<?xml version="1.0" encoding="utf-8" ?>
<pfsensewizard>
<copyright>
/*
 * openvpn_wizard.xml
 *
 * part of pfSense (https://www.pfsense.org)
 * Copyright (c) 2004-2013 BSD Perimeter
 * Copyright (c) 2013-2016 Electric Sheep Fencing
 * Copyright (c) 2014-2021 Rubicon Communications, LLC (Netgate)
 * All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
</copyright>
<totalsteps>12</totalsteps>
<step>
	<id>1</id>
	<title>OpenVPN Remote Access Server Setup</title>
	<description>This wizard will provide guidance through an OpenVPN Remote Access Server Setup .&lt;br/&gt;&lt;br/&gt; The wizard may be stopped at any time by clicking the logo image at the top of the screen.</description>
	<disableheader>true</disableheader>
	<fields>
		<field>
			<type>listtopic</type>
			<name>Select an Authentication Backend Type</name>
		</field>
		<field>
			<type>select</type>
			<displayname>Type of Server</displayname>
			<name>authtype</name>
			<description>&lt;br/&gt;&lt;b&gt;NOTE:&lt;/b&gt; If unsure, leave this set to "Local User Access."</description>
			<bindstofield>ovpnserver->step1->type</bindstofield>
			<options>
				<option>
					<name>Local User Access</name>
					<value>local</value>
				</option>
				<option>
					<name>LDAP</name>
					<value>ldap</value>
				</option>
				<option>
					<name>RADIUS</name>
					<value>radius</value>
				</option>
			</options>
		</field>
		<field>
			<name>Next</name>
			<type>submit</type>
		</field>
	</fields>
	<stepsubmitbeforesave>step1_stepsubmitbeforesave();</stepsubmitbeforesave>
	<stepsubmitphpaction>step1_submitphpaction();</stepsubmitphpaction>
	<includefile>/usr/local/www/wizards/openvpn_wizard.inc</includefile>
</step>
<step>
	<id>2</id>
	<title>LDAP Server Selection</title>
	<description>OpenVPN Remote Access Server Setup Wizard</description>
	<disableheader>true</disableheader>
	<fields>
		<field>
			<type>listtopic</type>
			<name>LDAP Authentication Server List</name>
		</field>
		<field>
			<name>authserv</name>
			<displayname>LDAP servers</displayname>
			<type>select</type>
			<bindstofield>ovpnserver->step2->authserv</bindstofield>
			<options>
				<option>
					<name>dummy</name>
					<value>dummy</value>
				</option>
			</options>
		</field>
		<field>
			<type>submit</type>
			<name>Add new LDAP server</name>
		</field>
		<field>
			<type>submit</type>
			<name>Next</name>
		</field>
	</fields>
	<stepbeforeformdisplay>step2_stepbeforeformdisplay();</stepbeforeformdisplay>
	<stepsubmitphpaction>step2_submitphpaction();</stepsubmitphpaction>
	<javascriptafterformdisplay>enablechange();</javascriptafterformdisplay>
	<includefile>/usr/local/www/wizards/openvpn_wizard.inc</includefile>
</step>
<step>
	<id>3</id>
	<title>Add LDAP Server</title>
	<description>OpenVPN Remote Access Server Setup Wizard</description>
	<disableheader>true</disableheader>
	<fields>
		<field>
			<type>listtopic</type>
			<name>LDAP Authentication Server Parameters</name>
		</field>
		<field>
			<name>name</name>
			<displayname>Name</displayname>
			<type>input</type>
			<bindstofield>ovpnserver->step2->authtype</bindstofield>
			<size>30</size>
			<description>Descriptive server name, for administrative reference.</description>
		</field>
		<field>
			<name>ip</name>
			<displayname>Hostname or IP address</displayname>
			<type>input</type>
			<bindstofield>ovpnserver->step2->ip</bindstofield>
			<description>Address of the LDAP server. When using SSL/TLS or STARTTLS, this hostname must match the LDAP server certificate.</description>
		</field>
		<field>
			<name>port</name>
			<displayname>Port</displayname>
			<type>input</type>
			<size>8</size>
			<bindstofield>ovpnserver->step2->port</bindstofield>
			<description>LDAP Server port, leave blank for the default (389 for TCP or STARTTLS, 636 for SSL/TLS).</description>
		</field>
		<field>
			<name>transport</name>
			<displayname>Transport</displayname>
			<type>select</type>
			<bindstofield>ovpnserver->step2->transport</bindstofield>
			<options>
				<option>
					<name>Standard TCP</name>
					<value>Standard TCP</value>
				</option>
				<option>
					<name>STARTTLS Encrypted</name>
					<value>STARTTLS Encrypted</value>
				</option>
				<option>
					<name>SSL/TLS Encrypted</name>
					<value>SSL/TLS Encrypted</value>
				</option>
			</options>
			<description>&lt;br/&gt;The transport used by the LDAP server. It can either be standard TCP, STARTTLS or SSL/TLS Encrypted.</description>
		</field>
		<field>
			<type>certca_selection</type>
			<name>ldap_caref</name>
			<displayname>Peer Certificate Authority</displayname>
			<bindstofield>ovpnserver->step2->ldap_caref</bindstofield>
			<description>&lt;br/&gt;The Certificate Authority for the LDAP server certificate. Used for SSL/TLS and STARTTLS.</description>
			<add_to_certca_selection>global</add_to_certca_selection>
		</field>
		<field>
			<name>ldap_protver</name>
			<displayname>Protocol Version</displayname>
			<type>select</type>
			<options>
				<option>
					<name>3</name>
					<value>3</value>
				</option>
				<option>
					<name>2</name>
					<value>2</value>
				</option>
			</options>
			<bindstofield>ovpnserver->step2->ldap_protver</bindstofield>
		</field>
		<field>
			<name>ldap_timeout</name>
			<displayname>Server Timeout</displayname>
			<type>input</type>
			<size>40</size>
