when they detect OpenVPN "fingerprint", enforce traffic shaping).

Kind regards
 

[Air4141841 24]

that explained this perfect thank you so much