Hi,
1st, thx for your step-by-step document.
few comments :
- don't use standard openvpn TCP port. Personnnaly, I use UDP and a custom port (even if I have another router before internet).
- your admin login should be replaced by something else than "cisco"
- prefer full tunnelling (more compatible for Android phones, and all packets go through your vpn, and not over a free public wifi, for example)
- you can also use the internal firewall rules to allow or block incomming traffic to the vpn (for example, allow one IP if it's for homeworking, or allow only during the day, and block everything else for that vpn. Like that you can use log alerts for intrusion)
- log > System Log > activate the log of "Deny Policies" and fullfilled the email setup. Like that you will discover that TCP and 1194 is not a good idea even if no one know your router exist !!! I was thinking it was a myth, for scaring children, but no, internet is constantly scanned for vulnerabilities and rarely by good guys.
note concerning UDP vs TCP :
if you use wireshark a bit, you will discover that TCP is more verbose than UDP regarding the openvpn server. If you use UDP, your vpn will not be verbose anymore (server version, ...).
if you still use TCP, you will transmitt in clear some important information. Not critical directly, but can help an attacker to identify the server software, and its security holes... If I well remember, it give the version of the openvpn server, the CA name (if your name or company is in, it could be a problem because you are exposing it to the internet), ...
Bye