			<value>25</value>
			<bindstofield>ovpnserver->step2->ldap_timeout</bindstofield>
		</field>
		<field>
			<name>scope</name>
			<displayname>Search Scope Level</displayname>
			<type>select</type>
			<options>
				<option>
					<name>Entire Subtree</name>
					<value>subtree</value>
				</option>
				<option>
					<name>One Level</name>
					<value>one</value>
				</option>
			</options>
			<bindstofield>ovpnserver->step2->scope</bindstofield>
		</field>
		<field>
			<name>basedn</name>
			<displayname>Search Scope Base DN</displayname>
			<type>input</type>
			<size>40</size>
			<bindstofield>ovpnserver->step2->basedn</bindstofield>
		</field>
		<field>
			<name>authscope</name>
			<displayname>Authentication Containers</displayname>
			<type>input</type>
			<size>40</size>
			<bindstofield>ovpnserver->step2->authscope</bindstofield>
			<description>Semi-Colon separated. This will be prepended to the search base dn above or full container path can be specified.&lt;br/&gt;EXAMPLE: CN=Users;DC=example&lt;br/&gt;EXAMPLE: CN=Users,DC=example,DC=com;OU=OtherUsers,DC=example,DC=com </description>
		</field>
		<field>
			<name>ldap_extended_enabled</name>
			<displayname>Enable Extended Query</displayname>
			<type>checkbox</type>
			<typehint>Enable extended query.</typehint>
			<bindstofield>ovpnserver->step2->ldap_extended_enabled</bindstofield>
		</field>
		<field>
			<name>ldap_extended_query</name>
			<displayname>Extended Query</displayname>
			<type>input</type>
			<size>40</size>
			<description>Example: memberOf=CN=Groupname,OU=MyGroups,DC=example,DC=com</description>
			<bindstofield>ovpnserver->step2->ldap_extended_query</bindstofield>
		</field>
		<field>
			<name>userdn</name>
			<displayname>LDAP Bind User DN</displayname>
			<type>input</type>
			<size>20</size>
			<description>If left blank, an anonymous bind will be done.</description>
			<bindstofield>ovpnserver->step2->userdn</bindstofield>
		</field>
		<field>
			<name>passdn</name>
			<displayname>LDAP Bind Password</displayname>
			<type>password</type>
			<size>20</size>
			<bindstofield>ovpnserver->step2->passdn</bindstofield>
			<description>If a user DN was supplied above, this password will also be used when performing a bind operation.</description>
		</field>
		<field>
			<name>nameattr</name>
			<displayname>User Naming Attribute</displayname>
			<type>input</type>
			<bindstofield>ovpnserver->step2->nameattr</bindstofield>
			<value>cn</value>
			<description>Typically "cn" (OpenLDAP, Novell eDirectory), "samAccountName" (Microsoft AD)</description>
		</field>
		<field>
			<name>groupattr</name>
			<displayname>Group Naming Attribute</displayname>
			<type>input</type>
			<bindstofield>ovpnserver->step2->groupattr</bindstofield>
			<value>cn</value>
			<description>Typically "cn" (OpenLDAP, Microsoft AD, and Novell eDirectory)</description>
		</field>
		<field>
			<name>memberattr</name>
			<displayname>Member Naming Attribute</displayname>
			<type>input</type>
			<bindstofield>ovpnserver->step2->memberattr</bindstofield>
			<value>member</value>
			<description>Typically "member" (OpenLDAP), "memberOf" (Microsoft AD), "uniqueMember" (Novell eDirectory)</description>
		</field>
		<field>
			<name>ldap_rfc2307</name>
			<displayname>RFC 2307 Groups</displayname>
			<type>checkbox</type>
			<typehint>LDAP Server uses RFC 2307 style group membership.</typehint>
			<description>RFC 2307 style group membership has members listed on the group object rather than using groups listed on user object. Leave unchecked for Active Directory style group membership (RFC 2307bis).</description>
			<bindstofield>ovpnserver->step2->ldap_rfc2307</bindstofield>
		</field>
		<field>
			<name>ldap_attr_groupobj</name>
			<displayname>Group Object Class</displayname>
			<type>input</type>
			<value>posixGroup</value>
			<bindstofield>ovpnserver->step2->ldap_attr_groupobj</bindstofield>
			<description>Object class used for groups in RFC2307 mode. Typically "posixGroup" or "group".</description>
		</field>
		<field>
			<name>ldap_utf8</name>
			<displayname>UTF8 Encode</displayname>
			<type>checkbox</type>
			<typehint>UTF8 encode LDAP parameters before sending them to the server.</typehint>
			<description>Required to support international characters, but may not be supported by every LDAP server.</description>
			<bindstofield>ovpnserver->step2->ldap_utf8</bindstofield>
		</field>
		<field>
			<name>ldap_nostrip_at</name>
			<displayname>Username Alterations</displayname>
			<type>checkbox</type>
			<typehint>Do not strip away parts of the username after the @ symbol.</typehint>
			<description>e.g. user@host becomes user when unchecked.</description>
			<bindstofield>ovpnserver->step2->ldap_nostrip_at</bindstofield>
		</field>
		<field>
			<name>ldap_allow_unauthenticated</name>
			<displayname>Allow unauthenticated bind</displayname>
			<type>checkbox</type>
			<typehint>Allow unauthenticated bind</typehint>
			<description>Unauthenticated binds are bind with an existing login but with an empty password.</description>
			<bindstofield>ovpnserver->step2->ldap_allow_unauthenticated</bindstofield>
		</field>
		<field>
			<type>submit</type>
			<name>Add new Server</name>
		</field>
	</fields>
	<stepsubmitphpaction>step3_submitphpaction();</stepsubmitphpaction>
