| Argument | Type | Description |
|---|
| name | string | Descriptive name of the interface. |
| mac-address | macAddr | MAC address of the OVPN interface. Automatically generated if not specified. |
| max-mtu | num | Maximum Transmission Unit. Maximum packet size that the OVPN interface can send without packet fragmentation. |
| connect-to ( mandatory ) | address (flags=D46v) | Remote address of the OVPN server. |
| port | num | Port to connect to. |
| mode | enum (ip | ethernet) { ip:0, ethernet:1 } | Layer3 or Layer2 tunnel mode (alternatively tun, tap). |
| protocol | enum (tcp | udp) | Transport protocol to use when connecting to the remote endpoint. |
| user ( mandatory ) | string | User name used for authentication. |
| password | string | Password used for authentication. Must not be longer than 1000 characters. |
| profile | enum | Specifies which PPP profile configuration is used when establishing the tunnel. |
| certificate | enum (none) { none:0 } | Client certificate from the certificate store. |
| verify-server-certificate | bool | Checks the server certificate's CN or SAN against the connect-to parameter and enables trust-chain validation against the router's certificate store. The IP or hostname must be present in the server's certificate. |
| tls-version | enum (any | only-1.2) { any:0, only-1.2:2 } | Specifies which TLS versions to allow. |
| auth | enum (sha1 | md5 | sha256 | sha384 | sha512 | null) { sha1:1, md5:2, sha256:8, sha384:32, sha512:16, null:4 } | Allowed authentication methods. |
| cipher | enum (blowfish128 | aes128-cbc | aes192-cbc | aes256-cbc | aes128-gcm | aes192-gcm | aes256-gcm | null) { blowfish128:1, aes128-cbc:2, aes192-cbc:4, aes256-cbc:8, aes128-gcm:16, aes192-gcm:32, aes256-gcm:64, null:128 } | Allowed ciphers. To use GCM ciphers, set auth to null, because the GCM cipher also handles authentication. |
| use-peer-dns | enum (no | yes | exclusively) { no:0, yes:1, exclusively:2 } | Whether to add DNS servers provided by the OVPN server to IP/DNS configuration. |
| add-default-route | bool | Whether to add the OVPN remote address as a default route. |
| route-nopull | bool | If enabled, the client does not use routes pushed by the server (including def1). |
| disconnect-notify | bool | Sends explicit disconnect notification in UDP mode. |