Hacker News Reader

The OpenVPN section is misleading. The dh option is only supported on the server side. If you try to use it on the client side (which is what this guide appears to be tailored towards) it will be ignored and you'll use whatever DH parameters the server provides.

View on HN

It may be misleading but also in the sense that there's no recommendation to just drop VPN altogether. How about we just stop relying on terribly over-designed protocols such as VPN and IPSec? Complexity is the enemy of security.

We use OpenVPN at work to provide layer 2 access to a management network that uses a /24 out of the 10/8 range.

How else do you think we should do this?

MinimaLT http://cr.yp.to/tcpip/minimalt-20130522.pdf

Reply on news.ycombinator.com