	<javascriptafterformdisplay>enablechange();</javascriptafterformdisplay>
	<includefile>/usr/local/www/wizards/openvpn_wizard.inc</includefile>
</step>
<step>
	<id>4</id>
	<title>RADIUS Server Selection</title>
	<description>OpenVPN Remote Access Server Setup Wizard</description>
	<disableheader>true</disableheader>
	<fields>
		<field>
			<type>listtopic</type>
			<name>RADIUS Authentication Server List</name>
		</field>
		<field>
			<name>authserv</name>
			<displayname>RADIUS servers</displayname>
			<type>select</type>
			<bindstofield>ovpnserver->step2->authserv</bindstofield>
			<options>
				<option>
					<name>dummy</name>
					<value>dummy</value>
				</option>
			</options>
		</field>
		<field>
			<type>submit</type>
			<name>Add new RADIUS server</name>
		</field>
		<field>
			<type>submit</type>
			<name>Next</name>
		</field>
	</fields>
	<stepbeforeformdisplay>step4_stepbeforeformdisplay();</stepbeforeformdisplay>
	<stepsubmitphpaction>step4_submitphpaction();</stepsubmitphpaction>
	<javascriptafterformdisplay>enablechange();</javascriptafterformdisplay>
	<includefile>/usr/local/www/wizards/openvpn_wizard.inc</includefile>
</step>
<step>
	<id>5</id>
	<title>Add RADIUS Server</title>
	<description>OpenVPN Remote Access Server Setup Wizard</description>
	<disableheader>true</disableheader>
	<fields>
		<field>
			<type>listtopic</type>
			<name>RADIUS Authentication Server Parameters</name>
		</field>
		<field>
			<name>name</name>
			<displayname>Name</displayname>
			<type>input</type>
			<bindstofield>ovpnserver->step2->authtype</bindstofield>
			<size>20</size>
			<description>Descriptive name for the RADIUS server, for administrative reference.</description>
		</field>
		<field>
			<name>ip</name>
			<displayname>Hostname or IP address</displayname>
			<type>input</type>
			<bindstofield>ovpnserver->step2->ip</bindstofield>
			<description>Address of the RADIUS server.</description>
		</field>
		<field>
			<name>port</name>
			<displayname>Authentication Port</displayname>
			<type>input</type>
			<size>8</size>
			<bindstofield>ovpnserver->step2->port</bindstofield>
			<description>Port used by the RADIUS server for accepting Authentication requests, typically 1812.</description>
		</field>
		<field>
			<name>secret</name>
			<displayname>Shared Secret</displayname>
			<type>password</type>
			<size>20</size>
			<bindstofield>ovpnserver->step2->password</bindstofield>
			<description></description>
		</field>
		<field>
			<name>Add new Server</name>
			<type>submit</type>
		</field>
	</fields>
	<stepsubmitphpaction>step5_submitphpaction();</stepsubmitphpaction>
	<includefile>/usr/local/www/wizards/openvpn_wizard.inc</includefile>
</step>
<step>
	<id>6</id>
	<title>Certificate Authority Selection</title>
	<description>OpenVPN Remote Access Server Setup Wizard</description>
	<disableheader>true</disableheader>
	<fields>
		<field>
			<name>Choose a Certificate Authority (CA)</name>
			<type>listtopic</type>
		</field>
		<field>
			<type>certca_selection</type>
			<name>certca</name>
			<displayname>Certificate Authority</displayname>
			<bindstofield>ovpnserver->step6->authcertca</bindstofield>
		</field>
		<field>
			<type>submit</type>
			<name>Add new CA</name>
		</field>
		<field>
			<name>Next</name>
			<type>submit</type>
		</field>
	</fields>
	<stepbeforeformdisplay>step6_stepbeforeformdisplay();</stepbeforeformdisplay>
	<stepsubmitphpaction>step6_submitphpaction();</stepsubmitphpaction>
	<includefile>/usr/local/www/wizards/openvpn_wizard.inc</includefile>
</step>
<step>
	<id>7</id>
	<title>Add Certificate Authority</title>
	<description>OpenVPN Remote Access Server Setup Wizard</description>
	<disableheader>true</disableheader>
	<fields>
		<field>
			<name>Create a New Certificate Authority (CA) Certificate</name>
			<type>listtopic</type>
		</field>
		<field>
			<name>descr</name>
			<displayname>Descriptive name</displayname>
			<description>A name for administrative reference, to identify this certificate. This is the same as common-name field for other Certificates.</description>
			<type>input</type>
			<size>20</size>
			<bindstofield>ovpnserver->step6->certca</bindstofield>
		</field>
		<field>
			<name>keylength</name>
			<displayname>Key length</displayname>
			<description>&lt;br/&gt;Size of the key which will be generated. The larger the key, the more security it offers, but larger keys take considerably more time to generate, and take slightly longer to validate leading to a slight slowdown in setting up new sessions (not always noticeable). As of 2016, 2048 bit is the minimum and most common selection and 4096 is the maximum in common use. For more information see &lt;a href="https://keylength.com"&gt;keylength.com&lt;/a&gt;</description>
			<type>select</type>
			<value>2048</value>
			<bindstofield>ovpnserver->step6->keylength</bindstofield>
			<options>
				<option>
					<name>1024 bit</name>
					<value>1024</value>
				</option>
				<option>
					<name>2048 bit</name>
					<value>2048</value>
				</option>
				<option>
					<name>3072 bit</name>
					<value>3072</value>
				</option>
				<option>
					<name>4096 bit</name>
					<value>4096</value>
				</option>
				<option>
					<name>6144 bit</name>
					<value>6144</value>
				</option>
				<option>
					<name>7680 bit</name>
					<value>7680</value>
