OpenVPN

[Starym]

I had to add "block-outside-dns" to the default exported OpenVPN configuration, it would be nice if it was included by default or maybe add an option to enable it.
I also added "auth-nocache" since it was suggested in red colors in my client.

Are there any downsides to having those features enabled? Privacy wise it can prevent DNS leaks (block-outside-dns).

 

[RMerlin]

I had to add "block-outside-dns" to the default exported OpenVPN configuration, it would be nice if it was included by default or maybe add an option to enable it.

That setting only works on Windows, that's why it's not exported by default, as it would be incompatible with non-Windows clients.

I also added "auth-nocache" since it was suggested in red colors in my client.

This is a matter of personal preferences, and in some case it might once again not be compatible, hence why it's not there by default.

The exported configuration aims to be as widely compatible as possible, not to be as tightly secured as some people might want. For instance, "DNS leaks" are not a concern when the goal is to connect to your home router. In fact, in many cases people will prefer NOT to use the DNS from their home router.

Adding settings for these seldom-used options are also out of question, as some router models are already running out of available nvram for settings. Any new nvram setting, even when unset, will take up valuable nvram space. I spent a lot of time last year actually reviewing each VPN setting to determine how I can finetune things to reduce the number of available settings. Asuswrt-Merlin already offers like 5x more settings than any other OpenVPN-compatible solution I have seen.

 

[Starym]

Understood. Thanks for your quick response!

Btw, I'm using the block-outside-dns setting in the config in OpenVPN on my iPhone and it seems to be working.

 

[RMerlin]

Btw, I'm using the block-outside-dns setting in the config in OpenVPN on my iPhone and it seems to be working.

It's most likely not doing anything at all - it's a Win32-specific feature.