1. Zkopírovat nástroje z adresáře /usr/share/easy-rsa.
2. Upravit soubor vars.example.
   1. Volitelně eliptické křivky:
      1. set_var EASYRSA_ALGO ec
      2. set_var EASYRSA_CURVE secp384r1

# ./easyrsa init-pki
# ./easyrsa build-ca nopass
# ./easyrsa build-server-full <nazevserveru> nopass
# ./easyrsa build-client-full <jmenoklienta> nopass
# ./easyrsa gen-dh

1. server:
   1. pki/ca.crt
   2. pki/private/<nazevserveru>.key
   3. pki/issued/<nazevserveru>.crt
   4. pki/dh.pem
2. klient:
   1. pki/ca.crt
   2. pki/private/<jmenoklienta>.key
   3. pki/issued/<jmenoklienta>.crt

openvpn --genkey --secret ta.key

server 172.17.255.0 255.255.255.0
port 1194
proto udp

topology subnet

dev tun

user nobody
group nogroup

persist-key
persist-tun

remote-cert-tls client
cipher AES-256-GCM

client-to-client

# ifconfig-pool-persist ipp.txt

keepalive 10 120
compress lz4

log /var/log/openvpn/<mujserver>.log
verb 3
mute 10

ca       [inline]
cert     [inline]
key      [inline]
dh       [inline]
tls-auth [inline]
key-direction 0

<cert>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
</key>

<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>

<dh>
-----BEGIN DH PARAMETERS-----
...
-----END DH PARAMETERS-----
</dh>  

<tls-auth>
-----BEGIN OpenVPN Static key V1-----
...
-----END OpenVPN Static key V1-----
</tls-auth>

client

dev tun
dev-node tap0 <-- název síťového připojení musí být "tap0"

<connection>
remote <server-hostname> 1194 udp
</connection>
nobind

resolv-retry infinite
persist-key
persist-tun

remote-cert-tls server
cipher AES-256-GCM

compress lz4

log "..\\log\\<firma>-<username>log"
verb 3
mute 10

ca       [inline]
cert     [inline]
key      [inline]
tls-auth [inline]
key-direction 1

<cert>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
</key>

<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>

<tls-auth>
-----BEGIN OpenVPN Static key V1-----
...
-----END OpenVPN Static key V1-----
</tls-auth>