				</option>
				<option>
					<name>8192 bit</name>
					<value>8192</value>
				</option>
				<option>
					<name>15360 bit</name>
					<value>15360</value>
				</option>
				<option>
					<name>16384 bit</name>
					<value>16384</value>
				</option>
			</options>
		</field>
		<field>
			<name>lifetime</name>
			<displayname>Lifetime</displayname>
			<type>input</type>
			<size>10</size>
			<value>3650</value>
			<description>Lifetime in days. This is commonly set to 3650 (Approximately 10 years.)</description>
			<bindstofield>ovpnserver->step6->lifetime</bindstofield>
		</field>
		<field>
			<name>country</name>
			<displayname>Country Code</displayname>
			<description>Two-letter ISO country code (e.g. US, AU, CA) </description>
			<type>input</type>
			<size>5</size>
			<bindstofield>ovpnserver->step6->country</bindstofield>
		</field>
		<field>
			<name>state</name>
			<displayname>State or Province</displayname>
			<description>Full State or Province name, not abbreviated (e.g. Kentucky, Indiana, Ontario).</description>
			<type>input</type>
			<size>30</size>
			<bindstofield>ovpnserver->step6->state</bindstofield>
		</field>
		<field>
			<name>city</name>
			<displayname>City</displayname>
			<description>City or other Locality name (e.g. Louisville, Indianapolis, Toronto).</description>
			<type>input</type>
			<size>30</size>
			<bindstofield>ovpnserver->step6->city</bindstofield>
		</field>
		<field>
			<name>organization</name>
			<displayname>Organization</displayname>
			<description>Organization name, often the Company or Group name.</description>
			<type>input</type>
			<size>30</size>
			<bindstofield>ovpnserver->step6->organization</bindstofield>
		</field>
		<field>
			<name>Add new CA</name>
			<type>submit</type>
		</field>
	</fields>
	<stepsubmitphpaction>step7_submitphpaction();</stepsubmitphpaction>
	<includefile>/usr/local/www/wizards/openvpn_wizard.inc</includefile>
	<javascriptafterformdisplay>enablechange();</javascriptafterformdisplay>
</step>
<step>
	<id>8</id>
	<title>Server Certificate Selection</title>
	<description>OpenVPN Remote Access Server Setup Wizard</description>
	<disableheader>true</disableheader>
	<fields>
		<field>
			<name>Choose a Server Certificate</name>
			<type>listtopic</type>
		</field>
		<field>
			<type>cert_selection</type>
			<name>certname</name>
			<displayname>Certificate</displayname>
			<bindstofield>ovpnserver->step9->authcertname</bindstofield>
		</field>
		<field>
			<type>submit</type>
			<name>Add new Certificate</name>
		</field>
		<field>
			<name>Next</name>
			<type>submit</type>
		</field>
	</fields>
	<stepbeforeformdisplay>step8_stepbeforeformdisplay();</stepbeforeformdisplay>
	<stepsubmitphpaction>step8_submitphpaction();</stepsubmitphpaction>
	<includefile>/usr/local/www/wizards/openvpn_wizard.inc</includefile>
</step>
<step>
	<id>9</id>
	<title>Add a Server Certificate</title>
	<description>OpenVPN Remote Access Server Setup Wizard</description>
	<disableheader>true</disableheader>
	<fields>
		<field>
			<name>Create a New Server Certificate</name>
			<type>listtopic</type>
		</field>
		<field>
			<name>descr</name>
			<displayname>Descriptive name</displayname>
			<description>A name for administrative reference, to identify this certificate. This is also known as the certificate's "Common Name."</description>
			<type>input</type>
			<size>20</size>
			<bindstofield>ovpnserver->step9->certname</bindstofield>
		</field>
		<field>
			<name>keylength</name>
			<displayname>Key length</displayname>
			<description>&lt;br/&gt;Size of the key which will be generated. The larger the key, the more security it offers, but larger keys take considerably more time to generate, and take slightly longer to validate leading to a slight slowdown in setting up new sessions (not always noticeable). As of 2016, 2048 bit is the minimum and most common selection and 4096 is the maximum in common use. For more information see &lt;a href="https://keylength.com"&gt;keylength.com&lt;/a&gt;</description>
			<type>select</type>
			<value>2048</value>
			<bindstofield>ovpnserver->step9->keylength</bindstofield>
			<options>
				<option>
					<name>1024 bit</name>
					<value>1024</value>
				</option>
				<option>
					<name>2048 bit</name>
					<value>2048</value>
				</option>
				<option>
					<name>3072 bit</name>
					<value>3072</value>
				</option>
				<option>
					<name>4096 bit</name>
					<value>4096</value>
				</option>
				<option>
					<name>6144 bit</name>
					<value>6144</value>
				</option>
				<option>
					<name>7680 bit</name>
					<value>7680</value>
				</option>
				<option>
					<name>8192 bit</name>
					<value>8192</value>
				</option>
				<option>
					<name>15360 bit</name>
					<value>15360</value>
				</option>
				<option>
					<name>16384 bit</name>
					<value>16384</value>
				</option>
			</options>
		</field>
		<field>
			<name>lifetime</name>
			<displayname>Lifetime</displayname>
			<description>Lifetime in days. Server certificates should not have a lifetime over 398 days or some platforms may consider the certificate invalid.</description>
			<type>input</type>
			<size>10</size>
			<value>398</value>
			<bindstofield>ovpnserver->step9->lifetime</bindstofield>
		</field>
		<field>
			<name>country</name>
			<displayname>Country Code</displayname>
			<description>Two-letter ISO country code (e.g. US, AU, CA) </description>
			<type>input</type>
			<size>5</size>
			<bindstofield>ovpnserver->step9->country</bindstofield>
		</field>
		<field>
			<name>state</name>
			<displayname>State or Province</displayname>
			<description>Full State of Province name, not abbreviated (e.g. Kentucky, Indiana, Ontario).</description>
			<type>input</type>
			<size>30</size>
			<bindstofield>ovpnserver->step9->state</bindstofield>
		</field>
		<field>
			<name>city</name>
			<displayname>City</displayname>
			<description>City or other Locality name (e.g. Louisville, Indianapolis, Toronto).</description>
			<type>input</type>
			<size>30</size>
			<bindstofield>ovpnserver->step9->city</bindstofield>
		</field>
		<field>
			<name>organization</name>
			<displayname>Organization</displayname>
			<description>Organization name, often the Company or Group name.</description>
			<type>input</type>
			<size>30</size>
			<bindstofield>ovpnserver->step9->organization</bindstofield>
		</field>
		<field>
			<name>Create new Certificate</name>
			<type>submit</type>
		</field>
	</fields>
	<stepbeforeformdisplay>step9_stepbeforeformdisplay();</stepbeforeformdisplay>
	<stepsubmitphpaction>step9_submitphpaction();</stepsubmitphpaction>
	<includefile>/usr/local/www/wizards/openvpn_wizard.inc</includefile>
</step>
<step>
	<id>10</id>
	<title>Server Setup</title>
	<description>OpenVPN Remote Access Server Setup Wizard</description>
	<disableheader>true</disableheader>
	<fields>
		<field>
			<type>listtopic</type>
			<name>General OpenVPN Server Information</name>
		</field>
		<field>
			<name>interface</name>
			<type>select_source</type>
			<source><![CDATA[openvpn_wizard_build_if_list()]]></source>
			<source_name>name</source_name>
			<source_value>value</source_value>
			<description>The interface where OpenVPN will listen for incoming connections (typically WAN.)</description>
			<displayname>Interface</displayname>
			<bindstofield>ovpnserver->step10->interface</bindstofield>
		</field>
		<field>
			<name>Protocol</name>
			<type>select</type>
			<bindstofield>ovpnserver->step10->protocol</bindstofield>
			<options>
				<option>
					<name>UDP on IPv4 only</name>
					<value>UDP4</value>
				</option>
				<option>
					<name>UDP on IPv6 only</name>
					<value>UDP6</value>
				</option>
				<option>
					<name>TCP on IPv4 only</name>
					<value>TCP4</value>
				</option>
				<option>
					<name>TCP on IPv6 only</name>
					<value>TCP6</value>
				</option>
				<option>
					<name>UDP IPv4 and IPv6 on all interfaces (multihome)</name>
					<value>UDP</value>
				</option>
				<option>
					<name>TCP IPv4 and IPv6 on all interfaces (multihome)</name>
					<value>TCP</value>
				</option>
			</options>
			<description>&lt;br/&gt;Protocol to use for OpenVPN connections. If unsure, leave this set to UDP.</description>
		</field>
		<field>
			<name>localport</name>
			<displayname>Local Port</displayname>
			<description>Local port upon which OpenVPN will listen for connections. The default port is 1194. This can be left at its default unless a different port needs to be used.</description>
			<type>input</type>
			<size>10</size>
			<bindstofield>ovpnserver->step10->localport</bindstofield>
		</field>
		<field>
			<name>description</name>
			<displayname>Description</displayname>
			<description>A name for this OpenVPN instance, for administrative reference. It can be set however desired, but is often used to distinguish the purpose of the service (e.g. "Remote Technical Staff"). It is also used by OpenVPN Client Export to identify this VPN on clients.</description>
			<type>input</type>
			<size>30</size>
			<bindstofield>ovpnserver->step10->descr</bindstofield>
		</field>
		<field>
			<type>listtopic</type>
			<name>Cryptographic Settings</name>
		</field>
		<field>
			<name>TLS Authentication</name>
			<type>checkbox</type>
			<value>on</value>
			<description>Enable authentication of TLS packets.</description>
			<bindstofield>ovpnserver->step10->tlsauth</bindstofield>
		</field>
		<field>
			<displayname>Generate TLS Key</displayname>
			<name>generatetlskey</name>
			<disablefields>tlssharedkey</disablefields>
			<value>on</value>
			<type>checkbox</type>
			<description>Automatically generate a shared TLS authentication key.</description>
			<bindstofield>ovpnserver->step10->gentlskey</bindstofield>
		</field>
		<field>
			<displayname>TLS Shared Key</displayname>
			<name>tlssharedkey</name>
			<description>Paste in a shared TLS key if one has already been generated.</description>
			<type>textarea</type>
			<cols>30</cols>
			<rows>5</rows>
			<bindstofield>ovpnserver->step10->tlskey</bindstofield>
		</field>
		<field>
			<displayname>DH Parameters Length</displayname>
			<name>dhparameters</name>
			<type>select_source</type>
			<source><![CDATA[openvpn_wizard_get_dhparams()]]></source>
			<source_name>name</source_name>
			<source_value>value</source_value>
			<value>2048</value>
			<bindstofield>ovpnserver->step10->dhkey</bindstofield>
			<description>&lt;br/&gt;Length of Diffie-Hellman (DH) key exchange parameters, used for establishing a secure communications channel. The DH parameters are different from key sizes, but as with other such settings, the larger the key, the more security it offers, but larger keys take considerably more time to generate. As of 2016, 2048 bit is a common and typical selection.</description>
		</field>
		<field>
			<name>ncpenable</name>
			<displayname>Data Encryption Negotiation</displayname>
			<type>checkbox</type>
			<value>on</value>
			<description>
				Enable negotiation of Data Encryption Algorithms between client and server.
				The best practice is keep this setting enabled.
			</description>
			<bindstofield>ovpnserver->step10->ncpenable</bindstofield>
		</field>
		<field>
			<name>dataciphers</name>
			<type>select</type>
			<multiple>yes</multiple>
			<size>3</size>
			<disabled>yes</disabled>
			<displayname>Data Encryption Algorithms</displayname>
			<bindstofield>ovpnserver->step10->dataciphers</bindstofield>
			<value>AES-256-GCM,AES-128-GCM,CHACHA20-POLY1305</value>
			<options>
				<option>
					<name>AES-256-GCM</name>
					<value>AES-256-GCM</value>
				</option>
				<option>
					<name>AES-128-GCM</name>
					<value>AES-128-GCM</value>
				</option>
				<option>
					<name>CHACHA20-POLY1305</name>
					<value>CHACHA20-POLY1305</value>
				</option>
			</options>
			<description>
				&lt;br/&gt;List of algorithms clients can negotiate to encrypt traffic between endpoints.
				The best practice is to use the exact algorithms listed above, in that order.
				Certain algorithms will perform better on different hardware,
				depending on the availability of supported VPN accelerator chips.
				Edit the server after finishing the wizard for additional choices.
			</description>
		</field>
		<field>
			<name>dataciphersfallback</name>
			<type>select</type>
			<displayname>Fallback Data Encryption Algorithm</displayname>
			<bindstofield>ovpnserver->step10->dataciphersfallback</bindstofield>
			<value>AES-256-CBC</value>
			<options>
				<option>
					<name>dummy</name>
					<value>dummy</value>
				</option>
			</options>
			<description>&lt;br/&gt;The algorithm used to encrypt traffic between endpoints when data encryption negotiation is diabled or fails.</description>
		</field>
		<field>
			<name>digest</name>
			<type>select</type>
			<displayname>Auth Digest Algorithm</displayname>
			<bindstofield>ovpnserver->step10->digest</bindstofield>
			<options>
				<option>
					<name>dummy</name>
					<value>dummy</value>
				</option>
			</options>
			<value>SHA256</value>
			<description>&lt;br/&gt;The method used to authenticate traffic between endpoints. This setting must match on the client and server side, but is otherwise set however desired.</description>
		</field>
		<field>
			<name>engine</name>
			<type>select</type>
			<displayname>Hardware Crypto</displayname>
			<bindstofield>ovpnserver->step10->engine</bindstofield>
			<options>
				<option>
					<name>dummy</name>
					<value>dummy</value>
				</option>
			</options>
			<description>&lt;br/&gt;The hardware cryptographic accelerator to use for this VPN connection, if any.</description>
		</field>
		<field>
			<type>listtopic</type>
			<name>Tunnel Settings</name>
		</field>
		<field>
			<displayname>Tunnel Network</displayname>
			<name>tunnelnet</name>
			<type>input</type>
			<size>20</size>
			<bindstofield>ovpnserver->step10->tunnelnet</bindstofield>
			<description>This is the virtual network used for private communications between this server and client hosts expressed using CIDR notation (eg. 10.0.8.0/24). The first network address will be assigned to the server virtual interface. The remaining network addresses will be assigned to connecting clients.</description>
		</field>
		<field>
			<displayname>Redirect Gateway</displayname>
			<name>redirectgw</name>
			<type>checkbox</type>
			<description>Force all client generated traffic through the tunnel.</description>
			<bindstofield>ovpnserver->step10->rdrgw</bindstofield>
		</field>
		<field>
			<displayname>Local Network</displayname>
			<name>localnet</name>
			<type>input</type>
			<size>20</size>
			<bindstofield>ovpnserver->step10->localnet</bindstofield>
			<description>This is the network that will be accessible from the remote endpoint, expressed as a CIDR range. This may be left blank if not adding a route to the local network through this tunnel on the remote machine. This is generally set to the LAN network.</description>
		</field>
		<field>
			<displayname>Concurrent Connections</displayname>
			<name>concurrentcon</name>
			<description>Specify the maximum number of clients allowed to concurrently connect to this server.</description>
			<type>input</type>
			<size>10</size>
			<bindstofield>ovpnserver->step10->concurrentcon</bindstofield>
		</field>
		<field>
			<displayname>Allow Compression</displayname>
			<name>allowcompression</name>
			<description>
				&lt;br/&gt;Allow compression to be used with this VPN instance, which is potentially insecure.</description>
			<bindstofield>ovpnserver->step10->allowcompression</bindstofield>
			<type>select</type>
			<value>no</value>
			<options>
				<option>
					<name>dummy</name>
					<value>dummy</value>
				</option>
			</options>
		</field>
		<field>
			<displayname>Compression</displayname>
			<name>compression</name>
			<description>
				&lt;br/&gt;Compress tunnel packets using the chosen option. Can save bandwidth, but is potentially insecure and may expose data.
				This setting has no effect if compression is not allowed.
				Adaptive compression will dynamically disable compression for a period of time if OpenVPN detects that the data in the packets is not being compressed efficiently.
			</description>
			<bindstofield>ovpnserver->step10->compression</bindstofield>
			<type>select</type>
			<options>
				<option>
					<name>dummy</name>
					<value>dummy</value>
				</option>
			</options>
		</field>
		<field>
			<displayname>Type-of-Service</displayname>
			<name>tos</name>
			<type>checkbox</type>
			<description>Set the TOS IP header value of tunnel packets to match the encapsulated packet's TOS value.</description>
			<bindstofield>ovpnserver->step10->tos</bindstofield>
		</field>
		<field>
			<displayname>Inter-Client Communication</displayname>
			<name>interclient</name>
			<type>checkbox</type>
			<description>Allow communication between clients connected to this server.</description>
			<bindstofield>ovpnserver->step10->interclient</bindstofield>
		</field>
		<field>
			<displayname>Duplicate Connections</displayname>
			<name>duplicate_cn</name>
			<type>checkbox</type>
			<description>Allow multiple concurrent connections from clients using the same Common Name.&lt;br/&gt;NOTE: This is not generally recommended, but may be needed for some scenarios.</description>
			<bindstofield>ovpnserver->step10->duplicate_cn</bindstofield>
		</field>
		<field>
			<type>listtopic</type>
			<name>Client Settings</name>
		</field>
		<field>
			<displayname>Dynamic IP</displayname>
			<name>dynip</name>
			<type>checkbox</type>
			<value>on</value>
			<description>Allow connected clients to retain their connections if their IP address changes.</description>
			<bindstofield>ovpnserver->step10->dynip</bindstofield>
		</field>
		<field>
			<displayname>Topology</displayname>
			<name>topology</name>
			<type>select</type>
			<value>subnet</value>
			<bindstofield>ovpnserver->step10->topology</bindstofield>
			<options>
				<option>
					<name>Subnet -- One IP address per client in a common subnet</name>
					<value>subnet</value>
				</option>
				<option>
					<name>net30 -- Isolated /30 network per client</name>
					<value>net30</value>
				</option>
			</options>
			<description>Specifies the method used to supply a virtual adapter IP address to clients when using tun mode on IPv4.&lt;br /&gt;Some clients may require this be set to &quot;subnet&quot; even for IPv6, such as OpenVPN Connect (iOS/Android).&lt;br /&gt;Older versions of OpenVPN (before 2.0.9) or clients such as Yealink phones may require &quot;net30&quot;.</description>
		</field>
		<field>
			<displayname>DNS Default Domain</displayname>
			<name>defaultdomain</name>
			<type>input</type>
			<description>Provide a default domain name to clients.</description>
			<bindstofield>ovpnserver->step10->defaultdomain</bindstofield>
		</field>
		<field>
			<displayname>DNS Server 1</displayname>
			<name>dnsserver1</name>
			<type>input</type>
			<bindstofield>ovpnserver->step10->dns1</bindstofield>
			<description>DNS server IP to provide to connecting clients.</description>
		</field>
		<field>
			<displayname>DNS Server 2</displayname>
			<name>dnserver2</name>
			<type>input</type>
			<bindstofield>ovpnserver->step10->dns2</bindstofield>
			<description>DNS server IP to provide to connecting clients.</description>
		</field>
		<field>
			<displayname>DNS Server 3</displayname>
			<name>dnserver3</name>
			<type>input</type>
			<bindstofield>ovpnserver->step10->dns3</bindstofield>
			<description>DNS server IP to provide to connecting clients.</description>
		</field>
		<field>
			<displayname>DNS Server 4</displayname>
			<name>dnserver4</name>
			<type>input</type>
			<bindstofield>ovpnserver->step10->dns4</bindstofield>
			<description>DNS server IP to provide to connecting clients.</description>
		</field>
		<field>
			<displayname>NTP Server</displayname>
			<name>ntpserver1</name>
			<type>input</type>
			<bindstofield>ovpnserver->step10->ntp1</bindstofield>
			<description>Network Time Protocol server to provide to connecting clients.</description>
		</field>
		<field>
			<displayname>NTP Server 2</displayname>
			<name>ntpserver2</name>
			<type>input</type>
			<bindstofield>ovpnserver->step10->ntp2</bindstofield>
			<description>Network Time Protocol server to provide to connecting clients.</description>
		</field>
		<field>
			<name>nbtenable</name>
			<type>checkbox</type>
			<displayname>NetBIOS Options</displayname>
			<bindstofield>ovpnserver->step10->nbtenable</bindstofield>
			<description>Enable NetBIOS over TCP/IP. &lt;br/&gt;If this option is not set, all NetBIOS-over-TCP/IP options (including WINS) will be disabled. </description>
		</field>
		<field>
			<displayname>NetBIOS Node Type</displayname>
			<name>nbttype</name>
			<type>select</type>
			<bindstofield>ovpnserver->step10->nbttype</bindstofield>
			<options>
				<option>
					<name>dummy</name>
					<value>dummy</value>
				</option>
			</options>
			<description>&lt;br/&gt;Possible options: b-node (broadcasts), p-node (point-to-point name queries to a WINS server), m-node (broadcast then query name server), and h-node (query name server, then broadcast).</description>
		</field>
		<field>
			<displayname>NetBIOS Scope ID</displayname>
			<name>nbtscope</name>
			<type>input</type>
			<bindstofield>ovpnserver->step10->nbtscope</bindstofield>
			<description>A NetBIOS Scope ID provides an extended naming service for NetBIOS over TCP/IP. The NetBIOS scope ID isolates NetBIOS traffic on a single network to only those nodes with the same NetBIOS scope ID.</description>
		</field>
		<field>
			<displayname>WINS Server 1</displayname>
			<name>winsserver1</name>
			<type>input</type>
			<bindstofield>ovpnserver->step10->wins1</bindstofield>
			<description>A Windows Internet Name Service (WINS) server IP to provide to connecting clients. Not desirable in most all modern networks.</description>
		</field>
		<field>
			<displayname>WINS Server 2</displayname>
			<name>winsserver2</name>
			<type>input</type>
			<bindstofield>ovpnserver->step10->wins2</bindstofield>
			<description>A Windows Internet Name Service (WINS) server IP to provide to connecting clients. Not desirable in most all modern networks.</description>
		</field>
		<field>
			<name>Next</name>
			<type>submit</type>
		</field>
	</fields>
	<stepbeforeformdisplay>step10_stepbeforeformdisplay();</stepbeforeformdisplay>
	<stepsubmitphpaction>step10_submitphpaction();</stepsubmitphpaction>
	<includefile>/usr/local/www/wizards/openvpn_wizard.inc</includefile>
</step>
<step>
	<id>11</id>
	<title>Firewall Rule Configuration</title>
	<description>OpenVPN Remote Access Server Setup Wizard</description>
	<disableheader>true</disableheader>
	<fields>
		<field>
			<type>listtopic</type>
			<name>Firewall Rule Configuration</name>
		</field>
		<field>
			<type>text</type>
			<description>Firewall rules control what network traffic is permitted. Rules must be added to allow traffic to the OpenVPN server's IP and port, as well as allowing traffic from connected clients through the tunnel. These rules can be automatically added here, or configured manually after completing the wizard.</description>
		</field>
		<field>
			<type>listtopic</type>
			<name>Traffic from clients to server</name>
		</field>
		<field>
			<name>ovpnrule</name>
			<displayname>Firewall Rule</displayname>
			<description>Add a rule to permit connections to this OpenVPN server process from clients anywhere on the Internet.</description>
			<type>checkbox</type>
			<bindstofield>ovpnserver->step11->ovpnrule</bindstofield>
		</field>
		<field>
			<type>listtopic</type>
			<name>Traffic from clients through VPN</name>
		</field>
		<field>
			<name>ovpnallow</name>
			<displayname>OpenVPN rule</displayname>
			<description>Add a rule to allow all traffic from connected clients to pass inside the VPN tunnel.</description>
			<type>checkbox</type>
			<bindstofield>ovpnserver->step11->ovpnallow</bindstofield>
		</field>
		<field>
			<name>Next</name>
			<type>submit</type>
		</field>
	</fields>
</step>
<step>
	<id>12</id>
	<title>Finished!</title>
	<description>OpenVPN Remote Access Server Setup Wizard</description>
	<disableheader>true</disableheader>
	<fields>
		<field>
			<type>listtopic</type>
			<name>Configuration Complete!</name>
		</field>
		<field>
			<type>text</type>
			<description>The configuration is now complete.</description>
		</field>
		<field>
			<type>text</type>
			<description>To be able to export client configurations, browse to System->Packages and install the OpenVPN Client Export package.</description>
		</field>
		<field>
			<type>submit</type>
			<name>Finish</name>
		</field>
	</fields>
	<stepsubmitphpaction>step12_submitphpaction();</stepsubmitphpaction>
	<includefile>/usr/local/www/wizards/openvpn_wizard.inc</includefile>
</step>
</pfsensewizard>
